How Risk Frameworks Fail

How business say they use committees to make decisions, and what happens in practice rarely align. This matters because decision processes can be easily corrupted in ways that are often invisible or unidentified by decision-makers. If risk teams are not empowered to challenge the design, operation and outcome of decision systems then the most material source of organisational risk is unmanaged.

Flawed processes that “feel right” are prevalent within organisations, even when there is little evidence that they work. Risk management is not immune. Some of our standard tools and practices may be giving false comfort simply because they look and feel right. Risk teams need stronger decision analysis capabilities to challenge this kind of thinking: not just asking whether a proposal feels plausible, but whether it is supported by clear logic and evidence.

Risk event processes can incentivise organisations to add low‑value controls that protect individuals from blame but gradually erode judgement, empowerment, and adaptability. Over time, this control‑heavy response to failures makes organisations more brittle; better at managing yesterday’s risks, but less able to respond intelligently to future shocks.