.png)
Beyond Checklists: The Human Factor in Risk Management
- Julien Haye
- Feb 28, 2025
- 12 min read
Updated: Apr 11
What if unlocking human potential is the greatest risk management strategy of all?
Risk management has traditionally been viewed through the lens of compliance, controls, and structured frameworks. This approach provides consistency and oversight, yet it does not fully account for how decisions are made under pressure or how risks are identified and escalated in practice.
Psychological safety plays a central role in this dynamic. It enables individuals to raise concerns, challenge assumptions, and contribute to decisions without fear of consequence. When these behaviours are present, organisations improve how risk is understood and managed. When they are absent, exposure can develop without being recognised.
When employees feel empowered to raise concerns, challenge assumptions, and learn from mistakes without fear of blame, risk management evolves from a defensive practice into a proactive force. Organisations that cultivate a culture of psychological safety, critical thinking, and continuous learning thrive in complexity, turning uncertainty into a strategic advantage, and developing the DNA to deal with unpredictability and an accelerating world.
By harnessing the human factor, businesses create an environment where risk is not something to be feared but understood, navigated, and even leveraged for growth. The focus has shifted from whether investing in people is necessary to how we can unlock their full potential to create a stronger, more resilient future.
This article explores the crucial role of psychological safety and human insight in transforming risk management from a reactive process into a proactive, resilience-building strategy. We also invite our article on cultural intelligence in risk management to learn how to adapt to diverse cultural contexts, turning differences into strengths and driving smarter risk strategies.
Executive Takeaways
For readers scanning rather than reading in full, five governing insights frame the argument:
Human behaviour shapes how risk is identified and acted upon.
Risk frameworks define exposure, yet outcomes depend on how individuals interpret signals, challenge assumptions, and decide whether to escalate. The human factor determines whether risk is recognised and addressed in practice.
Psychological safety influences escalation and decision quality.
When individuals can raise concerns and challenge assumptions without constraint, issues are surfaced earlier and examined more rigorously. This improves the quality and timing of decisions across the organisation.
Interpretation determines whether signals lead to action.
Signals do not translate directly into decisions. They are assessed through existing assumptions and context. When interpretation is not challenged, emerging risks can remain unexamined within normal operations.
Repeated decisions shape exposure over time.
Decisions taken under specific conditions are often reused in similar situations. Without reassessment, they extend beyond their original context. Exposure increases as these decisions continue to be applied.
Effective governance connects behaviour to decision-making.
Governance is effective when organisations ensure that signals are escalated, decisions are challenged, and outcomes are revisited as conditions evolve. This maintains alignment between risk exposure, control application, and strategic intent.
The Human Factor: Challenges in Risk Management
People are unpredictable. They make mistakes, succumb to pressure, and sometimes act irrationally. In industries like healthcare and finance, human error accounts for some of the most significant operational risks, from medical misdiagnoses to financial miscalculations. While organisations implement safeguards to minimise these risks, they often fail to address the behavioural and cultural factors that determine how decisions are made under pressure and how effectively risks are identified, escalated, and acted upon.
Without human oversight and critical thinking, technology alone cannot mitigate risk. It can, in fact, amplify it.
Technology and data-driven models also introduce new complexities. Organisations increasingly rely on automated risk management tools, yet these models are only as good as the assumptions and inputs behind them. A misplaced confidence in algorithms can lead to blind spots, where risks go unnoticed simply because they don’t fit within predefined parameters. Without human oversight and critical thinking, technology alone cannot mitigate risk. It can, in fact, amplify it. The limitation is not only technical. It lies in how outputs are interpreted and challenged. When model outputs are accepted without scrutiny, they shape decisions without being fully understood, creating exposure that remains invisible within formal risk assessments.
Beyond individual behaviour, corporate culture plays a defining role. In high-pressure environments where speaking up is discouraged, risks go unreported, festering until they erupt into full-blown crises. The 2008 financial collapse and high-profile corporate scandals have repeatedly shown the dangers of a culture where employees fear repercussions for raising red flags. When organisations fail to create conditions where concerns are raised and examined constructively, risk does not disappear. It remains present but unarticulated. Over time, this leads to delayed escalation, unchallenged assumptions, and exposure that develops without formal recognition.
