Risk Culture

Risk Management only works when an organisation has a shared understand of what matters, why it matters, and how uncertainty should be managed. When people are asked to make decisions without a clear sense of organisational meaning and purpose, we end up with organisational nihilism. Individuals are left to create their own meaning, leading to conflict, inconsistency in approach, and ineffective risk management.

Top-down risk culture frameworks and monitoring are useful, but they only take firms so far. Risk teams can build stronger frameworks, better challenge, and more resilient organisations by adding a bottom-up, decision-focused lens inspired by Mary Parker Follett’s idea of collaborative “Power With”.

Business norms can be critical to organisational success, but only become noticeable when they stop working or start to become harmful. Changes in strategy, company size, or personnel are the most likely causes for the undermining or corruption of business norms. Risk teams can benefit from identifying, documenting and evaluating business norms, especially when they have an unacknowledged impact on the decision-making process.

Whistleblowing is an extreme form of dissent. How organisations seek to disrupt, ignore and discredit whistleblowers provides insight into how organisations seek to actively silence unwanted dissent and challenge more generally.

Ideology (our values, assumptions, and mental shortcuts) shapes what we notice, trust, and consider acceptable, especially when data is limited or uncertainty is high. While ideology can enable speed and coherence, unchallenged or dominant worldviews create blind spots, making it critical for organisations and risk teams to surface assumptions, encourage diverse perspectives, and question the stories they tell about themselves.

Risk frameworks often fail because they overlook how formal, informal, and personal incentives, stress, and loss‑framing predictably shape human behaviour, especially under pressure.

How Risk teams can use assessments of organisations' Overton Windows and Social Capital to build strategies to drive more effective challenge.

Risk teams require a "social license" to provide effective challenge. This can be measured and used to support risk management strategy.