Defensive Decision-Making: Implications for Risk Management

TL;DR:  Too often, risk and governance frameworks assume that senior leaders will always act in the organisation’s best interests. Research on defensive decision-making suggests that assumption is unsafe: research suggests that between 20% and 50% of business decisions are defensive.

Defensive decision-making happens when employees choose the personally safer option, rather than the option that best serves the organisation. Calling out defensive decision-making is politically difficult for risk teams. But failing to do so is a failure of risk management. Risk frameworks need to challenge decision-making processes effectively while also protecting decision-makers when well-made decisions lead to bad outcomes. Risk teams need to help the business define what “fairness” looks like for decision-makers at every level of seniority.

The views and opinions expressed on this account are my own and do not reflect the official policy or position of my employer.  Any content provided is for informational purposes only and should not be considered or relied upon as professional advice.

I was recently reading about how ethics specialists were sidelined during the Covid pandemic (as one does), and how that reflected a form of defensive decision-making. It got me thinking about how damaging defensive decision-making can be, and what risk teams can do to combat it.

Defensive Decision-Making

Defensive decision-making happens when employees choose the personally safer option, rather than the option that best serves the organisation[i]. It is common: research suggests that between 20% and 50% of business decisions are defensive.

It is more likely when:

• Individuals make decisions under high uncertainty;

• They are explicitly or implicitly incentivised to prioritise avoiding negative outcomes over positive upsides;

• There is a blame culture that seeks scapegoats; and

• The decision-maker fears social rejection.

Defensive decision-making can take a variety of forms:[ii]

1. Uncertainty avoidance: favouring short-term, lower-risk options over choices with uncertain future benefits.

2. Quasi-resolution of conflict: choosing an option that temporarily accommodates and resolves disagreement, without resolving the underlying conflict.

3. Problemistic search: looking for alternative options only after current performance falls short of expectations.

Bioethicists and Covid in the USA: A Case Study[iii]

Who are bioethicists?

Bioethics emerged as a distinct field in the 1970s. Its purpose was to bring moral reasoning into difficult medical decisions and to provide a check on the power of scientists and physicians. In that sense, bioethicists play a similar role to risk teams: they are rarely the final decision-maker, but they help decision-makers identify options, clarify stakeholder objectives, and spot ethical pitfalls. Their value is greatest in rare, extreme, or novel situations where the existing playbook does not provide a clear or appropriate answer.

Why do we need them?

At the heart of bioethics is an attempt to define what “fairness” means in practice. There is no perfect definition of “fairness”, and there are competing, conflicting schools of thought used within the bioethics discipline. Whilst a perfect solution may be beyond anyone’s reach, what bioethicists are good at is identifying the ethical dilemmas that need to be explicitly addressed. For example, if hospitals run out of ventilators, how should they be allocated? When equipment is scarce, is it better to treat three people properly, or six people inadequately?

In the US, Covid disproportionately killed ethnic minorities, people with pre-existing conditions, the elderly, and people with disabilities. A triage framework based only on who was most likely to survive would therefore place a disproportionate burden on specific groups (the old, the sick, the poor).

A clear framework for triage, treatment choices, and equipment rationing helps medical staff focus on decisions that align with their expertise. It also protects them from having to make complex ethical decisions in very difficult circumstances, and shields them from civil or legal consequences.

How were they used in Covid?

As with risk teams, bioethicists have two main roles: building frameworks that support decision-making, and providing ad-hoc advice on specific decisions. They also think through new, emerging, or extreme situations where existing processes start to break down.

Ad-hoc advisory

Many bioethicist teams worked around the clock, providing case-by-case ethics consultations. In one hospital, a (small) bioethics team provided 2,500 consultations in one eight-week period.  These consultations attempted to provide moral clarity to doctors facing immediate problems with no protocol, no obviously “fair answer”, and (often) life-or-death consequences.