Even when issues are raised, ownership is not always clear. Concerns can circulate across teams without a defined point of accountability for resolution. This creates visibility without action, where risks are acknowledged but not decisively managed.
Workplace fatigue and cognitive overload add another dimension to the human challenge in risk management. Employees in high-risk industries often work long hours, increasing the likelihood of mistakes. Studies have shown that decision-making deteriorates under stress, yet many organisations continue to push productivity at the cost of attentiveness and well-being. Without strategies to manage workload and cognitive strain, businesses set themselves up for operational failures and regulatory breaches. Under these conditions, decision quality becomes inconsistent. Individuals rely on shortcuts, defer escalation, or accept existing assumptions to maintain delivery. This introduces variability into risk management that is rarely visible at an aggregate level.
These dynamics follow a consistent pattern within organisations. When signals are not escalated, they remain untested. Assumptions that are not challenged begin to shape subsequent decisions. Actions taken under pressure are often reused beyond their original context, extending their influence over time. This progression embeds behaviours into day-to-day operations, where they operate outside formal governance structures. Exposure develops gradually as these conditions accumulate and remain unexamined.
For more details please read the article: The Risks Leaders Normalise First: Revealing Early Blind Spots
Case Illustration: Knight Capital trading glitch
A trading firm deploys new software to support market-making activity. Within 45 minutes of release, the system generates unintended orders, resulting in losses of approximately $440 million.
The release is time-sensitive. The update is designed to improve execution efficiency and support higher trading volumes. Deployment follows standard procedures, and the change is assessed as low risk based on prior experience.
One component of the system is not updated consistently across all servers. Legacy functionality remains active in part of the environment.
At the point of release, the system begins generating unintended orders. These are processed automatically and executed at speed.
The activity is initially interpreted as normal system behaviour. The volume and pattern of trades increase rapidly, yet the response is delayed as teams seek to determine whether the activity reflects market conditions or system error.
Intervention mechanisms are not immediately effective. The system continues to operate, executing instructions without interruption.
The outcome reflects the interaction between deployment decisions, system assumptions, and the absence of immediate challenge when behaviour diverges from expectations.
How Human Behaviour Translates into Structural Risk
Human behaviour does not only influence isolated decisions. It shapes how risk is recognised, interpreted, and acted upon across the organisation.
"Over time, what was initially understood as risk becomes accepted as part of normal operations... This is how structural exposure develops."
When concerns are not raised, signals remain untested. When assumptions are not challenged, they become embedded in decision-making. When decisions taken under pressure are reused, they extend beyond their original context.
Over time, what was initially understood as risk becomes accepted as part of normal operations. Exceptions become reference points. Temporary adjustments become standard practice. The organisation adapts to the presence of risk without explicitly recognising it.
This is how structural exposure develops. Not through a single failure, but through the gradual normalisation of conditions that were never formally assessed or approved.
The consequence is not only increased risk, but also reduced visibility.
The progression from individual behaviour to increasing exposure follows a consistent pattern.
Understanding how this operates within your organisation requires more than reviewing frameworks. It requires assessing how signals are interpreted, how escalation decisions are made, and how decisions are applied over time.
Assess how human factors influence decision-making and escalation in your organisation -> Contact Us
The Competitive Advantage of Human-Centric Risk Management
Organisations that integrate human factors into risk management improve the quality and timing of their decisions by strengthening how risk signals are identified, escalated, and acted upon. Instead of reacting to crises, they cultivate an environment where early risk detection, including through risk assessment, becomes second nature. When employees feel psychologically safe, they are more likely to raise concerns, challenge assumptions, and prevent small issues from escalating into full-blown crises. In industries such as finance and healthcare, this results in earlier escalation, clearer challenge of assumptions, and more effective intervention before exposure develops.
Beyond crisis prevention, organisations that integrate human factors into risk management maintain consistency in decision-making under increased uncertainty. At a time of rapid technological change and economic volatility, businesses that encourage adaptability and empower their teams to navigate challenges with confidence are better prepared to withstand disruptions. Companies that embed a culture of responsible risk-taking not only mitigate potential threats but also unlock new opportunities for growth. Tech firms, for example, thrive by creating environments where experimentation is encouraged within structured guardrails, leading to breakthrough innovations while managing downside risks effectively.
