.png)
Leaders Don’t Experience Risk Culture
- Julien Haye
- Jan 17
- 13 min read
Updated: 6 hours ago
Introduction — The First Discomfort
Risk culture shapes how organisations respond when uncertainty disrupts delivery. It determines whether issues surface early, how challenge is handled, and who absorbs the consequences when priorities collide. In most organisations, risk culture is discussed as a set of values or expectations. In practice, it is experienced through escalation, response, and outcome.
Many risk culture initiatives focus on intent. Leaders articulate the right messages. Frameworks are approved. Expectations are reinforced through tone from the top. From that vantage point, risk culture often appears healthy and aligned. Escalation is encouraged. Challenge is invited. Governance feels proportionate and in control.
Elsewhere in the organisation, the experience can be different. Risk is encountered through delivery pressure, competing objectives, and personal exposure. Escalation is rarely a neutral act. It carries consequences that shape how and when people choose to raise concerns. Over time, these experiences form a memory of how risk is really handled, independent of what is said.
This creates a structural gap. Senior leaders experience risk through designed forums and curated narratives. Delivery teams experience it through lived consequence. Both perspectives are internally coherent. Neither is the result of poor intent. The issue is that governance rarely forces these experiences to intersect.
As a result, risk culture does not fail everywhere. It fails at specific points of escalation, handoff, and consequence. Those points are visible long before incidents occur.
This article examines risk culture through that lens. It focuses on how governance teaches behaviour, why escalation patterns matter more than statements, and how organisations learn what is safe to raise. The aim is not to redefine culture, but to make its mechanics visible, where risk is actually shaped.
TABLE OF CONTENTS
Two Legitimate Experiences of the Same System
Risk culture feels different depending on where you encounter it.
That difference is not accidental, and it is not a failure of intent.
At senior levels, risk is experienced through designed structures and direct management engagement. Discussion happens in scheduled forums, supported by aggregated reporting and curated narratives. Risk is also engaged through bilateral, but most of the time equally curated, conversations, leadership team meetings, portfolio reviews, and risk discussions within each executive’s own area of responsibility.
Accountability is real, but it is mediated through role authority and governance. Senior leaders rarely experience risk processes as delivery constraints. They do not have to navigate risk escalation while meeting operational deadlines, managing resource trade-offs, or translating risk language into execution under pressure.
Senior leaders’ engagement with risk is episodic, even when attention is sustained. Issues appear, are discussed, and move on. They often leave the room with a sense that the risk has been handled. What is less visible is that their contribution also sends a signal about how risk should be handled next time. From this vantage point, the system feels typically orderly, proportionate, and responsive. Nothing feels hidden. Nothing feels unsafe.
The experience is asymmetrical, and in important ways, buffered.
Elsewhere in the organisation, risk is experienced through lived pressure. Decisions are made continuously, often under delivery constraints that leave little room for abstraction. Escalation is informal long before it becomes formal. Ownership is personal, not collective, and consequences attach to individuals rather than forums. Judgement is not based on what was said in a meeting, but on what followed afterwards. Risk is not episodic. It is persistent.
Both perspectives make sense within their own context. Executives are not ignoring reality. Delivery teams are not misunderstanding intent. Each is responding rationally to the part of the system they inhabit and the signals they receive.
The organisation is designed so that the executive experience of risk and the delivery experience of risk can remain separate, even when both are functioning well in their own context. The system does not require those perspectives to intersect. Governance enables reassurance to form at the top, while adaptation occurs below through absorbed friction and informal workarounds. Each side learns from different signals, and alignment is assumed rather than tested. As a result, misalignment can persist quietly, with reassurance above and constraint below coexisting until an incident forces the system to reconcile them.
Our Risk Leadership Diagnostics help leaders identify behavioural blind spots and shape more accountable risk decisions.
Intent Is Clear. Impact Is Asymmetrical.
People don’t remember what leaders say about risk.
They remember what happened the last time someone spoke up.
At senior levels, risk culture is often assessed through intent. Leaders look at what they approve, the frameworks they sponsor, the messages they repeat, and the tone they set in formal and informal settings. From that perspective, encouragement is visible and consistent. Risk feels welcomed because it is invited.
