Organizations often measure "risk culture" through surveys, workshops, and maturity models, but the evidence suggests that many traditional approaches are only weakly associated with actual risk performance. The strongest predictors of better risk outcomes tend to be observable behaviors, decision quality, and organizational learning rather than stated attitudes.
Here's how the main approaches compare.
| Approach | What it measures | Evidence of correlation with outcomes |
|---|
| Employee surveys | Perceptions, beliefs, attitudes | Moderate when well designed; weak if used alone |
| Interviews & focus groups | Nuance, informal norms | Valuable diagnostically but subjective |
| Behavioral indicators | Actual decisions and actions | Stronger correlation |
| Incident & near-miss analysis | Learning capability | Strong correlation |
| Decision-quality reviews | How risk is considered in major decisions | Strong correlation |
| Network & communication analysis | Information flow | Emerging evidence |
| Regulatory maturity assessments | Governance processes | Good for compliance, less predictive of resilience |
What research consistently finds
Several themes appear across studies in banking, healthcare, aviation, energy, and other high-reliability industries.
1. Psychological safety is one of the strongest predictors
Teams that can openly discuss concerns, challenge assumptions, and report mistakes tend to experience:
- fewer catastrophic failures
- earlier identification of emerging risks
- more effective learning after incidents
This doesn't mean avoiding accountability. High-performing organizations combine openness with clear performance expectations.
2. Speaking up matters more than risk awareness
Many organizations score highly on questions like:
"I understand our risk policies."
That rarely predicts outcomes very well.
Questions that are more predictive include:
- "I can challenge a senior manager."
- "Bad news travels quickly."
- "Near misses are discussed."
- "People raise concerns before they become problems."
These reflect actual organizational behavior rather than knowledge.
3. Decision processes outperform attitude measures
Some organizations now review major decisions rather than general culture.
For example:
- Was uncertainty explicitly discussed?
- Were alternative scenarios considered?
- Was dissent documented?
- Were assumptions challenged?
- Were incentives examined?
This provides direct evidence of whether risk is influencing decisions.
Leading indicators that correlate with stronger risk outcomes
Organizations with healthier risk cultures often exhibit:
- High rates of near-miss reporting
- Rapid escalation of emerging issues
- Low retaliation against whistleblowers
- Frequent cross-functional communication
- Evidence that leaders change decisions after challenge
- Consistent post-incident learning
- Balanced incentive systems (not solely rewarding short-term performance)
- Stable turnover in critical control functions
Notably, more reported incidents can be a positive sign if reporting is improving. A low incident count may simply reflect underreporting.
Less useful metrics
Organizations often overemphasize measures such as:
- Percentage of staff completing risk training
- Number of policies
- Survey averages like "Risk is important."
- Maturity model scores
- Volume of risk registers
These indicate activity rather than effectiveness.
Better diagnostic approaches
A stronger assessment combines multiple sources of evidence.
For example:
Behavioral data
- escalation rates
- challenge frequency
- override decisions
- policy exceptions
- audit findings
- near-miss reporting
Decision reviews
Select important strategic decisions from the past year and ask:
- What risks were identified?
- Which assumptions proved incorrect?
- Was dissent encouraged?
- Were incentives considered?
- What information was ignored?
Leadership observation
Assess whether leaders:
- admit uncertainty
- invite disagreement
- respond constructively to bad news
- visibly act on risk information
Learning capability
Examine whether the organization:
- conducts high-quality root cause analyses
- tracks corrective actions
- shares lessons across teams
- updates practices after incidents
Learning speed often predicts future resilience better than current compliance.
A practical framework
One useful way to think about risk culture is across five dimensions:
- Voice — Can people raise concerns?
- Decision quality — Are risks integrated into decisions?
- Accountability — Are incentives aligned with prudent risk-taking?
- Learning — Does the organization improve after mistakes?
- Leadership signals — Do leaders consistently reinforce desired behaviors?
Each dimension can be measured using:
- survey items,
- behavioral metrics,
- interviews,
- documented decision reviews,
- and observed outcomes.
This "triangulation" is generally more informative than relying on a single survey.
What predicts resilience best?
Across industries, organizations that recover well from unexpected events tend to share several characteristics:
- rapid detection of weak signals
- willingness to surface uncomfortable information
- disciplined but adaptable decision-making
- continuous learning from both failures and successes
- leadership that models curiosity rather than certainty
These qualities are more consistently associated with favorable risk outcomes than formal risk policies or high scores on culture surveys alone.
Overall, the strongest evidence suggests that observable organizational behaviors—especially speaking up, high-quality decision processes, effective learning from incidents, and leadership responses to bad news—are more predictive of better risk outcomes than perceptions, compliance activities, or self-reported attitudes. A robust risk culture assessment therefore combines perception data with behavioral and operational evidence rather than relying on any single diagnostic tool.
