By examining where football analysis goes wrong we can learn a lot about how organisational analysis – and risk analysis – can falter. The lesson is that good organisational analysis recognises the difference between good performance and good outcomes, it creates and tests theories on what improves performance, and it seeks out new data where existing information is insufficient.

How business say they use committees to make decisions, and what happens in practice rarely align. This matters because decision processes can be easily corrupted in ways that are often invisible or unidentified by decision-makers. If risk teams are not empowered to challenge the design, operation and outcome of decision systems then the most material source of organisational risk is unmanaged.

Flawed processes that “feel right” are prevalent within organisations, even when there is little evidence that they work. Risk management is not immune. Some of our standard tools and practices may be giving false comfort simply because they look and feel right. Risk teams need stronger decision analysis capabilities to challenge this kind of thinking: not just asking whether a proposal feels plausible, but whether it is supported by clear logic and evidence.

Research on defensive decision-making suggests between 20% and 50% of business decisions are defensive. Risk frameworks need to challenge decision-making processes effectively while also protecting decision-makers when well-made decisions lead to bad outcomes. Risk teams need to help the business define what “fairness” looks like for decision-makers at every level of seniority.