.png)
Building Psychological Safety in Risk Management: A Practical Guide to the Four Stages
- Julien Haye
- Jul 5
- 13 min read
As I looked around the room, it became clear that not a single soul, regardless of seniority, was willing to speak up. The dialogue of the two executives was only matched in intensity by the silence of the other 40 odd participants.
I believe it is better to face hard truths than to let necessary actions fail through silence or mishandling. So when the executives assumed the meeting was over because they had said all they wanted to say, I spoke up. Sitting across the table from them, I told them what others would not. They jumped from their chairs and started shouting. But months later, after many tense conversations and even more difficult decisions, the hard truth had sank in and the necessary correction course was taken.
Psychological safety has become a familiar term in discussions about leadership and culture. Yet in many risk functions, and across organisations more broadly, it remains a soft ideal rather than a practical element of performance and governance. The fear of conflict, a lack of trust, and poor communication skills continue to hold risk teams back.
Organisations may encourage openness or invite challenge, but without structure and behavioural reinforcement, those messages fall flat. Good intentions alone do not create an environment where people feel safe to speak up, question, or push back.
Psychological safety requires courage. It demands boldness. And it means setting aside the interpersonal risks that often hold leaders back, especially in high-stakes environments. It allows forward momentum where silence and avoidance have stalled decisions.
Psychological safety does not appear overnight. It grows through a sequence of stages, each one deepening trust and shaping how people show up in high-stakes moments.
This is where Timothy R. Clark’s Four Stages of Psychological Safety provide a practical and valuable guide. His model describes four progressive levels:
Inclusion Safety – feeling accepted and part of the group
Learner Safety – feeling able to ask questions, experiment, and learn
Contributor Safety – feeling trusted to participate and add value
Challenger Safety – feeling empowered to challenge, question, or offer dissent
Each stage builds on the last, deepening trust and enabling more open, confident engagement. For risk professionals, these stages map directly to the lived reality of governance, assurance, and challenge. Whether it is inviting new voices into risk discussions, creating space for honest post-incident reviews, or enabling principled disagreement in board meetings, the four stages reflect what it truly means to build a psychologically safe risk function.
In this article, we will explore what each stage looks like in practice and how risk leaders can embed them to create environments where speaking up becomes part of the cultural DNA.
TABLE OF CONTENTS
About The Four Stages of Psychological Safety Framework
The Four Stages of Psychological Safety — Inclusion Safety, Learner Safety, Contributor Safety, and Challenger Safety — were developed by Dr. Timothy R. Clark, founder of LeaderFactor. His research highlights how individuals progress through these stages to build a culture where people feel safe to belong, learn, contribute, and challenge the status quo.
While widely used in leadership and team development, its application to risk management remains underexplored. This article builds on Clark’s model to examine how each stage shapes risk identification, control ownership, governance challenge, and regulatory readiness positioning psychological safety as a foundational enabler of effective risk culture.
>>> I also invite you to read more about Google’s Project Aristotle (Supporting Psychological Safety Evidence), which I also reference in The Risk Within.
>>> Curious how culture sets the tone for psychological safety? You can read more about risk culture here.
Our Risk Leadership Diagnostics help leaders identify behavioural blind spots and shape more accountable risk decisions.
What’s Missing in Most Risk Functions?
Many risk functions have strong frameworks and capabilities but limited influence. They produce risk registers, coordinate assurance reviews, and facilitate governance meetings. Yet critical risks and uncertainties still surface too late. The challenge process is ineffective at informing strategic and operational decision-making. Ultimately, the risk function becomes a costly assurance function.
Why does this happen in organisations that are technically competent and well-resourced?
Teams instinctively know when it is safer to stay quiet. Risk professionals sense when their challenge will be unwelcome. Even senior leaders sometimes defer rather than dissent. These behaviours reflect deeply human instincts to avoid conflict, preserve status, and align with group norms.
In that sense, the core work of risk — from surfacing difficult truths and pushing for accountability to challenging consensus — runs counter to human psychology. This is precisely why psychological safety is so critical: it makes the unnatural act of speaking up possible.
The four stages of psychological safety — inclusion safety, learner safety, contributor safety, and challenger safety — developed by Timothy R. Clark represent a progressive path toward the final stage of psychological safety, where challenge and dissent are welcomed. It gives leaders a way to diagnose where challenge is breaking down and what to do about it.