Across the organisation, risk culture is assessed differently. It is judged through outcomes rather than messages. What matters is not whether escalation is encouraged, but what follows when it occurs. Was the issue taken seriously. Was the person supported. Did the escalation change priorities or simply create friction. Did it lead to learning. Was the person who escalated subtly sidelined from subsequent decisions and discussions.
These moments accumulate quickly. Each escalation leaves a residue. Over time, the organisation forms a memory of how risk is treated, not in principle, but in practice. That memory shapes future behaviour more powerfully than any policy statement or leadership message.
This is where a disconnect often emerges. Leaders experience a culture shaped by what they intend and endorse. The organisation experiences a culture shaped by what it has learned to expect. Both views can coexist without contradiction, yet they produce very different signals.
Risk culture is not misread. It is lived through and then remembered.
In a recent LinkedIn poll, respondents pointed overwhelmingly to leadership response (42%) and psychological safety (28%) as the strongest influences on escalation behaviour. The signal was clear: people know how to escalate risk. What shapes behaviour is confidence in what happens next.
Where the Gap Is Designed In
The gap between executive experience and organisational reality is rarely created by attitude. It is created by design choices that shape how risk travels, who absorbs friction, and where consequences land.
Escalation thresholds are one example. Many organisations define clear points at which issues must be raised formally. In practice, crossing those thresholds often increases personal exposure. Language changes. Visibility widens. What was once a local concern becomes a reputational event. The act of escalation, rather than the risk itself, becomes consequential.
Decision rights create a similar effect. As organisations scale, accountability is distributed across roles, committees, and functions. Ownership appears clear on paper yet becomes blurred in motion. Decisions are made collectively, but delivery consequences remain individual. The result is a system where responsibility is shared upward, while exposure concentrates downward.
Performance signals reinforce this dynamic. Delivery certainty, momentum, and predictability are rewarded consistently. Early judgement, ambiguity, and caution are harder to value in scorecards and incentives. Leaders often reinforce this unintentionally when they signal that they want to see solutions, not problems. The message is pragmatic, but it shifts behaviour. Issues are held back while people gather more data, identify root causes, and shape potential fixes. Escalation becomes something that should arrive complete rather than timely.
Over time, the system teaches that raising a risk early, without answers, carries more personal cost than raising it late, with solutions attached. Being right late feels safer than being uncertain early.
Forums complete the picture. Senior risk discussions often feel constructive and balanced. Time is allocated. Language is moderated. Options are explored. Lower down, those same forums can feel consequential rather than supportive, because attendance itself signals severity and scrutiny.
No one tells you not to escalate. You just learn when it’s a bad idea.
The system does not need to explain this lesson. It demonstrates it.
Why Senior Leaders Rarely See the Gap
Case Study: Challenger, Before the Disaster
The dynamics described so far are not theoretical. They are well documented in complex organisations operating under pressure. Diane Vaughan’s analysis in The Challenger Launch Decision shows how senior leaders can experience reassurance while risk steadily accumulates elsewhere in the system.
In the years before the Challenger launch, engineers raised concerns repeatedly about O-ring performance in cold temperatures. These concerns were not hidden or ignored. They were discussed, documented, and escalated through formal channels. The issue was visible.
What changed was how those signals were interpreted. Over time, anomalies were reframed as acceptable deviations. Each successful launch without catastrophic failure reinforced the belief that the risk was understood and under control. Escalation continued, but it occurred within boundaries that had become normalised. Technical concerns were translated into management language, accompanied by rationale, caveats, and prior outcomes.
From a leadership perspective, the system appeared to be functioning. Processes were followed. Decisions were made through established forums. Expert input was present. Nothing suggested recklessness or disregard. What leaders experienced was compliance with governance, not proximity to danger.
The critical point is not that leaders dismissed engineering judgement. It is that the structure through which risk travelled transformed how it was felt. Reassurance emerged as an output of the system itself, shaped by reporting formats, prior success, and collective interpretation.
The lesson is uncomfortable but important.
Reassurance does not require neglect.
It can be produced by well-intended, well-designed governance operating exactly as expected.
👉If you're interested in applying these principles in your organisation, Explore our Risk Culture & Leadership Solutions
Where Risk Culture Actually Breaks
Case Study: BP Texas City, Before the Explosion
Risk culture breaks the moment escalation becomes personal.
