What's Going On Here? The Most Important Question in Operational Risk Management

Operational Risk Management · Risk Governance · Risk Culture · GRC Technology

The most important question in risk management

In Radical Uncertainty: Decision-Making Beyond the Numbers (2020), John Kay and Mervyn King argue that one of the most useful questions when confronting uncertainty is deceptively simple: “What is going on here?” It is arguably the most important question in operational risk management (ORM), yet one that our increasingly elaborate frameworks and reporting processes do not always encourage us to ask.

ORM has developed an extensive toolkit, including risk and control self-assessments (RCSAs), risk registers, key risk indicators (KRIs), incident databases, control testing, scenario analysis, risk appetite statements and sophisticated governance, risk and compliance (GRC) systems. All are potentially valuable, but their usefulness depends upon how accurately we understand the organisation and the risks it faces. What happens when that understanding is incomplete, distorted or simply wrong, or when people know something is wrong but nobody is prepared to say so or take responsibility for addressing it?

Before we can manage risks effectively, we must understand what is happening, while creating the conditions in which information can surface, assumptions can be challenged and uncomfortable conclusions can lead to action. That is considerably more difficult than it sounds.

When organisations fail to understand what is happening

Consider the institutional failures exposed by the Jimmy Savile scandal, alongside wider public controversies and allegations involving prominent entertainment figures such as Russell Brand and David Walliams. These are different cases involving different evidence and legal circumstances, and allegations must not be confused with established wrongdoing. Nevertheless, they raise important questions about how organisations acquire knowledge, interpret warning signs and respond to concerns involving influential individuals.

In the Savile case, subsequent investigations identified serious institutional failures involving the handling of concerns, safeguarding, information sharing and accountability. The troubling question is how serious problems could persist within institutions possessing formal management structures, policies and oversight arrangements. The challenge was not necessarily a complete absence of information, but also the ability and willingness to recognise its significance, connect separate observations, challenge assumptions and act.

The same challenge arises in financial services. A bank may experience repeated technology incidents, customer complaints, staff concerns, control failures, audit findings and regulatory observations, each investigated and closed separately. But has anyone asked what these developments might be telling us collectively? Are they unrelated problems, or symptoms of a more fundamental weakness? An organisation can become very good at recording individual events while remaining remarkably poor at understanding the system that produces them.

Radical uncertainty: understanding before measurement

Kay and King distinguish between uncertainty that can reasonably be represented using probabilities and radical uncertainty, where possible outcomes, underlying mechanisms or relevant information may be insufficiently understood. Statistical analysis is valuable where reliable historical data and sufficiently stable conditions exist, but many important business decisions cannot be reduced to reliable probabilities.

This is particularly relevant to ORM, where risk owners are frequently asked to assess likelihood and impact using five-point scales and heat maps. What does a likelihood score of three mean when the organisation has an incomplete understanding of the risk? How reliable is a residual risk rating when control effectiveness rests primarily on management assertions? What confidence should we place in a green KRI that may not measure the underlying problem?

The difficulty is not that measurement is misguided, but that measurement cannot compensate for a poor understanding of what we are measuring. Understanding must precede measurement, and developing that understanding requires more than gathering data and assigning scores.

Three failures of organisational knowledge

It is useful to distinguish three related but different problems. First, we may simply not know: information is unavailable, events are unprecedented or relevant risks have not yet been recognised. Second, we may possess information but fail to understand it: observations are treated in isolation, warning signs dismissed or an inadequate management explanation accepted. Third, and perhaps most troubling, we may understand that something is wrong but fail to act: people remain silent, responsibility is diffused, uncomfortable information is suppressed or group pressure discourages dissent.

The third problem cannot be solved simply by collecting more information or introducing more sophisticated technology, because it concerns behaviour, incentives, accountability and culture. An effective risk framework must help the organisation interpret information and create meaningful mechanisms for challenge, escalation and action.

The bystander effect: everyone knows, but nobody acts

The bystander effect describes how individuals may be less likely to intervene when others are present, partly because responsibility becomes diffused across the group. Within organisations this can generate the dangerous assumption that someone else must know about the problem and must be dealing with it.

A member of staff witnesses a questionable practice but assumes their manager is aware; the manager assumes Compliance has reviewed it; Compliance assumes the first line owns the issue; the risk function assumes Internal Audit will investigate; and Internal Audit assumes management has considered the implications. Each person believes responsibility lies elsewhere, with the result that nobody acts.

This is especially relevant to the Three Lines Model. The model usefully clarifies management responsibilities, oversight and independent assurance, but does not automatically ensure risks will be recognised or escalated. Poor implementation can encourage people to regard risk management as somebody else's responsibility. An effective culture requires clear accountability, accessible escalation routes and an expectation that concerns should be raised even when someone else may already know about them.