Trust and reputation also emerge as key benefits of a human-centered approach. Companies that promote transparency, ethical decision-making, and accountability cultivate strong relationships with customers, investors, and regulators. Firms known for their open risk culture and sound governance are often perceived as more reliable partners, gaining competitive leverage in the marketplace. Additionally, organisations that prioritise employee engagement by fostering an environment where individuals feel valued and heard see measurable improvements in job satisfaction and retention. When employees are empowered to contribute to risk discussions without fear of blame, they remain more committed to the organisation’s mission and performance, reducing turnover costs and enhancing institutional knowledge.
A human-centered approach improves the consistency and quality of decision-making across the organisation. Businesses that balance data-driven insights with human judgment can navigate complexity more effectively, avoiding the pitfalls of over-reliance on automated risk models. Those that integrate both analytical tools and intuitive expertise consistently outperform competitors who rely solely on rigid compliance mechanisms. The ability to make swift, informed decisions in the face of uncertainty is a hallmark of companies that see risk management as an enabler rather than a constraint.
Ultimately, forward-thinking organisations recognise that sustainable success requires moving beyond risk avoidance to intelligent risk-taking. Instead of focusing solely on mitigating threats, they harness risk as a driver of innovation, resilience, and growth. By embedding a risk-aware culture that empowers employees and aligns risk strategies with broader business objectives, they not only safeguard their future but actively shape it. Organisations that invest in the human dimensions of risk management strengthen their ability to make informed decisions, manage exposure, and adapt as conditions evolve.
The Path Forward: Making Risk Management Human-Centric
Organisations that address these human challenges strengthen how risk is identified, escalated, and acted upon across the organisation. Integrating psychological safety into risk frameworks enables earlier escalation of issues and more consistent challenge of assumptions at the point of decision-making. This improves the organisation’s ability to respond to emerging exposure before it develops into material risk.
Investing in training that strengthens critical thinking and judgement improves how decisions are assessed, challenged, and revisited under changing conditions. Employees become better equipped to interpret information, question underlying assumptions, and apply risk considerations consistently in their day-to-day activities. This reduces reliance on reactive responses and supports more deliberate decision-making.
Balancing technology with human insight remains essential. Leading organisations use risk models and automated tools to support decision-making, while maintaining active human oversight to interpret outputs, challenge assumptions, and respond to unexpected behaviour. This ensures that technology enhances judgement rather than replacing it, and that emerging risks are identified even when they fall outside predefined parameters.
Leadership plays a central role in embedding these practices. Executives and managers define expectations around escalation, challenge, and accountability, ensuring that risk signals are surfaced and acted upon consistently. Clear ownership and disciplined follow-through strengthen the link between identifying a risk and resolving it, reducing the likelihood that issues remain visible without being addressed.
Embedding the human dimensions of risk management improves the integrity of decision-making across the organisation. Risk signals are more likely to be identified, examined, and acted upon in a timely manner. This strengthens alignment between strategy, execution, and governance, particularly in environments where conditions evolve rapidly.
What This Means for the Future of Risk Management
As organisations navigate increasingly complex risk environments, the role of the human factor becomes more central to how risk is understood and managed. Embedding psychological safety within risk culture strengthens how signals are identified, challenged, and escalated. This ensures that emerging risks are examined in a timely manner and that decisions reflect current conditions rather than outdated assumptions.
Organisations that integrate these practices move beyond a compliance-driven approach. Risk management becomes more closely aligned with how decisions are made across the business, improving consistency in judgement, clarity of ownership, and responsiveness to change. This allows exposure to be addressed earlier, before it develops into more significant issues.
This article forms part of a broader series on risk culture and governance. The focus is on how leadership shapes the conditions under which decisions are made, how risk signals are surfaced, and how accountability is exercised. Subsequent articles will examine the role of leadership in defining escalation expectations, reinforcing challenge, and ensuring that risk management remains aligned with strategy and execution.
Embedding Psychological Safety into Decision-Making and Governance
Psychological safety becomes effective when it is reflected in how decisions are made and how governance processes operate.
At the point of decision, organisations define expectations around challenge, review, and accountability. Alternative views are examined, assumptions are tested, and ownership for acting on emerging risks is clearly assigned. This ensures that issues raised through open dialogue are translated into action.
Escalation mechanisms determine whether risk signals lead to decisions. Reporting provides visibility of current conditions. Escalation defines when intervention is required and who is responsible for responding. Clear thresholds and defined ownership ensure that signals are acted upon consistently.