Stage 1: Inclusion Safety – Who Gets to Be Heard in Risk Management?
Inclusion Safety refers to the feeling of being accepted, respected, and allowed to belong without needing to conform or stay silent. Creating an inclusive environment where everyone feels respected and feels comfortable contributing is the first step toward a psychologically safe culture.
In risk management, it plays a foundational role in shaping how systems function and how decisions are informed. In psychologically safe teams, mistakes are treated as opportunities for learning and growing, not personal failure.
Risk conversations often take place in closed rooms with a narrow range of voices. Senior committees may review risks escalated through formal processes, but they rarely hear directly from those who experience those risks first-hand.
Front-line teams, outsourced partners, and underrepresented groups are frequently absent. This is not because their input lacks value, but because the governance system has not created meaningful ways to involve them.
As a result, the people who understand what is really happening and what it means often do not have a voice. Risk and control decisions end up being made based on filtered and interpreted information presented by individuals who may lack a full understanding of operational realities or who (un)intentionally minimise concerns due to pressure, loyalty, or fear of reputational consequences.
In one example, I faced an executive who had presented a risk mitigating initiative as transformative for an operational area prone to significant processing failures. Their initiative alongside significant budget had been approved by several risk, executive, and board committees. After diving into their work and talking extensively with the operational teams involved, who incidentally were never invited to join the discussion, I discovered that the scope of work had been, for practical reasons, truncated and the source of the issues the operational teams involved were facing was excluded. What’s worse, they were embedding activities that should not be performed at all. In short, they were applying an expensive sticky plaster, while also increasing the business’ cost base.
Exclusion can take many forms. It occurs when certain roles are consistently omitted from governance oversight. It shows up when whistleblowing channels are available in theory but feel risky or ineffective to use. It is reinforced when onboarding suggests that speaking up could harm career prospects. It continues when diversity is acknowledged externally, but critical decision-making forums remain homogenous.
Creating Inclusion Safety involves being intentional about whose voices are included and how. It means examining how the design of risk and governance frameworks either encourages or discourages input from across the organisation as necessary.
Practical enablers include:
Anonymous risk escalation tools that are actively monitored and acted upon
Onboarding practices that normalise speaking up from day one
Representation from a range of roles and backgrounds in risk governance
Feedback loops that inform contributors of outcomes, so they know their input matters
Bypass management layer to give a voice to operational team
Inclusion Safety does not equate to universal agreement. It is about diversity of opinions and the ability to surface the necessary insights. In risk management, that contribution can be the difference between preventing failure and responding too late. Or, as in the example above, accepting risks the organisation should never have taken on.
👉If you're interested in applying these principles in your organisation, Explore our Risk Culture & Leadership Solutions
Stage 2: Learner Safety – Are People Allowed to Get it Wrong?
Learner Safety is about creating an environment where people feel safe to ask questions, try new approaches, admit mistakes, and seek feedback without fear of embarrassment or retribution. In the context of risk, it enables continuous improvement and helps surface hidden issues before they escalate.
But many risk environments do not reward learning. They reward perfection.
This is particularly true in regulated sectors or large corporates where a single misstep can feel career-defining. In these environments, people often avoid raising uncertain or incomplete concerns unless they are fully validated. The result is a reluctance to explore emerging risks or evolving scenarios that don’t fit existing categories. It becomes safer to follow the process and tick the box than to question the adequacy of controls or test new ideas.
This tension between spoken values and lived behaviour reflects a deep organisational pattern where exclusion is often coded as professionalism, and challenge is reframed as disruption.
Yet risk management depends on learning and challenging the status quo. Models must be challenged. Controls must be tested. Scenarios must evolve.
Where Learner Safety is lacking, people are more likely to ignore early indicators or overstate control effectiveness rather than admit uncertainty or ask for support.
In my trading days, I was expected to meet my budget, and this factored in the ups and downs this type of activity entails. Making losses was part of the process and accepted – as long as the top figures remained on or above budget.
This is a clear example of the opposite of Learner Safety. It is what happens when we expect people to have answers before they have the tools or space to explore the problem.
Encouraging Learner Safety does not mean accepting underperformance or ignoring standards. It means recognising that learning, especially in complex risk areas, requires an environment where mistakes are part of the process, not a signal to stop it.
