Risk Culture

Risk professionals in organisations with a broken risk culture need to navigate the effectiveness trap: how people inside powerful or corrupted institutions may tolerate actions they oppose to preserve access and influence. This includes exploring the moral uncertainty of working from within, the risks of dissent, and how a principled resignation can end up accelerating cultural norms that favour conformity over accountability.

Flawed processes that “feel right” are prevalent within organisations, even when there is little evidence that they work. Risk management is not immune. Some of our standard tools and practices may be giving false comfort simply because they look and feel right. Risk teams need stronger decision analysis capabilities to challenge this kind of thinking: not just asking whether a proposal feels plausible, but whether it is supported by clear logic and evidence.

Research on defensive decision-making suggests between 20% and 50% of business decisions are defensive. Risk frameworks need to challenge decision-making processes effectively while also protecting decision-makers when well-made decisions lead to bad outcomes. Risk teams need to help the business define what “fairness” looks like for decision-makers at every level of seniority.

Risk Management only works when an organisation has a shared understand of what matters, why it matters, and how uncertainty should be managed. When people are asked to make decisions without a clear sense of organisational meaning and purpose, we end up with organisational nihilism. Individuals are left to create their own meaning, leading to conflict, inconsistency in approach, and ineffective risk management.

Top-down risk culture frameworks and monitoring are useful, but they only take firms so far. Risk teams can build stronger frameworks, better challenge, and more resilient organisations by adding a bottom-up, decision-focused lens inspired by Mary Parker Follett’s idea of collaborative “Power With”.

Business norms can be critical to organisational success, but only become noticeable when they stop working or start to become harmful. Changes in strategy, company size, or personnel are the most likely causes for the undermining or corruption of business norms. Risk teams can benefit from identifying, documenting and evaluating business norms, especially when they have an unacknowledged impact on the decision-making process.

Whistleblowing is an extreme form of dissent. How organisations seek to disrupt, ignore and discredit whistleblowers provides insight into how organisations seek to actively silence unwanted dissent and challenge more generally.

Ideology (our values, assumptions, and mental shortcuts) shapes what we notice, trust, and consider acceptable, especially when data is limited or uncertainty is high. While ideology can enable speed and coherence, unchallenged or dominant worldviews create blind spots, making it critical for organisations and risk teams to surface assumptions, encourage diverse perspectives, and question the stories they tell about themselves.

Risk frameworks often fail because they overlook how formal, informal, and personal incentives, stress, and loss‑framing predictably shape human behaviour, especially under pressure.

How Risk teams can use assessments of organisations' Overton Windows and Social Capital to build strategies to drive more effective challenge.

Risk teams require a "social license" to provide effective challenge. This can be measured and used to support risk management strategy.