Frameworks to support decision-making

Bioethicists also developed frameworks to help decision-making under the specific circumstances created by Covid. However, across the US, federal and state health departments failed to implement key recommendations. In most states, implementing recommendations required government action that didn't happen. The consequences included:

• Physicians could not withhold CPR even when they believed it was futile, despite low success rates and high Covid transmission risk for medical staff.

• Hospitals lacked authority to sequester or restrain patients, including Covid patients who wanted to be discharged against medical advice but could not safely isolate.

• Legal immunity remained unclear, leaving doctors worried about personal and professional risk. Although limited civil and criminal immunity was promised, health departments often failed to provide practical guidance.

• Assumptions around the balance between patient needs and the infection risk to doctors and staff were not updated for Covid, leading to sub-optimal treatment approaches.

• No triage protocol was in place to guide the prioritisation of scarce resources, and triage committees were not activated. Many hospitals left these decisions to doctors’ discretion.

A Clear Case of Defensive Decision-Making

“What we learned is that no matter how good the ethical guidance, governors are incredibly reluctant to actually implement explicit triage.”

Governors, health commissioners, and many hospital leaders decided that the personally and politically safer option was to avoid making a decision. Each time someone in authority passed responsibility down the chain, they knew that they were pushing the decision closer to the bedside. Tired doctors and nurses, who were not ethics specialists, were left to make life-and-death choices. Rather than make a visible political decision that could be criticised, leaders allowed many invisible clinical decisions to be made under pressure, increasing suffering and harm.

How to Combat Defensive Decision-Making

A combination of low psychological safety and low authentic leadership increases the likelihood that decisions will be made defensively.

Psychological Safety

In 2012, Google launched “Project Aristotle”[iv] to understand what factors the most successful teams had in common.  It concluded that group norms relating to five factors were most important: psychological safety, dependability, structure and clarity, meaning, and impact.  Of these factors, by far the most important was psychological safety.

Amy Edmondson, a Harvard Business School professor, defines psychological safety as a “shared belief held by members of a team that the team is safe for interpersonal risk taking… it is a sense of confidence that the team will not embarrass, reject, or punish someone for speaking up, it describes a team climate characterised by interpersonal trust and mutual respect in which people are comfortable being themselves”.[v]

Authentic Leadership

In this definition, authentic leaders demonstrate and communicate clear and consistent personal values, which are resistant to pressure from peers.  They are self-aware, understand their own strengths and weaknesses, consider information fairly, and communicate openly with others.

This matters because authentic leadership can reduce the fear that decision makers feel when an outcome might attract criticism. It can also encourage people to act in the best interests of the organisation and the wider group, rather than choosing the safest option for themselves.

The Role of Risk Teams

Defensive decision-making often produces weak risk management. Good risk decisions can be politically difficult: they require spending, effort, and attention, all to reduce the impact of events that may never happen. They also require an honest interrogation of uncertainty and of outcomes the business would prefer not to face. These conversations are more uncomfortable when leaders are primarily focused on personal safety.

If the research is correct – that 20% to 50% of business decisions are defensive – then risk frameworks and challenge processes that ignore the existence of defensive decision-making are incomplete. Risk teams need processes and engagement models that support psychological safety, encourage authentic leadership, and explicitly call out defensive decisions when they appear. Too often, decision-making processes either sit outside the risk framework or are only addressed indirectly.

Psychological safety does not mean shielding senior decision-makers from accountability. The boundary is not always easy to draw: creating space for (bounded) failure can start to look like excusing poor decisions, while maintaining accountability can slide into a blame game. Risk frameworks can help define those boundaries more clearly.

As with bioethicists, risk teams need to build decision-making frameworks and support ad-hoc decisions. Both matter, but frameworks matter more because they shape the conditions in which decisions are made.

Decision-making frameworks

Frameworks should ensure that material decisions properly address four things: purpose, methodology, outcome, and asessment.

1. Purpose: define the business problem clearly, including relevant uncertainties, and explain the success criteria over the short, medium, and long term.

2. Methodology: define the decision-making approach, including key assumptions and limitations

3. Outcome: justify the proposed decision against the stated purpose and methodology. 

4. Assessment: measure whether the decision ended up aligning with the purpose. Implement a feedback loop to improve the methodology for future decisions.