Groupthink: when consensus becomes more important than reality

Groupthink arises when pressure for consensus and cohesion undermines independent judgement. People may privately question a decision but remain silent because they believe the group has reached a conclusion; others interpret that silence as agreement, reinforcing the apparent consensus.

Solomon Asch's conformity experiments in the 1950s showed that participants sometimes agreed with an obviously incorrect majority judgement when comparing the lengths of lines. The finding was not that everyone always conforms, but that social pressure can influence judgement even when evidence appears straightforward.

Douglas Murray's The Madness of Crowds and Andrew Doyle's The New Puritans examine broader questions about conformity, ideological pressures and the consequences of challenging prevailing orthodoxies. Their cultural and political interpretations are open to debate, but the organisational question remains: what happens when expressing an unpopular view carries a greater immediate personal cost than remaining silent, or when disagreement is interpreted as disloyalty?

Boards and committees can become vulnerable to these pressures. Unanimous assurances about a transformation programme or a reassuring assessment of third-party resilience may reflect genuinely independent agreement, but they may also reflect the suppression of doubt. Effective governance requires evidence-led challenge and an environment in which seniority does not determine whether an explanation is accepted.

Obedience to authority: would we really behave differently?

Stanley Milgram's experiments at Yale in the early 1960s investigated whether ordinary people would obey an authority figure when instructions appeared to conflict with their moral judgement. Participants believed they were administering increasingly severe electric shocks to another person for incorrect answers in a learning experiment. The supposed recipient was an actor and no real shocks were administered, but the participants were not initially told this. In the best-known condition, 26 of 40 participants, or 65%, continued to the maximum indicated 450 volts.

Milgram's work has been scrutinised, including questions about participants' beliefs and whether their behaviour reflected obedience, identification with the researcher's objectives or other influences. Nevertheless, it illustrates how apparently legitimate authority can affect people's willingness to challenge instructions they would otherwise question.

Christopher Browning's Ordinary Men: Reserve Police Battalion 101 and the Final Solution in Poland provides an even more disturbing historical examination. Browning studied how members of a German reserve police battalion became involved in the mass murder of Jewish civilians during the Holocaust, considering authority, peer pressure, conformity, antisemitism, wartime conditions and the normalisation of violence. In an early episode, members were offered an opportunity to step aside from a mass shooting, yet relatively few initially did so. These circumstances must never be equated with ordinary corporate misconduct, but the research challenges comforting assumptions about how readily ordinary individuals will resist authority or group pressure.

Jordan Peterson has discussed Milgram, totalitarianism and the danger of assuming that we ourselves would necessarily have resisted wrongdoing. Most of us prefer to believe that intelligence, values and independence of judgement would protect us from such pressures, but confidence in our own moral independence is not evidence that we would act independently when dissent carries a personal cost.

Consider a financial services transformation programme supported by a powerful senior executive despite growing concerns about operational readiness. Technology specialists identify weaknesses, operational staff question testing and risk managers raise resilience concerns, yet each assumes that others possess information or authority that justifies proceeding. Formal approvals, committee minutes and reassuring management information accumulate. When the programme fails, the organisation discovers that numerous experienced professionals privately had reservations, but nobody brought them together or ensured they were addressed.

The question is not simply why controls failed, but why an organisation containing intelligent, conscientious people collectively failed to act upon concerns that were at least partly understood. Effective ORM should not depend on everyone being willing to challenge authority at personal cost; it should create an environment in which challenge is expected, supported, documented and acted upon.

The Salem witch trials: when collective belief overwhelms evidence

The Salem witch trials of 1692–1693 provide a further historical illustration of collective conviction, institutional authority and flawed evidential practices. Accusations of witchcraft spread through colonial Massachusetts, resulting in prosecutions, imprisonment and executions. The trials reflected complex religious, social, legal and political circumstances, including acceptance of so-called spectral evidence that would not satisfy modern standards of reliable proof.

The point is not that modern organisations are directly comparable to seventeenth-century witch trials, nor that the history can be reduced to a simple explanation of mass hysteria. Rather, collective conviction, institutional authority and the failure to challenge unreliable evidence can reinforce one another. An organisation may become so confident in a prevailing explanation that contradictory information is discounted and those who challenge the consensus become part of the perceived problem. Widespread agreement does not establish that an explanation is correct.

Common sense: essential, but not always common

Much of effective ORM is, at its heart, common sense. If a process repeatedly fails, investigate why; if a control supposedly operates but there is no evidence, challenge the assertion; if customers complain, listen; and if several incidents occur, consider whether they share an underlying cause.