In the years leading up to the Texas City refinery incident, cost pressure and production targets were persistent. Efficiency, uptime, and budget discipline were not episodic priorities. They were structural expectations. Within that environment, safety concerns did surface, yet they had to compete with performance signals that were clearer, louder, and more consistently reinforced.
At the frontline, exposure increased as issues moved closer to formal escalation. Raising concerns about aging equipment, deferred maintenance, or operating conditions did not simply introduce a technical discussion. It changed how individuals were perceived. Escalation triggered scrutiny, additional reporting, and pressure to justify disruption to production. The further an issue travelled, the more personally consequential it became.
Handoffs played a critical role. As safety issues moved upward, they were reframed through layers of management, translated into metrics, and contextualised against broader performance narratives. By the time they reached senior levels, they appeared bounded and manageable. Executives received reassurance through improving safety statistics and formal reporting that suggested progress and control.
From the top, safety culture looked increasingly positive. From the frontline, the experience was different. Each escalation raised the stakes without altering the physical risk. Over time, the lesson became clear. Managing issues locally felt safer than escalating them formally.
As later observed in post-incident analysis, reducing day-to-day accident rates revealed little about exposure to major operational disasters. Low injury frequency masked the accumulation of systemic risk.
The breakdown did not occur because safety was dismissed. It occurred because escalation altered exposure.
Risk culture fractured at the handoff, where individual consequence replaced shared responsibility, long before any incident forced the system to confront itself.
In a LinkedIn poll, most respondents pointed to leadership intent (57%), while fewer highlighted response to escalation (32%). The split reflects the difference between how risk culture is assessed at the top and how it is learned through consequence.
How the Organisation Adapts
When escalation becomes costly, organisations adapt. Not because people are careless or disengaged, but because they are trying to deliver in a system that rewards continuity.
Under sustained pressure, risk rarely disappears. It is reshaped. Issues are held while more information is gathered. Judgement is delayed until uncertainty can be reduced. Concerns are translated into design choices, sequencing decisions, or local workarounds that allow progress to continue. Escalation remains possible, yet it becomes something that should arrive complete, justified, and unlikely to disrupt momentum.
Over time, this behaviour becomes normal. People learn how much uncertainty the system will tolerate. They learn which issues can be raised early and which are better resolved quietly. They learn where risk can be absorbed without widening exposure. Escalation becomes selective, and silence takes its place.
That silence reflects learning, not avoidance. It is the result of repeated interaction with how the organisation responds to disruption. When early escalation creates friction without changing outcomes, the system teaches restraint. When late escalation arrives with answers attached, it is received more easily.
From above, progress still looks steady. From within delivery, adaptation feels necessary. Risk is managed in ways that preserve momentum, even when doing so increases the distance between governance reassurance and operational reality.
The organisation does exactly what the system trains it to do.
See our article on Why Risk Escalation Fails and How Control Replaces Transparency
The Limits of “Strong Tone from the Top”
Tone from the top matters. Clear messaging, visible sponsorship, and consistent leadership language shape how risk is talked about and legitimised across the organisation. When leaders articulate expectations clearly, it creates permission to engage.
That permission, however, is not enough. Tone is often asked to carry more weight than it can bear, precisely because it allows leaders to feel aligned without confronting how risk is actually experienced.
Risk culture is not aligned by endorsement alone. It is aligned by whether the experience of engaging with risk matches what leaders say they value. When messages encourage early escalation but responses create friction, delay, or personal exposure, people notice. They adjust quietly, without challenge or complaint.
The erosion is subtle. Trust is not lost through overt contradiction. It weakens through small inconsistencies between words and outcomes. Over time, people stop listening to statements and start reading signals. They learn which risks are safe to raise, when to raise them, and how much certainty is expected before doing so.
This is where blind spots form. Leaders continue to reinforce the right messages and see them echoed in formal forums. The organisation adapts to how those messages play out in practice. Both believe they are aligned.
Without shared experience, tone becomes reassurance rather than insight. It signals intent, not impact. And where intent is not tested against lived consequence, risk culture drifts quietly out of view.
For senior leadership, this blind spot is structurally reinforced.
