Sociology and risk management: how risks get defined
TL;DR: The world is not naturally organised into clear and distinct risks. Risks are not simply "found". They are actively shaped by regulators, organisational structures, management processes, research activities, data systems, and risk frameworks.
Risk teams should examine not only whether a risk framework is complete, but how it was constructed. A sociological lens can reveal hidden assumptions, challenge inherited categories and expose gaps between the risks an organisation faces and the risks it is prepared to recognise. They need to ask “Why have we chosen to define risks this way, and what does that choice prevent us from seeing?”
In a previous post, I explored how companies operate within a “perceptual bubble” shaped by their data, language and assumptions. When something falls outside that bubble, an organisation may struggle to notice, assess or even discuss it.
Risk teams face the same problem - our risk frameworks can become a perceptual bubble. Unless we examine the social forces behind our frameworks, we may mistake inherited assumptions for objective truths. Almost 35 years ago, Stephen Hilgartner explored this problem in an essay[i] on how societies construct risks, and what that means for how they are managed.
The views and opinions expressed on this account are my own and do not reflect the official policy or position of my employer. Any content provided is for informational purposes only and should not be considered or relied upon as professional advice.
The social construction of risk
Hilgartner saw risks as having three elements:
An object that is said to pose the risk.
An agreed harm that may result from the risk. The harm does not need to be genuine; what matters is that a group believes it is real.
A causal link connecting the object to the harm.
This perspective draws attention to the power structures, preferred methods and organisational priorities that shape how risks, hazards and causal links are defined. It also challenges the idea that risks are static, consistent, or scientifically settled. We should expect definitions of risk to change over time, and to differ across groups and organisations.
The world is not naturally organised into clear and distinct risks. People and organisations decide how to classify and interpret what they see. As a result, the same issue may be viewed differently depending on the categories, frameworks, or language being used.
This means risks are not simply "found"; they are actively constructed. The key mechanisms through which this happens include regulation, governance frameworks, organisational structures, management processes, research activities, data systems, and the mechanisms used to monitor and control risk.
What driving risks reveal
Hilgartner used the risks associated with driving to illustrate some of the implications of introducing a sociological view of risk.
Risk definitions are influenced by organisational agency
No framework can capture every possible causal link. A car crash might be attributed to an unsafe driver, an unsafe road or an unsafe vehicle. An driver may be unsafe due to inexperience, irresponsibility, fatigue or alcohol. Inexperience might reflect inadequate training, which might reflect insufficient public spending.
Where we stop tracing the linkages is not a neutral choice. It depends on group consensus and on who has the power, and ability, to act. There is, after all, very little value in listing linkages that we have no power, or desire, to address.
How we frame risks shapes how we manage them
In his book on drunk driving[ii], Joseph Gusfield showed how the “killer drunk” came to be treated as the main cause of alcohol-related road deaths. This framing placed causal, moral and political responsibility on the individual while downplaying other factors.
Stigmatising drink-driving helped reduce deaths. But it also diverted attention from the responsibilities of vehicle manufacturers, alcohol companies, licensing regimes, bar locations and serving practices. Banning bars in locations that can only be accessed by car, alcohol promotions, and the paying of bonuses to staff that sell more alcohol would also have reduced deaths.
I am not suggesting there is a simple answer to this web of accountability. An old boss and mentor of mine, Johann Meeke, used to joke that if our only aim were to prevent car crashes, we would put a giant spike in the centre of every steering wheel.
The key point is that the way we define a problem strongly influences the solutions we consider. Hilgartner put it more precisely:
Changes in the definition of [risks] can redistribute responsibility…, change the locus of decision making, and determine who has the right – and who has the obligation - to ‘do something’ about hazards.
Risk definitions can be blind to design choices
In the 1960s, Ralph Nader challenged the prevailing view that driver behaviour was the main source of road risk[iii]. By focusing on vehicle design, he shifted some responsibility from drivers to manufacturers in two ways:
First, he exposed design flaws and commercial responsibility. The General Motors Corvair, for example, was criticised for a built-in tendency to roll over or lose control. Nader argued that these problems were not simply engineering mistakes; they reflected constraints imposed by “cost cutters” and “market-oriented stylists”. That observation allowed him to shift some accountability from the individual to the car manufacturers.
Second, he broadened the definition of harm. Nader popularised the idea of the “second collision”: the moment when occupants strike the car’s interior after the initial crash. That shifted accountability towards manufacturers and regulators.
Nader's work helped push the adoption of airbags and automatic seat belts, reducing injuries and deaths in ways that a narrow focus on driver behaviour could not[iv].
We rarely see the forces that define risk
Hilgartner argued that risks, and the control frameworks built around them, become embedded in the social fabric almost unnoticed. We often treat them as a function of how the world really works because they “feel right”, rather than as products of unspoken and untested group consensus. To understand risk, and improve how we manage it, we need to examine how these frameworks were built.
How organisations prioritise risk
A sociological view asks how organisations prioritise risks, harms and causal links. In my experience, prioritisation is often shaped by novelty, the availability heuristic[v], uncertainty, theoretical downside and regulation. Regulation is usually the strongest force.
Regulation can improve outcomes, especially where society bears the cost of organisational choices and market incentives are too weak to prevent harm. But regulation can also lock organisations into specific views of risk and prescribed controls, limiting agency and innovation.
