Risk professionals in organisations with a broken risk culture need to navigate the effectiveness trap: how people inside powerful or corrupted institutions may tolerate actions they oppose to preserve access and influence. This includes exploring the moral uncertainty of working from within, the risks of dissent, and how a principled resignation can end up accelerating cultural norms that favour conformity over accountability.

By examining where football analysis goes wrong we can learn a lot about how organisational analysis – and risk analysis – can falter. The lesson is that good organisational analysis recognises the difference between good performance and good outcomes, it creates and tests theories on what improves performance, and it seeks out new data where existing information is insufficient.

Risk teams should examine not only whether a risk framework is complete, but how it was constructed. A sociological lens can reveal hidden assumptions, challenge inherited categories and expose gaps between the risks an organisation faces and the risks it is prepared to recognise. They need to ask “Why have we chosen to define risks this way, and what does that choice prevent us from seeing?”

How business say they use committees to make decisions, and what happens in practice rarely align. This matters because decision processes can be easily corrupted in ways that are often invisible or unidentified by decision-makers. If risk teams are not empowered to challenge the design, operation and outcome of decision systems then the most material source of organisational risk is unmanaged.

Research on defensive decision-making suggests between 20% and 50% of business decisions are defensive. Risk frameworks need to challenge decision-making processes effectively while also protecting decision-makers when well-made decisions lead to bad outcomes. Risk teams need to help the business define what “fairness” looks like for decision-makers at every level of seniority.

Risk Management only works when an organisation has a shared understand of what matters, why it matters, and how uncertainty should be managed. When people are asked to make decisions without a clear sense of organisational meaning and purpose, we end up with organisational nihilism. Individuals are left to create their own meaning, leading to conflict, inconsistency in approach, and ineffective risk management.

Top-down risk culture frameworks and monitoring are useful, but they only take firms so far. Risk teams can build stronger frameworks, better challenge, and more resilient organisations by adding a bottom-up, decision-focused lens inspired by Mary Parker Follett’s idea of collaborative “Power With”.

Risk teams should recognise the explicit and implicit incentives that influence how frameworks are designed and how challenge is delivered, because only by making those pressures visible can they decide when standard approaches are useful and when they need to be adapted or temporarily abandoned.

Foucault’s ideas about power, knowledge, and the limits of systems make him a risk management role model.

Risk frameworks are often oblivious to power dynamics, instead focusing on the robustness of the decision-making methodology and its application. This can undermine the effectiveness of risk assessments, particularly with respect to change initiatives where the impact of power dynamics is often elevated.

How to tailor risk team stategy to the culture of the organisation to increase the likelihood that valid challenge will be constructively engaged with.

IT teams talk a lot about Technical Debt, but it is a really powerful lens for risk teams to use when thinking more broadly about their organisation.

Integrating organisational psychology into the risk management toolset.