Practical enablers include:
Innovation frameworks that encourage experimentation and learning from failures
Post-incident reviews that focus on system learning rather than blame
Risk training that includes exploration and application, not just compliance theory
Psychological safety questions included in team surveys and performance reviews
Leaders who openly model learning by sharing what they’re working on or unsure about
>>> Learner safety isn't just a mindset — it's built through experience. Learn how immersive learning builds confidence in risk conversations.
Which stage of psychological safety best describes your current risk team culture?
Inclusion: We’re focused on belonging and respect
Learner: Growth and learning are encouraged
Contributor: People take ownership and speak up
Challenger: We welcome dissent and challenge
Stage 3: Contributor Safety – Taking Ownership of Risk
Contributor Safety emerges when individuals feel trusted to participate, add value, and take ownership. In risk management, this stage marks the shift from passively identifying risks to actively managing them.
This is where real operational ownership begins. When people feel safe to contribute, they not only raise concerns but propose solutions. They engage in risk and control activities with confidence, rather than fear of being blamed or side-lined. Crucially, Contributor Safety enables distributed ownership of risk, where accountability sits with those best positioned to act.
This is where delegation models like RACI (Responsible, Accountable, Consulted, Informed) become essential. They clarify who owns each aspect of a process, control, or decision. They shift the perception of risk from being someone else’s job to something core to delivering safe, reliable, and strategic outcomes. Risk champions, embedded within functions or teams, can further reinforce this sense of ownership by bridging operational expertise with governance expectations.
One of the main challenges I explore in The Risk Within stems from the misalignment of operational responsibilities with budget allocation. In short, people are given the responsibilities, including the challenges, but not the resources to manage or fix the issues. This paradoxical situation must be addressed before true ownership of risk can take place.
To embed Contributor Safety, leaders and risk teams can:
Encourage solution-oriented challenge, not just issue escalation
Celebrate examples of proactive risk management, not only when things go wrong
Clarify roles and accountabilities using simple tools like RACI or decision matrices
Build feedback loops so contributors see the impact of their input
Provide training and coaching to equip staff with the skills and language to participate in risk conversations confidently
Ensure the risk framework allocates risks and controls to individuals with the means to manage them
Stage 4: Challenger Safety – Speaking Up Without Fear
Challenger Safety is present when people feel able to question, challenge, or offer a dissenting view without fear of embarrassment, retaliation, or career harm. Research consistently shows that high performing teams are those where team members feel safe to challenge and debate without fear of retribution. In risk management, this is the point where genuine challenge becomes possible and meaningful.
When Challenger Safety is lacking, risks escalate slowly or not at all. People hesitate to speak up, even when they see something is wrong. Issues are filtered or downplayed, because the environment signals that raising uncomfortable truths is unwelcome. By contrast, when Challenger Safety is strong, individuals at all levels can voice concerns, question assumptions, and highlight blind spots. Feedback is framed as opportunities for growth, rather than criticism.
This stage is essential for strengthening the integrity of decision-making. It allows teams to test risk assumptions before they harden into commitments. It opens the door for constructive disagreement, which is vital in managing uncertainty. Without it, groupthink takes hold, and risk processes become exercises in confirmation rather than inquiry.
Building Challenger Safety requires both culture and structure. It must be normalised through leadership behaviour, team dynamics, and process design. This means creating formal and informal avenues for challenge and making it clear that respectful dissent is a form of contribution, not defiance.
To strengthen Challenger Safety, organisations can:
Set clear expectations that challenge is part of everyone’s role
Train managers to respond constructively to dissenting views
Use facilitated challenge sessions or red-teaming during critical risk decisions
Protect and support individuals who raise concerns, especially in high-stakes settings
Include challenge and debate as part of formal governance agendas
Reflect on past incidents to identify where challenge could have made a difference
Challenger Safety is the culmination of psychological safety in risk. Without it, even well-designed frameworks fail. With it, risk management becomes a living system of learning, accountability, and resilience.
>>> Effective challenge depends on risk perception. This article explores how leaders can calibrate risk awareness.
The Risk Within provides a roadmap for embedding psychological safety into risk management. It identifies critical touch points across the risk lifecycle and offers clear actions to align leadership, culture, and governance. It is designed to help risk functions integrate more deeply into the business and strengthen decision-making at every level.
