.png)
From Signals to Systems: Embedding Trust and Challenge in Risk Governance
- Julien Haye
- Apr 12, 2025
- 15 min read
Updated: Jun 20
In our last article, we explored the human heartbeat of risk: psychological safety—the silent force behind culture, challenge, and trust.
But awareness alone isn’t enough.
It’s one thing to understand why people stay silent in the face of risk. It’s another to design governance structures, leadership behaviours, and daily practices that make it safe—and expected—to speak up.
This article moves beyond mindset and into mechanism. It asks:
How do boards, executives, and risk leaders embed trust and safe challenge into the way decisions are made?
What does it take to move from passive signals to active systems that surface risk early?
And what role should the risk function play—not as an auditor of culture, but as a catalyst for it?
Because the real test of culture isn’t what people say—it’s what systems reinforce.
Executive Takeaways
For readers scanning rather than reading in full, five governing insights frame the argument:
Psychological safety influences risk visibility, not simply workplace culture.
The ability to identify, challenge, and escalate emerging concerns depends on whether information can move freely through the organisation. Psychological safety determines the quality of information reaching governance forums and decision-makers.
Governance effectiveness depends on information integrity.
Most significant failures occur despite relevant information existing somewhere within the organisation. The critical challenge is ensuring that information is surfaced, debated, escalated, and acted upon before risks become material events.
Silence creates a governance exposure.
Silence Risk arises when relevant information remains within teams, functions, or management layers rather than reaching those responsible for oversight and decision-making. The absence of escalation should be examined alongside the presence of reported issues.
Risk culture can be monitored through governance indicators.
Escalation activity, near miss reporting, challenge within committees, speak-up measures, and escalation cycle times provide insight into how effectively risk intelligence moves through the organisation. These indicators help boards assess the health of challenge and transparency in practice.
Strong psychological safety strengthens governance capability.
Organisations that encourage constructive challenge, support escalation, and respond consistently to concerns improve decision quality, increase risk visibility, and strengthen organisational resilience. Psychological safety therefore functions as a governance capability as much as a cultural attribute.
The Unseen Currency of Risk Culture
Risk culture is often described through behaviours. The more important question is what enables those behaviours to occur consistently across an organisation.
At its core, effective risk culture depends on trust. Trust shapes whether concerns are raised, whether assumptions are challenged, and whether information reaches decision-makers in time to influence outcomes. It establishes the conditions under which people contribute their observations, expertise, and judgement to the governance process.
These conditions influence every aspect of organisational decision-making. They shape discussions within teams, the quality of management reporting, the willingness to escalate emerging concerns, and the depth of challenge applied to important decisions. When trust is embedded within governance structures, organisations gain earlier visibility of emerging issues and a broader range of perspectives to support decision-making.
For boards and executive teams, the quality of risk information should be assessed alongside the quality of challenge that supports it. An absence of debate, escalation, or differing viewpoints may indicate that important information is not moving freely through the organisation. Effective governance creates space for constructive challenge and encourages issues to be surfaced before they become material events.
The consequences of weak trust rarely appear through a single governance failure. They emerge through a gradual reduction in information quality. Concerns remain within local teams. Alternative viewpoints receive limited consideration. Escalation occurs later in the decision process. Management reporting becomes progressively less representative of operational reality.
This dynamic affects more than culture. It affects risk visibility.
Every governance framework relies on information moving accurately between operational teams, management, executive committees, and boards. The quality of decisions therefore depends on the quality of information entering those decisions. Trust supports that flow. Challenge strengthens it. Escalation extends its reach.
This is why risk culture should be viewed as a governance capability rather than a standalone behavioural objective. Its value lies in preserving the integrity of risk intelligence as it moves through the organisation. Organisations that achieve this consistently identify emerging issues earlier, improve decision quality, and strengthen their capacity to respond to uncertainty.
📘 For a deeper examination of the relationship between psychological safety, risk culture, and leadership, explore The Risk Within by Julien Haye.
Why Risk Culture Is Not a “Nice to Have”
Risk culture is often discussed alongside frameworks, controls, and policies. In practice, it influences how effectively those mechanisms operate.
Every governance process relies on information. Risks must be identified, concerns must be raised, assumptions must be challenged, and decisions must be informed by an accurate understanding of operational reality. The effectiveness of governance therefore depends not only on the quality of frameworks and controls, but also on the quality of information moving through them.
This is where risk culture becomes significant.