Yet common sense can be remarkably uncommon in organisational practice. Highly capable individuals become absorbed in methodologies, reporting requirements, organisational politics and procedural compliance, focusing on completing the RCSA rather than understanding the risk, closing an incident rather than identifying its cause, or producing a dashboard rather than questioning what it reveals.

The value of a good risk manager often lies in asking apparently obvious questions when everyone else has stopped asking them. Common sense is not a substitute for rigorous risk management; it is one of the foundations upon which rigorous risk management should be built.

Absence of evidence: why documentation matters

One of the expressions we use in JADEtc Academy training is “Absence of evidence is evidence of absence.” From a regulator's or auditor's perspective, if an activity or control cannot be evidenced, it may as well not have happened. Strictly speaking, absence of evidence is not conclusive proof that an activity never occurred, but where evidence should reasonably exist, its absence is a legitimate reason for challenge.

Documentation also preserves organisational knowledge. Decisions that seemed obvious at the time become difficult to reconstruct as people leave, responsibilities change and memories fade. Why was a concern dismissed? Who reviewed the evidence? What alternative explanations were considered? Why was a risk accepted? Without reliable records, the organisation may struggle to distinguish a reasonable judgement under uncertainty from an inadequate assessment or failure to act. Lack of documentation can also make uncomfortable concerns easier to overlook, minimise or conceal.

This is not an argument for recording every conversation. Excessive documentation has costs of its own. It is an argument for proportionate evidence of material activities, decisions, challenge, risk acceptances and follow-up. If a decision matters, the organisation should be able to explain what was decided, why, by whom and on what evidence.

GRC technology: better information or a more sophisticated illusion?

Modern GRC platforms offer considerable opportunities to improve ORM through integrated risk and control registers, incident management, automated workflows, action tracking, control testing, evidence repositories and management information. They can connect information otherwise fragmented across functions, highlight recurring incidents or control failures, establish accountability and reduce the risk that concerns disappear into email exchanges.

But technology cannot guarantee understanding. A GRC platform may contain comprehensive information that is incomplete, inaccurate, poorly classified or based on flawed assumptions. Automated workflows can efficiently process concerns without recognising their underlying significance; attractive dashboards can visualise risk assessments that were never adequately challenged; and control testing records may not demonstrate meaningful testing.

The fundamental distinction is between digitising a risk management process and improving the quality of risk management itself. A poor process does not become effective merely because it has been automated. AI may help identify patterns across incidents, complaints, audit findings and employee concerns, but can also produce plausible incorrect explanations and reinforce biases in historical data. A useful test of GRC technology is therefore not simply how efficiently it produces a dashboard, but whether it helps an organisation recognise when its understanding of risk may be wrong.

Risk management as the search for better explanations

There is a useful connection between Kay and King's work and David Deutsch's emphasis on explanations, criticism and the correction of errors. We should not assume an explanation is correct merely because it is widely accepted, endorsed by management or consistent with existing reporting. We should ask whether it accounts for the evidence, whether alternatives are more credible and what observations might reveal that our understanding is mistaken.

Consider a business unit experiencing technology incidents, increasing staff turnover, reconciliation problems and customer complaints. A conventional RCSA might treat these as separate issues, whereas a more searching approach would ask whether they share an underlying cause. Is the business operating beyond capacity? Has a technology transformation introduced unrecognised weaknesses? Are staff compensating for inadequate systems through manual workarounds? Are incentives encouraging underreporting?

The objective is not speculation for its own sake, but explanations that can be investigated and tested. A good risk manager should be able to explain the current understanding, supporting evidence, uncertainties, alternatives and what could change the assessment. That is more informative than a risk score without context.

RCSAs: a starting point, not the answer

The RCSA remains valuable when properly implemented, providing a structured means of identifying risks, evaluating controls, assessing residual exposures and deciding where action is required. But it is only as good as the understanding and judgement brought to the exercise.

Too often, attention centres on completing templates, reviewing established descriptions and updating scores. The framework becomes self-referential: organisations assess risks already in the register using assumptions embedded in previous assessments, without questioning whether those risks still describe reality.

A more effective RCSA examines how activities actually operate rather than merely how policies say they operate, drawing on incidents, complaints, near misses, audit findings, control testing, staff feedback and external developments. It asks what evidence supports the conclusion that a risk is controlled, what might be overlooked, what would disprove the assessment and whether people know of concerns that have not been formally raised. These questions do not replace the methodology; they make it valuable.

