Research on defensive decision-making suggests between 20% and 50% of business decisions are defensive. Risk frameworks need to challenge decision-making processes effectively while also protecting decision-makers when well-made decisions lead to bad outcomes. Risk teams need to help the business define what “fairness” looks like for decision-makers at every level of seniority.

Risk Management only works when an organisation has a shared understand of what matters, why it matters, and how uncertainty should be managed. When people are asked to make decisions without a clear sense of organisational meaning and purpose, we end up with organisational nihilism. Individuals are left to create their own meaning, leading to conflict, inconsistency in approach, and ineffective risk management.

Risk teams should recognise the explicit and implicit incentives that influence how frameworks are designed and how challenge is delivered, because only by making those pressures visible can they decide when standard approaches are useful and when they need to be adapted or temporarily abandoned.

Risk frameworks often fail because they overlook how formal, informal, and personal incentives, stress, and loss‑framing predictably shape human behaviour, especially under pressure.