Organisations rarely struggle because risk information is unavailable. More often, governance challenges emerge when information changes as it moves from operational teams to management forums, executive committees, and boards. Details are condensed, concerns are re-prioritised, and context is reduced, creating a less complete picture of operational reality. Important observations remain within teams. Emerging concerns receive limited discussion. Escalation occurs later than intended. Decision-makers receive a less complete view of the conditions surrounding execution.
The result is reduced risk visibility.
Many significant failures across industries share a common characteristic. Information existed somewhere within the organisation before the event occurred. The challenge was not identification. The challenge was ensuring that information reached the right people, at the right time, with sufficient context to support action.
This explains why regulators, boards, and executive teams increasingly examine culture as part of governance effectiveness. The focus extends beyond behaviours and values. It includes how organisations surface concerns, encourage challenge, support escalation, and integrate diverse perspectives into decision-making processes.
For risk leaders, culture should therefore be viewed as a governance capability. It influences the integrity of management information, the quality of challenge within committees, the effectiveness of escalation pathways, and ultimately the quality of decisions.
Strong risk cultures strengthen organisational visibility. They support the accurate flow of information between operational teams, management, executive committees, and boards. This enables earlier identification of emerging issues and provides decision-makers with a more complete understanding of risk exposure.
The value of risk culture is therefore practical rather than theoretical. It helps organisations improve the quality of information entering governance processes and strengthens the effectiveness of the decisions that follow.
Activate challenge and escalation with our Risk Challenge Activation services, tailored to embed safe challenge and trusted escalation in daily decision-making.
The Risk Function as Cultural Catalyst
The role of the risk function has traditionally focused on frameworks, policies, controls, and oversight. These responsibilities remain important. However, as organisations become more complex and interconnected, risk leadership is increasingly concerned with the quality of information supporting governance and decision-making.
Effective governance depends on more than the existence of controls. It depends on whether emerging concerns are identified, challenged, escalated, and acted upon before they become material issues. This places the risk function in a unique position. Beyond assessing risk exposure, it can help organisations understand the conditions that influence how risk intelligence moves through the enterprise.
This expands the role of risk leadership from evaluating control effectiveness to strengthening governance effectiveness.
Risk leaders should continue asking whether controls are operating as intended. They should also examine whether governance processes consistently surface the information required to support sound decisions. This includes understanding how challenge is encouraged, how escalation pathways operate, and whether decision-makers receive a sufficiently complete view of operational reality.
One of the most important shifts is recognising that the absence of information is not always evidence of the absence of risk. Low levels of challenge, escalation, or issue reporting may reflect effective management. They may also indicate reduced visibility. Understanding this distinction is becoming an increasingly important component of modern risk leadership.
Progressive risk functions are already extending their focus beyond traditional assurance activities. They are reviewing how information flows between teams, assessing the effectiveness of escalation mechanisms, monitoring indicators of challenge and transparency, and supporting leaders in creating governance environments that encourage constructive debate and learning.
In this context, the risk function becomes more than a provider of oversight. It becomes a catalyst for stronger governance. By improving the quality of information entering decision-making processes, risk leaders help organisations identify emerging issues earlier, strengthen decision quality, and improve organisational resilience.
As organisations face increasing complexity and uncertainty, the ability to preserve information integrity may become as important as the ability to measure risk itself. Risk functions that recognise this shift will be better positioned to support effective governance and sustainable performance.
👉 Our article on Integrated Risk Management explains how to embed risk insight into daily decisions and strategic oversight.
The Psychological Safety Governance Cycle
Many discussions about psychological safety focus on culture, behaviour, or leadership style. These factors matter, yet they do not fully explain why some organisations consistently surface concerns while others struggle to identify emerging issues until they become incidents.
The difference often lies in governance design.
Psychological safety is not simply a cultural attribute. It is a governance capability that determines how information moves through an organisation.
When governance is functioning effectively, concerns are identified early, challenged constructively, escalated appropriately, and translated into action. When governance weakens, information becomes fragmented, challenge declines, escalation slows, and decision-makers receive an increasingly incomplete picture of reality.
This dynamic can be understood through the Psychological Safety Governance Cycle.
1. Speak Up
The cycle begins when individuals feel able to raise concerns, share observations, identify weaknesses, or challenge assumptions.
This stage is influenced by trust, clarity of expectations, leadership behaviour, and organisational norms.
Without voice, risk intelligence never enters the governance system.
2. Challenge
Information alone is not sufficient.
Effective governance requires constructive challenge. Teams must feel able to test assumptions, explore alternative perspectives, and question decisions without fear of personal consequence.