Without these steps, it is difficult for risk teams to challenge poor decision-making or surface defensive decision-making.  A robust, well-understood decision process creates psychological safety because it reduces the perceived need for self-preservation and keeps attention on organisational outcomes.

Risk teams are critical to making sure each step is carried out in good faith and with sufficient rigour. They also help ensure that approaches to defining purpose and setting methodology are consistent across the organisation. A good risk appetite framework supports this because it will have already identified key sources of uncertainty, set agreed methods for assessing them, and defined how much uncertainty the business is willing to tolerate in each area. If the risk appetite framework does not support decision-making and enable clear delegation of responsibility, it is not fit for purpose.

Through their challenge processes, risk teams should also test whether material decisions have appropriate governance, clear ownership, and decision responsibility shared at the right level. This will improve psychological safety by sharing accountability – responsibility for flawed methodology and unidentified uncertainty is shared, whilst accountability for execution is clearly allocated.

Ad-Hoc Decision-Challenge

Risk can also support psychological safety in ad-hoc decisions by creating an independent record of the context in which the decision was made: the strategic background, agreed assumptions, known uncertainties, accepted risks, and key limitations.

However, the Covid case study shows that frameworks are far, far more important for creating psychological safety than ad-hoc support. Bioethicists could influence genuinely novel one-off decisions, but they could not overcome structural issues that forced doctors into defensive decisions, such as the requirement to perform CPR in all cases.

Ad-hoc decision support will therefore fail if risk teams do not identify and pre-empt the circumstances that push senior leaders towards defensive decisions. This is not addressed with a vague annual review of decision-making in the abstract. It is about targeted investigations into the dynamics affecting real decisions in real time.

A symptom of defensive decision-making is that risk teams are often sidelined at the point when challenge could still influence the outcome. Timing matters. If risk teams are brought in only at the end of a decision process, they can usually challenge only the most obvious or material issues. Risk reporting often fails to show when risk teams were engaged, or whether there are patterns (by business area or decision type) relating to where they are being sidelined.

Conclusion

Risk teams are often comfortable challenging decision-making at lower levels of the organisation. But risk teams also need to look upwards. Too often, risk and governance frameworks assume that senior leaders will always act in the organisation’s best interests. The research on defensive decision-making suggests that assumption is unsafe.

Calling out defensive decision-making is politically difficult. But failing to do so is a failure of risk management. Our frameworks need to challenge decision-making processes effectively while also protecting decision-makers when well-made decisions lead to bad outcomes. As with bioethicists, risk teams need to help the business define what “fairness” looks like for decision-makers at every level of the organisation.

---

I hope this blog sparks ideas and discussion. If you found it interesting, please share or connect with me on LinkedIn to contribute or provide feedback!

---

[i] Florian M. Artinger, Stefanie Marx-Fleck, Nina M. Junker, Gerd Gigerenzer, Sabrina Artinger, Rolf van Dick, Coping with uncertainty: The interaction of psychological safety and authentic leadership in their effects on defensive decision making, Journal of Business Research, Volume 190, 2025, 115240, ISSN 0148-2963, https://doi.org/10.1016/j.jbusres.2025.115240.

[ii] R.M. Cyert, J.G. March, A behavioral theory of the firm, Prentice Hall (1963)

[iii] This section is heavily based on two articles: What the Chaos in Hospitals Is Doing to Doctors By Jordan Kisner, https://www.theatlantic.com/magazine/archive/2021/01/covid-ethics-committee/617261/ & Ethical and Legal Challenges Faced by Hospitals in New York’s First COVID-19 Surge - Petrie-Flom Center By Zachary E. Shapiro

[iv] What Google Learned From Its Quest to Build the Perfect Team, The New York Times Magazine, Feb. 25, 2016, Charles Duhigg

[v] The Fearless Organization: Creating Psychological Safety in the Workplace for Learning, Innovation, and Growth, 2018, Amy Edmondson, 978-1119477242