Integrating the Four Stages Into the Risk Function
Psychological safety is a foundational enabler to risk management. But it can’t be fostered in isolation. It needs to be embedded directly into how the risk function operates: in its governance, assurance, oversight, and escalation practices.
To make this practical, organisations can map the Four Stages of Psychological Safety to key risk activities and identify where behavioural or structural barriers might be holding people back.
Stage | Risk Function Activity | What It Looks Like in Practice |
Inclusion Safety | Risk identification and escalation | Diverse voices invited into risk discussions, including front-line teams, outsourced partners, and underrepresented groups. |
Learner Safety | Incident reviews, scenario testing, and lessons learned exercises | Blame-free environments where mistakes are surfaced quickly and analysed for systemic improvements. |
Contributor Safety | Control ownership, monitoring, and reporting | Risk owners are clearly defined, resourced, and empowered to manage controls effectively. |
Challenger Safety | Board reporting, risk appetite debates, and issue escalation | Risk professionals and business leaders openly question assumptions, challenge strategies, and refine decisions. |
This mapping helps organisations ask critical questions:
Do our escalation paths only flow upward, or do they also enable lateral and grassroots challenge?
Are post-incident reviews a compliance box-tick or a source of learning?
Are risk owners equipped—and willing—to act when issues arise?
Is challenge welcomed and responded to, or quietly avoided?
The Compliance and Intelligence Connection
Embedding psychological safety isn’t just good for culture; it strengthens compliance and enhances risk intelligence. Regulators increasingly expect firms to demonstrate active listening, meaningful challenge, and evidence of a strong risk culture. In many jurisdictions, these behaviours are now part of regulatory expectations (e.g., SMCR in the UK, or conduct requirements in DORA and Basel guidance).
A risk function built on psychological safety doesn't just detect risks—it becomes a trusted source of insight and influence. And in a world where reputational, strategic, and conduct risks are escalating, that trust can be a differentiator.
>>> Inclusion is only the first step. To build a resilient culture, teams must adapt. Explore what it means to embrace a dynamic risk culture.
Regulatory Alignment and Oversight Expectations
While psychological safety is often framed as a cultural or leadership issue, it also has direct implications for regulatory compliance and audit expectations. In the UK, frameworks such as the Senior Managers and Certification Regime (SMCR) emphasise individual accountability, informed decision-making, and robust challenge. When team members do not feel safe to speak up, oversight becomes ineffective, and risks go unchallenged. Embedding the four stages of psychological safety strengthens the credibility of assurance processes, supports effective escalation, and reinforces governance structures that regulators increasingly expect to be both rigorous and people aware.
Conclusion: From Permission to Culture
Building psychological safety enables individuals and teams to realise their full potential while improving the quality of decision-making. Applied to the risk function, it is not about adding another training module or a new line on a policy document. It’s about shaping leadership behaviours and creating cultural norms where risk awareness, challenge, and accountability are embedded into how people think, act, and collaborate every day.
When people feel safe to speak up, experiment, own risk, and challenge decisions, risk management moves from being a reactive function to a proactive, value-driving capability. But that shift does not happen through frameworks alone. It happens when leaders consistently demonstrate openness, when systems reinforce inclusion, and when organisations reward thoughtful engagement—not just silence and compliance.
To create psychological safety, risk leaders must go beyond awareness and model inclusive, learning-oriented behaviours consistently. The Four Stages of Psychological Safety offer a practical lens for examining where your culture is supporting risk maturity and where it may be holding it back.
Reflection questions for your team:
Which stage are we currently strongest in?
Where does challenge break down in our risk lifecycle?
Who is missing from our risk conversations—and why?
Do people feel ownership of controls, or do they defer upward?
How are we enabling learning from failure, rather than avoiding it?
This is about building a culture where speaking up is expected, supported, and acted upon.
>>> Many risk teams overlook the leadership gaps that quietly undermine psychological safety. Read more about these hidden risks here.
About the Author: Julien Haye
Managing Director of Aevitium LTD and former Chief Risk Officer with over 26 years of experience in global financial services and non-profit organisations. Known for his pragmatic, people-first approach, Julien specialises in transforming risk and compliance into strategic enablers. He is the author of The Risk Within: Cultivating Psychological Safety for Strategic Decision-Making and hosts the RiskMasters podcast, where he shares insights from risk leaders and change makers.
Comentários