The danger of green dashboards

Boards receive dashboards containing risk ratings, KRIs, control assessments, incident trends and remediation progress. Such reporting is essential, but a green dashboard does not necessarily mean risks are well managed: it means reported measures are within their defined parameters, which is not the same thing.

Indicators may be poorly designed, thresholds inappropriate, data incomplete and control assessments subjective, while serious problems remain unreported. The organisation may also be monitoring yesterday's risks while missing tomorrow's. The most valuable board discussion may therefore begin not with “Why is this indicator red?” but with “How confident are we that this dashboard gives us an accurate picture of what is happening?” Reassuring reporting may itself reflect collective assumptions nobody has adequately challenged.

Ten questions that should sit at the heart of ORM

1. What is actually going on here? What is our best explanation, and does it account for the evidence?
2. What do we know, and how do we know it? What rests on independent evidence rather than assertions or assumptions?
3. What might we be missing? Are there weak signals, reporting gaps or overlooked dependencies?
4. What alternative explanations are possible? Could the evidence indicate a more serious underlying problem?
5. What incentives influence what we are told? Are commercial or personal pressures affecting escalation?
6. Is there something everyone knows but nobody is saying? Could fear or diffusion of responsibility prevent concerns surfacing?
7. Are we challenging assumptions or reinforcing consensus? Can people disagree with influential individuals?
8. What evidence would change our minds? What tests or observations could challenge our understanding?
9. Can we demonstrate what was done and why? Are material decisions, concerns and risk acceptances documented?
10. What should we do while uncertainty remains? What proportionate preventative, detective, responsive or recovery measures are justified?

The limits of knowledge are not an excuse for inaction

Recognising uncertainty does not mean abandoning judgement or waiting for perfect information. Organisations must determine when further investigation is warranted, when precautionary action is proportionate and when existing controls provide sufficient confidence.

This brings us back to another important principle: there are no solutions, only trade-offs. Investigating every concern exhaustively consumes resources and may create costs and harms, while ignoring warning signs because they are inconclusive can be equally dangerous. Decisions must consider the seriousness of potential consequences, credibility of information, costs of further investigation and opportunities to prevent harm.

The objective is not certainty, but better understanding and better decisions. When potential consequences are serious, absence of definitive evidence should not automatically justify doing nothing; further investigation, monitoring, safeguards or contingency arrangements may be appropriate. Good ORM is as much about learning and adaptation as control.

Conclusion: ORM must help organisations understand reality

ORM has become increasingly sophisticated, with detailed frameworks, taxonomies, assessment methodologies and powerful technology. AI promises to improve pattern recognition and insight, but none of these developments eliminates the fundamental challenge identified by Kay and King.

We must still understand what is going on, recognising that barriers to understanding are not merely technical or informational, but human. People may assume someone else will act, hesitate to challenge authority, conform to group expectations, overlook inconvenient evidence or place excessive confidence in reassuring management information. Sophisticated systems cannot compensate for an organisation unwilling to confront uncomfortable realities.

The purpose of ORM is not to maintain a register, produce a dashboard or demonstrate compliance with prescribed processes, but to help organisations understand the risks they face and make better decisions. That requires curiosity, critical thinking, professional scepticism, effective challenge, reliable evidence and humility about what we do not know.

Perhaps the most dangerous failure in ORM is not a control that fails to operate as intended, but an organisation confidently operating controls against a fundamentally mistaken understanding of the risks it faces — or one that knows something is wrong but fails to act. And that is why the most important question we can ask may also be the simplest: What's going on here?

References and further reading

• Kay, J. and King, M. (2020). Radical Uncertainty: Decision-Making Beyond the Numbers.
• Deutsch, D. (2011). The Beginning of Infinity.
• Milgram, S. (1963). “Behavioral Study of Obedience.” Journal of Abnormal and Social Psychology, 67(4), 371–378.
• Asch, S. E. (1956). “Studies of Independence and Conformity.” Psychological Monographs, 70(9).
• Browning, C. R. (1992). Ordinary Men.
• Janis, I. L. (1972). Victims of Groupthink.
• Darley, J. M. and Latané, B. (1968). “Bystander Intervention in Emergencies.” Journal of Personality and Social Psychology.
• Murray, D. (2019). The Madness of Crowds.
• Doyle, A. (2022). The New Puritans.
• Peterson, J. B. (2018). 12 Rules for Life.
• Institute of Internal Auditors (2020). The IIA's Three Lines Model.
• Hinchliffe, J. and Sheen, A. (2025). Integrated Operational Risk Management. Wiley.

Related JADEtc Academy Insights: There Are No Solutions, Only Trade-Offs · Selecting and Implementing a GRC System · Risk Glossary.