Challenge improves decision quality by increasing the range and depth of information considered.
3. Escalate
Material concerns must reach the appropriate level of authority.
Escalation is the mechanism through which local observations become organisational intelligence.
When escalation pathways are unclear, delayed, or perceived as punitive, significant issues remain trapped within operational teams.
4. Respond
Leadership response determines whether trust is strengthened or weakened.
People observe how concerns are received. They notice whether difficult issues are welcomed, investigated, and acted upon.
Every response sends a signal about what the organisation genuinely values.
5. Learn
Effective organisations treat escalation as a source of learning.
They examine underlying conditions, identify patterns, and strengthen decision-making processes rather than focusing solely on immediate remediation.
Learning converts individual events into organisational capability.
6. Reinforce
The final stage ensures that positive behaviours become embedded.
Recognition, accountability, leadership modelling, and governance practices reinforce expectations around challenge, transparency, and responsible escalation.
Over time, reinforcement shapes culture and strengthens the confidence required to begin the cycle again.
Why the Cycle Matters
Psychological safety is often discussed as a cultural attribute. In practice, it functions as a governance capability.
Every organisation depends on a continuous flow of information between operational reality and strategic decision-making. The quality of governance therefore depends on the quality of information reaching decision-makers.
When individuals choose not to disclose concerns, governance loses visibility. When challenge is discouraged, information loses depth. When escalation pathways are weak, information loses reach. When responses are inconsistent, future disclosure declines. When lessons are not embedded, organisations repeatedly encounter the same underlying conditions.
The cumulative effect is not simply reduced engagement or weaker culture.
It is reduced decision quality.
This is why psychological safety should be viewed as a component of governance effectiveness rather than a standalone cultural initiative. Its value lies in preserving the integrity of risk intelligence as it moves through the organisation.
Organisations with strong psychological safety identify emerging issues earlier, challenge assumptions more effectively, and provide leaders with a more complete picture of operational reality. The result is stronger oversight, better decisions, and greater organisational resilience.
Case Study: Creating the Conditions for Better Decisions
Microsoft's transformation under Satya Nadella provides a useful example of how leadership philosophy can influence organisational learning, challenge, and decision-making. A central element of this transformation was the adoption of a Growth Mindset approach, encouraging employees to focus on learning, curiosity, and continuous improvement rather than defending existing expertise.
Nadella described the shift as moving from a culture of "know-it-alls" to one of "learn-it-alls." While often discussed as a cultural change initiative, the governance implications were significant. Teams were encouraged to share perspectives, challenge assumptions, and learn from setbacks without undermining accountability.
The transformation was reinforced through tangible management and governance changes. Microsoft eliminated its long-standing stack ranking performance system, which had been widely criticised for encouraging internal competition over collaboration. New approaches to performance, leadership, and teamwork were introduced to support knowledge sharing, cross-functional cooperation, and constructive challenge.
The result was more than cultural renewal. It strengthened the organisation's ability to surface information, test assumptions, and adapt to changing conditions. For risk leaders, the lesson is clear. Psychological safety is not simply about employee engagement. It influences how effectively information moves through an organisation, how challenge contributes to decision-making, and how leadership teams gain visibility of emerging risks and opportunities.
Organisations that create environments where people can contribute perspectives, question assumptions, and share concerns openly improve the quality of information available to decision-makers and strengthen governance effectiveness over time.
Measuring Psychological Safety as a Governance Capability
If psychological safety influences risk visibility, challenge, and escalation, it should be monitored with the same discipline applied to other governance capabilities.
Many organisations assess culture through periodic surveys. While useful, surveys provide only one perspective. Boards and executive teams also need indicators that demonstrate how effectively challenge, escalation, and information flow operate in practice.
The objective is not to measure psychological safety directly. The objective is to monitor the organisational behaviours and governance outcomes that psychological safety enables.
Examples include:
No single indicator provides a complete picture. Trends across multiple indicators provide a more meaningful assessment of how effectively risk intelligence moves through the organisation.
For boards, the goal is not to maximise reporting volumes or escalation activity. The goal is to understand whether governance processes consistently surface relevant information before risks become incidents.
When viewed collectively, these indicators help leaders assess whether challenge is encouraged, escalation pathways are functioning, and decision-makers are receiving a sufficiently complete view of operational reality.
Understanding Silence Risk
Most governance frameworks are designed to assess information that has already been identified, reported, and escalated.