Regulation can also impose a narrow lens. UK regulation, for example, has led banks and insurers to invest heavily in identifying, assessing and managing climate-related risk. This work has clear social value. Yet many organisations may now devote more resource to climate risk than to the economic, social and competitive disruption caused by AI, which (for the moment at least) seem are far more material immediate concern.
Regulation can also change the question. Instead of asking, “What uncertainty do we face, and how should we manage the downside?”, teams instead ask, “How can we demonstrate compliance?” That shift can weaken the connection between risk management and strategy.
Implications for risk teams
Hilgartner’s work has several practical implications for how organisations define and communicate risks, and the effectiveness of the risk register:
Risk framing shapes risk assessment. When conducting risk coverage exercises risk teams should consider the unspoken implications of risk definitions for business prioritisation, accountability and risk management.
Design-thinking is poorly captured. Risk frameworks commonly start with what the business wants to achieve and then consider how supporting processes might fail. What is often missing is the bit in the middle: the design of processes, systems and operating models.
As a result, risk teams may manage the symptoms of poor design rather than the underlying cause. They should therefore spend meaningful time embedded within change programmes, challenging whether proposed designs consider a sufficiently broad view of the potential risk environment.
Risk classifications can be arbitrary. Humans can be lazy, seek familiarity, and are unwilling to expend political capital on secondary priorities like risk framework design. Once established, these frameworks tend to persist.
Even formal reviews and refreshes are usually anchored to what came before. During periods of rapid change, this inertia can leave the framework increasingly disconnected from the organisation’s real risk profile. Risk teams need to challenge it actively and encourage regular revolutions rather than evolutions in risk classification.
Risk definitions contain assumptions about accountability. Every risk definition carries assumptions about who or what should be controlled. In pedestrianised areas, people and bicycles have priority and cars are treated as the exception. On motorways, those assumptions are reversed.
Risk systems are often built on similar, largely unspoken beliefs about the normal and exceptional "risk states". If those beliefs are wrong or become outdated, the framework may become ineffective. Risk reviews should therefore test both explicit and implicit assumptions about risk accountability.
Distinguish causes from symptoms. Risks can be framed around underlying causes, around their symptoms, or a mixture of the two but this choice is rarely made explicit. Addressing an underlying cause only makes sense when the organisation has the power to influence it.
A car manufacturer, for example, can reduce the harm caused by a drunk-driver through safer vehicle design. It cannot implement broader actions to reduce the likelihood of a drunk commandeering a car, such as criminal sentencing, alcohol policy or changing where bars are located. It should understand that wider environment, but it can only manage the consequences of factors beyond its control.
Perhaps risk managers should adopt a version of the serenity prayer: “Grant me the courage to manage the risks I am empowered to mitigate, the Board support to address the symptoms of risks I cannot influence, and the wisdom to know the difference.”
Risk frameworks are anchored to organisational design. The jumping off point for risk framework design is usually the departments, functions and committees that already exist. This often provides reasonable coverage of material risks. But organisational structures are also influenced by regulation, individual managers’ capabilities, internal politics and past failures. A framework built around the organisation chart may therefore reproduce its blind spots.
Visible harms receive more attention. Risk frameworks tend to favour visible harms and processes with clear, recurring decisions and accountabilities.
Nuclear power illustrates the point. Its potential harms are visible and localised, whilst the harms associated with fossil fuel power stations are dispersed and invisible. Public perceptions of risk give nuclear risks greater weight, even where the cumulative health impact of fossil-fuel generation is substantially higher – causing 100 to 800 times more deaths[vi]. The majority of the expected deaths from nuclear power will only crystallise following a meltdown, whereas the majority of expected deaths from fossil fuel power will happen every year.
In Conclusion
Risk frameworks do more than describe risk. They allocate responsibility, direct attention and shape the actions an organisation sees as possible.
To paraphrase Hilgartner, the inspiration for this post, risk teams should therefore examine not only whether a framework is complete, but how it was constructed. A sociological lens can reveal hidden assumptions, challenge inherited categories and expose gaps between the risks an organisation faces and the risks it is prepared to recognise.
The central question Hilgartner would want us to ask is “Why have we chosen to define risks this way, and what does that choice prevent us from seeing?”
Hopefully that has sparked some ideas. I am hoping to start a discussion with this blog. If you find it interesting, please share! If you would like to contribute or share feedback, please comment below or message me on LinkedIn!
[i] The Social Construction of Risk Objects: Or, How to Pry Open Networks of Risk In James F. Short and Lee Clarke, eds., Organizations, Uncertainties, and Risk, Westview Press, 1992.
[ii] Joseph R. Gusfield, The Culture of Public Problems: Drinking-Driving and the Symbolic Order. Chicago: University of Chicago Press, 1981
[iii] Nader, R. (1965). Unsafe at any speed: The designed-in dangers of the American automobile. Grossman Publishers.
[iv] There are still blindspots: in the US there are no regulations that push car design to take into account the safety of pedestrians involved in car accidents. For instance, a bonnet height of over 1m corresponds to a 45% increase in pedestrian fatalities – market-oriented stylists are still making decisions that cause unnecessary injury and death.
[v] The psychological term for judging how likely something is based on how easily examples come to mind or how often you experience it
[vi] https://ourworldindata.org/grapher/death-rates-from-energy-production-per-twh Nuclear power causes 0.03 annual deaths per TWh (driven by meltdowns, operational and mining risks), vs 2.82 for natural gas and 24.62 for coal (driven primarily by air pollution)
Comments