Human Behaviour

Why Do People Do What They Do (Even When They Know the Risk)? Everyone has a rebel inside them!

Organisations can have good systems, detailed procedures, strong technology and carefully designed controls. Yet ultimately, people still have to use them.

Why do people ignore procedures they have been trained to follow? Why do good employees make mistakes? Why do experienced people overlook warning signs? Why do teams sometimes agree with a decision even when individual members have doubts? And why will someone find a shortcut around a control that was deliberately put there to protect them? I think I have the answer to why teams agree when individual members don't: herd behaviour. 

These are not simply questions about procedures. They are questions about human behaviour.

People are influenced by experience, habits, incentives, pressure, fatigue, confidence, fear, trust, culture and the people around them. We make assumptions. We take shortcuts. We can become overconfident. Sometimes we remain silent when something does not feel right. Sometimes a behaviour is repeated for so long without anything going wrong that it gradually becomes accepted as normal.

Understanding this human element is therefore an important part of understanding risk.

How Does Human Behaviour Relate to the Pillars of Risk Management?

Human behaviour has a strong connection to many of the established Pillars of Risk Management, particularly Enterprise Risk Management, Cyber Risk, Governance & Compliance, Operational Resilience, Business Continuity and Risk Assessment.

A company can introduce a control, but somebody has to follow it. A cyber-security system can be sophisticated, but an employee can still click on the wrong link or share information with the wrong person. A business continuity plan can be beautifully written, but people need to know what to do when an actual disruption occurs. We had a client who wanted to engage us to do business continuity but they did not want us to give the training for it to their team. Whatever their reasons, we are glad that we managed to convince them to do a co-training with us (even for a reduced fee) because no beautiful continuity plan is going to save the day. An mock emergency would, and we knew it! 

Governance can define responsibilities, but culture and incentives can influence whether people actually raise concerns.

This is why the human element can determine whether a control works in practice rather than merely on paper.

A risk register might tell us what could go wrong. Human behaviour can help us understand why it might happen despite the controls already being there.

Human Risk Is Not About Blaming People

When something goes wrong, it is very easy to conclude:

“Human error.”

But that can sometimes end the investigation too early.

Why did the person make the error? Was the procedure unclear? Was there insufficient training? Was the employee tired or overloaded? Was there pressure to complete the task quickly? Did the system make the correct action unnecessarily difficult? Had people been taking the same shortcut for years without consequences? Was someone afraid to challenge a senior colleague?

Sometimes the individual made a mistake. Sometimes the environment made that mistake more likely. Often, several factors came together.

Understanding human behaviour allows us to move beyond “Who made the mistake?” towards the more useful question: “What made this mistake possible or more likely, and what can we learn from it?”

Why Smart People Still Make Bad Decisions

Experience and intelligence do not make us immune to poor judgement.

Experts can become overconfident. Successful people can place too much weight on what worked previously. Teams can fall into groupthink. We naturally look for information that supports what we already believe. Incentives can encourage behaviours that produce good short-term results while quietly increasing longer-term risk.

Fear matters too.

If employees believe they will be punished for reporting mistakes, they may hide them. If challenging the boss carries a social or career cost, people may remain silent. If everyone else appears comfortable with a decision, an individual may begin questioning their own concerns.

Or sometimes maybe the answer is because the one who cares have given up. They no longer bother. 

This is why subjects such as cognitive bias, groupthink, psychological safety, incentives, ethics, culture and trust belong in a serious discussion about risk.

Procedures Don't Manage Risk by Themselves

A procedure is useful only if people can understand it, remember it and realistically follow it while doing their work.

This is especially important for smaller businesses. A procedure designed in an office may look perfectly sensible until we observe what happens at the actual point where the work is carried out. Staff may be busy, customers may be waiting, systems may be slow and several things may be happening simultaneously.

That does not automatically mean procedures should be relaxed. It means we should understand how work actually happens, not only how we intended it to happen.

When people repeatedly bypass the same control, the question should not simply be how to force compliance. We should also ask why they are bypassing it.

The answer may reveal a risk that the procedure itself did not show us.

Culture Is What Happens When Nobody Is Watching

Policies tell people what an organisation says it expects. Culture strongly influences what people actually do.

A risk-aware culture does not mean employees becoming frightened of taking risks. Nor does it mean referring every small decision upwards because nobody wants to be responsible.

It means people understand the risks relevant to their work, know when something matters, feel able to ask questions and recognise when an issue should be raised.

This is also why psychological safety matters to risk management. If people can say, “I think something is wrong,” “I made a mistake,” or “I don't agree with this assumption,” important information has a better chance of reaching the people who need to hear it.

What We Will Explore in Human Behaviour

Rather than treating people simply as another control or another source of error, we have divided Human Behaviour into eight areas.

Human Risk looks at how people's actions, decisions and behaviours can create, increase or reduce risk.

Human Error asks why mistakes happen and what organisations can learn beyond simply blaming the individual.

Risk Culture explores how everyday behaviours, leadership and expectations influence the way people approach risk.

Cognitive Bias introduces the mental shortcuts and assumptions that can influence judgement. We introduced blind spots in Decision Making; here we look more closely at the human behaviour behind them.

Groupthink examines why groups can reach poor decisions even when intelligent and experienced people are sitting around the table.

Psychological Safety considers whether people feel able to speak up, question assumptions, report mistakes and raise concerns.

Insider Risk looks at risks that can arise from people who already have legitimate access to an organisation's information, systems or resources.

Why People Ignore Procedures examines the gap between the process as it was designed and what people actually do in everyday working conditions.

Together, these areas help us understand something that cannot be solved by another form, policy or piece of technology alone: the people inside the system.

People Can Also Be Our Strongest Control

Human behaviour should not be discussed only as a source of risk.

People notice unusual things. Experienced employees recognise patterns that systems may miss. Someone can question an assumption, stop an unsafe action, report a near miss, challenge the group or recognise that circumstances have changed.

The same human judgement that can introduce uncertainty can also provide an organisation with an extraordinary early-warning system.

The objective, therefore, is not to remove humans from risk management. It is to create conditions in which people are more likely to notice, think, question, communicate and act well.

That is why Human Behaviour deserves its own major section of Applied Risk Management.

Questions We Will Be Exploring

Throughout Human Behaviour, we will explore questions including:

• Why Do People Ignore Procedures?

• Why Do Good Employees Make Mistakes?

• What Is Human Risk?

• How Do You Reduce Human Error?

• What Is Risk Culture?

• How Do You Build a Risk-Aware Team?

• Why Do People Take Shortcuts at Work?

• Why Do People Ignore Warning Signs?

• What Is Cognitive Bias?

• What Is Confirmation Bias?

• What Is Optimism Bias?

• What Is Normalisation of Deviance?

• What Is Groupthink?

• Why Are People Afraid to Speak Up?

• What Is Psychological Safety?

• Why Do Employees Bypass Controls?

• Why Does Training Sometimes Fail?

• Why Do People Resist Change?

• How Does Incentive Create Risk?

• What Is Insider Risk?

• Why Do Smart People Make Bad Decisions?

• How Does Overconfidence Create Risk?

• How Does Fatigue Affect Decisions?

Risk Management gives us structures, systems and controls. Human behaviour helps us understand what happens when real people meet them.