A less visible challenge exists when material information never enters the governance process in the first place.
This can be described as Silence Risk.
Silence Risk is the risk that relevant information is not surfaced, challenged, escalated, or debated despite being known somewhere within the organisation.
The issue is not the absence of information. The issue is the absence of visibility.
Operational teams may identify emerging concerns. Subject matter experts may recognise weaknesses in controls, processes, or decisions. Managers may observe changing conditions that increase exposure. Yet these observations do not always reach the forums where decisions are made.
Several organisational factors influence the level of Silence Risk:
Ambiguity around accountability and ownership
Escalation pathways that are unclear or inconsistently applied
Hierarchical structures that discourage challenge
Incentives that prioritise short-term delivery over transparency
Governance forums that limit constructive debate
Previous experiences that influence confidence in escalation processes
For boards and executive teams, Silence Risk presents a unique governance challenge because it cannot be measured through incidents alone. By the time a risk becomes visible through an event, the opportunity for earlier intervention may already have passed.
This is why leading indicators matter. Escalation activity, challenge within governance forums, near miss reporting, and speak-up measures provide valuable insight into whether information is flowing effectively through the organisation.
Managing Silence Risk is therefore not simply a cultural objective. It is a governance requirement. Organisations that reduce Silence Risk improve risk visibility, strengthen decision quality, and increase their capacity to identify emerging issues before they become material events.
Culture Starts at the Top, but Lives in the Middle
Boards and executive teams establish expectations for risk culture. Middle managers determine how those expectations operate in practice.
They sit at a critical point within the governance system, translating strategic priorities, risk appetite, policies, and leadership expectations into day-to-day decisions. As a result, they have significant influence over how information flows through the organisation and how effectively emerging concerns are identified, challenged, and escalated.
Many of the conditions that shape risk visibility are influenced at this level. Managers help determine whether challenge is encouraged during discussions, whether escalation pathways are used consistently, whether concerns are resolved promptly, and whether important information reaches the appropriate decision-makers.
This makes middle managers important contributors to governance effectiveness. While boards provide oversight and executives establish direction, managers influence how governance operates within operational teams. They help convert governance expectations into everyday behaviours, decisions, and actions.
For organisations seeking to strengthen risk culture, investment in this layer is essential. Effective managers require more than policy awareness or compliance training. They need practical skills in escalation, decision-making, challenge, issue resolution, and communication. They also need clarity regarding accountability, authority, and governance expectations.
Strong managers improve the quality of information moving through the organisation. They help ensure that concerns are surfaced early, that challenge contributes to decision quality, and that escalation processes function as intended.
This is why risk culture cannot be assessed solely through board oversight or executive messaging. It must also be examined through the management practices that influence how governance operates every day. Organisations that strengthen this connection improve risk visibility, support better decision-making, and create more effective governance outcomes.
From Signals to Systems: Embedding Culture in Practice
Recognising the importance of psychological safety is only the starting point. The greater challenge is embedding the conditions that support effective challenge, escalation, and decision-making throughout the organisation.
This requires more than leadership messaging or policy updates. It requires governance structures, management practices, and accountability mechanisms that consistently support the flow of information between operational teams and decision-makers.
The five implementation strategies outlined above provide a practical foundation. Together, they strengthen the conditions that support risk visibility, improve the quality of challenge, and reinforce organisational learning.
What’s at Stake Isn’t Just Culture—It’s Control
Risk culture influences how information is identified, shared, challenged, and acted upon. Its impact extends beyond behaviours and values into the quality of governance itself.
Boards depend on accurate information to exercise oversight. Executive teams depend on timely escalation to support decision-making. Risk functions depend on constructive challenge to identify emerging issues and test assumptions. Each of these activities relies on an environment where relevant information can move efficiently through the organisation.
This is why psychological safety should be viewed as a governance capability.
Organisations that encourage challenge, support escalation, and respond constructively to concerns strengthen their capacity to identify emerging issues early and make better-informed decisions. They improve the quality of information reaching governance forums and increase the effectiveness of oversight.
The objective is not simply to create a positive workplace culture. The objective is to ensure that decision-makers have access to the information, perspectives, and challenge required to govern effectively.
Ultimately, strong risk cultures strengthen risk visibility. They support better decisions, more effective governance, and greater organisational resilience in increasingly complex operating environments.
