Flawed processes that “feel right” are prevalent within organisations, even when there is little evidence that they work. Risk management is not immune. Some of our standard tools and practices may be giving false comfort simply because they look and feel right. Risk teams need stronger decision analysis capabilities to challenge this kind of thinking: not just asking whether a proposal feels plausible, but whether it is supported by clear logic and evidence.

Research on defensive decision-making suggests between 20% and 50% of business decisions are defensive. Risk frameworks need to challenge decision-making processes effectively while also protecting decision-makers when well-made decisions lead to bad outcomes. Risk teams need to help the business define what “fairness” looks like for decision-makers at every level of seniority.

Foucault’s ideas about power, knowledge, and the limits of systems make him a risk management role model.

Ideology (our values, assumptions, and mental shortcuts) shapes what we notice, trust, and consider acceptable, especially when data is limited or uncertainty is high. While ideology can enable speed and coherence, unchallenged or dominant worldviews create blind spots, making it critical for organisations and risk teams to surface assumptions, encourage diverse perspectives, and question the stories they tell about themselves.