The Role of the Risk Function
Most organisations don’t ignore control breaches. They absorb them. Issues are fixed locally, workarounds appear, and delivery continues. Escalation is held back while teams try to keep things on track, especially when wider exposure feels riskier than the issue itself. From the frontline, this feels like doing the right thing. From above, the system still looks stable.
What reaches senior levels is not untrue, but it is incomplete. Over time, executive confidence is reinforced by what the system reports. Indicators improve. Issues appear contained. The absence of escalation is taken as evidence of control. Below the surface, however, effort accumulates. Teams absorb friction, adapt quietly, and adjust what they are willing to raise. Risk engagement does not stop. It becomes more selective, more cautious, and more contained. In that situation, it is not that leaders can’t connect the dots. It is that the dots never arrived in a connectable form.
This is where the role of the risk function needs to be reframed, at least in this context. The risk function does own important elements of the risk framework, governance processes, and oversight mechanisms. It can define what good risk management behaviour looks like, set expectations, and articulate how escalation is supposed to work. But behaviour does not exist in isolation. How people actually engage with risk is shaped by the wider culture of the organisation and the consequences it produces.
The risk function cannot enforce behaviour, nor can it define culture independently of how the organisation operates. Its distinctive value lies in exposing where governance teaches the wrong lesson. That means surfacing patterns rather than incidents, and experience gaps rather than compliance gaps. It means showing how escalation really travels through the organisation, where it slows or stops, and how personal exposure changes as visibility increases.
The risk function translates system behaviour upward without moralising. It helps leaders see not only what is reported, but what is learned through consequence. It makes visible the distance between reassurance and lived reality early enough to act. The limits matter. Risk cannot create psychological safety on its own, nor can it override performance incentives or leadership behaviour. What it can do is make those forces visible, long before the behaviours they produce harden into habit or failure.
The Risk Within provides a roadmap for embedding psychological safety into risk management. It identifies critical touch points across the risk lifecycle and offers clear actions to align leadership, culture, and governance. It is designed to help risk functions integrate more deeply into the business and strengthen decision-making at every level.
Designing for a Shared Risk Reality
Closing the gap between executive reassurance and organisational experience does not require a new culture programme. It requires treating experience itself as a risk signal.
When the way leaders experience risk differs materially from how it is felt in delivery, that gap is not a soft issue. It is an indicator that governance is absorbing friction in one place and concentrating it in another. Mature organisations learn to look for that pattern early.
This starts by testing governance from multiple vantage points. Not only how risk appears in formal forums, but how it is encountered in day-to-day decisions, handoffs, and escalation paths. Where does risk slow work down. Where does it become personal. Where does it require translation to remain acceptable.
Shared risk reality also requires leaders to encounter friction directly. Not through summaries or dashboards, but through exposure to the trade-offs, constraints, and uncertainty that shape behaviour lower in the organisation. Without that contact, reassurance remains unchallenged.
The aim is not uniformity of experience. It is comparability. When leaders and delivery teams recognise the same tensions, speak the same language, and respond to the same signals, governance becomes a learning system rather than a filtering one.
Alignment of this kind is a marker of governance maturity.
It is achieved through design, not declaration.
Closing Reflection — The Risk Escalation Lesson the System Teaches
Risk culture does not fail everywhere. In most organisations, it works as intended for long periods. The failures that matter emerge at specific points, where exposure shifts and escalation changes what is personally at stake.
Those points are rarely hidden. They appear in small delays, in workarounds that become normal, and in risks that are managed quietly rather than raised. Long before incidents occur, the system is already teaching people what is safe to say, when to say it, and how much certainty is expected.
Alignment is not achieved when leaders speak more clearly. It emerges when leaders and the organisation experience the same friction, the same trade-offs, and the same consequences. When risk feels similar at the top and in delivery, signals travel faster and learning happens earlier.
Until then, the system continues to teach in its own way.
Consequences teach faster than messages because you only need to feel them once.
About the Author: Julien Haye
Managing Director of Aevitium LTD and former Chief Risk Officer with over 26 years of experience in global financial services and non-profit organisations. Known for his pragmatic, people-first approach, Julien specialises in transforming risk and compliance into strategic enablers. He is the author of The Risk Within: Cultivating Psychological Safety for Strategic Decision-Making and hosts the RiskMasters podcast, where he shares insights from risk leaders and change makers.