Board Oversight Checklist
Five Questions Directors Should Ask About Psychological Safety and Risk Governance
1. Where do we see evidence that challenge is taking place before decisions are finalised?
Boards should understand whether material decisions are being tested through meaningful discussion, alternative viewpoints and challenge from relevant functions. The focus should be on the quality of debate, not simply whether committees met or papers were reviewed.
2. Which risks, concerns or near misses were escalated before they became incidents?
Early escalation provides evidence that risk intelligence is moving through the organisation. Directors should look for examples where concerns were surfaced in time to influence decisions, adjust priorities or strengthen controls.
3. Where might silence be creating a false sense of stability?
Low volumes of escalation, near miss reporting or challenge can indicate effective control. They can also indicate weak visibility. Boards should ask management to explain areas with unusually low reporting activity, limited challenge or repeated assurance without supporting evidence.
4. How does leadership respond when difficult information is raised?
Psychological safety is shaped by response. Directors should assess whether concerns lead to constructive review, learning and timely action. Responses that appear defensive, delayed or overly punitive can reduce future escalation and weaken governance visibility.
5. How are risk culture indicators monitored alongside formal risk metrics?
Boards should receive evidence on escalation trends, near miss reporting, committee challenge, speak-up measures and time to escalate material issues. These indicators help directors assess whether governance processes are receiving a complete view of operational reality.
Final Reflection
Effective governance depends on more than frameworks, policies, and reporting structures. It depends on the quality of information reaching decision-makers and the organisational conditions that support challenge, escalation, and learning.
Psychological safety plays an important role in this process. It influences whether concerns are surfaced, whether assumptions are tested, and whether emerging risks become visible before they develop into material issues.
Organisations that strengthen risk visibility improve more than culture. They improve decision quality, governance effectiveness, and organisational resilience.
The most effective risk cultures are therefore not defined by the absence of issues. They are defined by the organisation's ability to identify, discuss, and respond to them early.
About the Author: Julien Haye
Managing Director of Aevitium LTD and former Chief Risk Officer with over 26 years of experience in global financial services and non-profit organisations. Known for his pragmatic, people-first approach, Julien specialises in transforming risk and compliance into strategic enablers. He is the author of The Risk Within: Cultivating Psychological Safety for Strategic Decision-Making and hosts the RiskMasters podcast, where he shares insights from risk leaders and change makers.
FAQs
How is psychological safety different from accountability?
Psychological safety and accountability are complementary rather than competing concepts. Psychological safety encourages individuals to raise concerns, challenge assumptions, and share information openly. Accountability ensures that decisions, actions, and outcomes remain clearly owned. Organisations achieve the strongest governance outcomes when both are present simultaneously.
Does psychological safety mean avoiding difficult conversations?
No. Psychological safety enables more effective difficult conversations by creating an environment where concerns, disagreements, and alternative perspectives can be discussed constructively. Strong challenge is often a characteristic of psychologically safe teams because individuals can debate issues without personalising disagreement.
Why are regulators increasingly interested in organisational culture?
Many regulatory failures occur despite formal policies, controls, and governance structures being in place. Regulators increasingly recognise that culture influences how effectively those mechanisms operate in practice. Areas such as escalation, challenge, accountability, and decision-making are now viewed as important indicators of governance effectiveness.
How does remote and hybrid working affect psychological safety?
Remote and hybrid environments can reduce opportunities for informal discussion, observation, and relationship-building. Organisations may therefore need more deliberate approaches to challenge, escalation, and collaboration to ensure important information continues to flow effectively across teams and management structures.
What role does psychological safety play during incident investigations?
Psychological safety supports learning-oriented investigations by encouraging individuals to share information openly and accurately. Organisations that focus on understanding conditions, decisions, and contributing factors often gain deeper insights than those that focus primarily on assigning blame for outcomes.
Can artificial intelligence create new psychological safety challenges?
Yes. As organisations increasingly rely on AI-supported analysis and decision-making, employees may become less willing to challenge automated outputs or raise concerns about system recommendations. Governance frameworks should encourage appropriate challenge of both human and machine-generated decisions.
How can organisations assess the quality of challenge in governance forums?
The quality of challenge is often reflected in the diversity of perspectives considered, the testing of assumptions, the examination of alternatives, and the willingness to revisit decisions when new information emerges. Effective challenge improves decision quality rather than simply increasing debate.
Are psychologically safe teams higher performing?
Research consistently suggests that psychologically safe teams are more likely to share information, learn from experience, adapt to changing conditions, and collaborate effectively. These characteristics can improve innovation, problem-solving, decision-making, and organisational resilience when combined with clear accountability and performance expectations.