Review and reassessment maintain alignment over time. Decisions taken under specific conditions are revisited as those conditions evolve. This prevents previously accepted risks from remaining in place without explicit review.
Leadership behaviour reinforces these practices. When challenge is acknowledged and reflected in decisions, it establishes consistent expectations across the organisation. This strengthens the connection between culture, governance, and execution.
How is your organisation adapting its risk culture to foster psychological safety? What challenges have you encountered in balancing compliance with human-driven risk management?
These are the questions shaping the future of risk management, and they deserve deeper exploration. If your leadership team is navigating these challenges, let’s continue the conversation.
These themes are explored in depth in my book, The Risk Within, where I draw on firsthand experience in the corporate world to examine how psychological safety transforms decision-making, leadership, and organisational resilience.
Executive Reflection: Assessing the Role of Human Factors in Your Governance Model
The effectiveness of risk management is shaped by how human factors influence decision-making, escalation, and oversight. This can be assessed through a small number of focused questions:
When concerns are raised, is there clear ownership for acting on them, or do they remain within discussion without resolution
Do escalation mechanisms distinguish between visibility and intervention, with defined triggers for action
Are assumptions within key decisions actively challenged, or do they persist once accepted
Are decisions revisited as conditions evolve, or do they remain in place without reassessment
Does reporting reflect emerging patterns of behaviour, or only established risk metrics
These questions provide a practical way to evaluate whether psychological safety is translating into effective governance. They focus attention on how risk is managed in practice, rather than how it is described in frameworks.
Next Step: Assessing Decision-Making and Governance
Understanding how risk is identified, escalated, and acted upon requires visibility on how decisions are made in practice.
The Aevitium Risk Leadership Diagnostics provides a structured assessment of decision-making, escalation, and governance effectiveness across the organisation. It highlights where assumptions remain unchallenged, where escalation does not lead to action, and where exposure develops over time.
If you are reviewing how risk is identified, escalated, and acted upon, the Risk Leadership Diagnostics provides a structured assessment of decision-making and governance effectiveness.
About the Author: Julien Haye
Managing Director of Aevitium LTD and former Chief Risk Officer with over 26 years of experience in global financial services and non-profit organisations. Known for his pragmatic, people-first approach, Julien specialises in transforming risk and compliance into strategic enablers. He is the author of The Risk Within: Cultivating Psychological Safety for Strategic Decision-Making and hosts the RiskMasters podcast, where he shares insights from risk leaders and change makers.
Frequently Asked Questions
What is psychological safety, and why is it critical for risk management?
Psychological safety is the foundation that allows individuals to speak up, challenge assumptions, and engage in honest discussions without fear of blame or retribution. In risk management, it ensures that potential threats and issues are identified early, rather than being ignored or suppressed. Organisations that embed psychological safety into their risk culture are better equipped to anticipate, navigate, and mitigate risks proactively.
How does psychological safety align with regulatory and compliance-driven risk management?
Many organisations see compliance as a structured, rules-based process, but psychological safety enhances regulatory effectiveness by fostering an environment where employees feel comfortable reporting concerns, escalating issues, and engaging in ethical decision-making. A strong risk culture, supported by psychological safety, leads to better governance, improved regulatory relationships, and fewer compliance failures.
What are the first steps to embedding psychological safety into a risk culture?
Leadership plays a key role in setting the tone. First, executives and managers must actively model openness, encourage dialogue, and reward transparency. Second, organisations should integrate psychological safety into their risk frameworks by embedding it into training, performance reviews, and incident response mechanisms. Third, organisations must create structured processes for raising concerns, ensuring that employees see real consequences from speaking up—not just in times of crisis but as part of everyday decision-making.
How does this topic connect to Risk Within?
This article is part of a broader exploration of risk culture and leadership that I discuss in my upcoming book, Risk Within. The book delves into how psychological safety transforms risk management, governance, and strategic decision-making, offering insights from both research and real-world corporate experience. If this article resonates with you, Risk Within provides a deeper examination of these principles in action.
Where can I join upcoming discussions on this?
In the lead-up to the book’s release, I will be hosting discussions on these topics through LinkedIn sessions and private executive roundtables. Stay connected for details on how to participate and engage in conversations on risk culture, leadership, and psychological safety.