Risk management training development lives in the stretch between somebody seeing a problem and saying it where it counts. Most programs aim somewhere else. They teach assessment models, scoring matrices and the vocabulary of an established framework to people who were already good at spotting the wobble, and they leave untouched the two things that actually decide the outcome: whether a person will carry a concern to somebody senior who owns the thing being questioned, and whether anyone in your organisation has ever said out loud how much of that kind of exposure the company is willing to hold.
Key takeaways
- The risks that hurt an organisation are usually the ones somebody already saw, sitting in an email with a question mark in the subject line or on a slide labelled watch items.
- Staying quiet reads as being a team player, respecting the owner’s call and declining to cry wolf, which are the behaviours a performance review rewards.
- Raising a concern to a senior audience gets treated as a temperament, and it behaves like a skill: it shows up in people who have already said the awkward version somewhere it cost nothing.
- The trainable call is a placement one (carried, watched, or raised), and a framework will not answer it, because a framework presumes the risk has already been named out loud.
- Training rehearses the raising. The line it gets raised against is a governance decision your board owns, and ThinkingKap does not produce it.
Where does a preventable incident actually begin?
The review happens in a conference room some weeks later, and it arrives at the same discovery almost every time. The risk was known.
It was in an email with a question mark in the subject line. It was a row on a slide labelled watch items, third from the bottom, carried forward unchanged from the previous month. It was a project engineer who noticed a vendor’s test results drifting for several weeks and mentioned it, once, carefully, to the one person he was sure would not take it wrong.
Nobody in that review failed to see the problem. The problem had a name, an owner and a rating.
The engineer was hiding nothing. He watched what happened to the last person who put a red concern on a senior sponsor’s schedule, and he made the calculation his environment taught him to make. Identification was never his gap. The framework course he took in the spring trained the part of the job he was already doing well.
The people who bought that course were not careless either. A framework is what the category sells, an auditor asks whether the organisation has trained its people on one, and the answer needs to be yes. It covers a real obligation. It simply covers the stage after the one where this went wrong.
Why does saying nothing look like good judgment from the inside?
Every workplace virtue is available to the person who decides not to raise something. Not escalating reads as trusting your colleague, respecting the chain, keeping the meeting moving, staying constructive, declining to cry wolf over something that will probably resolve itself. The person who stays quiet is not failing to exercise judgment. They are exercising the exact judgment their last performance review praised.
That is what makes this a camouflage problem. Most programs file it under reporting failure, which sends the fix to the wrong department. The wrong call arrives dressed as professionalism, it looks identical to the right call from the inside, and nobody has ever taught anyone to tell the two apart at working speed.
The costs of raising something are specific and immediate, and the quiet ones can name them without hesitating. It costs the sponsor’s agenda. It costs a reputation as the person who is difficult about other people’s projects.
It also costs being wrong out loud, in a culture that remembers wrong more clearly than early. Set against all that, the cost of silence is diffuse, deferred and shared by everyone.
And the window in which any of this stays cheap does not announce itself. A drifting vendor result is a conversation in March and a program in September, and nothing about the March version feels like the last easy version of it.
Where does your framework stop and the judgment start?
Your framework is doing what it was designed to do. ISO 31000, an enterprise risk management (ERM) structure, whichever taxonomy your risk function runs, all of them give you a common vocabulary, a rating scheme, named owners and a reporting line up to the committee. That work is real and this page is not arguing with it.
What every one of them assumes is that a risk has already become a stated thing. They begin where somebody has said the words out loud and written them down, and the stage before that (where naming it still costs the namer something) sits outside the process entirely.
Layering makes it harder. An enterprise register goes to the board a few times a year, operational risks sit with a function and get carried as the price of doing the work, and project risks live and die inside one delivery, in front of one sponsor. A project engineer looking at a drifting test result already knows the thing is a risk. What he cannot answer is whether it is his, or his function’s, or the board’s, and no framework document tells him.
Underneath that sits the question the framework cannot answer for him either. A register records that an exposure exists; an appetite says how much of it this company will carry, in which parts of the business, and who is allowed to accept it on everyone’s behalf. Where that has been decided and said plainly, a person at the project layer has a line to measure against. Where it has not, every escalation call is a private guess about what leadership would want.
How do we build risk management training where your flags currently stall?
We start where your own flags currently stall, and your people already know where that is. Working with your risk function, your project leads and the functions that carry the exposure day to day, we find the junctures your organisation actually has: the status meeting where the risk item runs last and shortest, the report whose cautious phrasing buried its own warning, the vendor everybody knows is behind, the project that feels too senior to question.
ThinkingKap brings no expertise in your risks and does not pretend to. The exposures, the thresholds, the history and the governance structure come from your people; what we bring is the practice built on top of it, with something at stake in getting it wrong. Work like this usually starts in a working session where that gets surfaced with the people who hold the risks.
The practice is built around the placement call. A learner meets a live situation and has to do three things: say whether this is carried, watched or raised, name the fact the answer rests on, and say who they would take it to. Scenarios run against your appetite statement where you have one, and against the answers your leaders give us where you do not. Some of the situations are genuinely nothing, on purpose, because a program that only ever rewards escalation trains a different bad habit.
Then the raising itself gets rehearsed, because it is the part nobody practises. Concern-raising against realistic resistance: the sponsor who owns the plan being questioned, the owner who has already defended this once, the numbers that are technically fine and directionally wrong, the first polite dismissal that ends most attempts. What people practise is putting an exposure on the table without putting a person on trial, and then staying in the conversation after the first no.
A separate track for the people who receive flags, built as governance content. Sponsors, function heads and risk committee members practise taking a challenge to their own project, responding to a concern that turns out to be nothing so that the next one still arrives, and making an acceptance decision explicit so it stops happening by default. This is where leader modelling stops being a poster and becomes a rehearsed behaviour with a scenario attached.
Where the call happens away from a desk, the content can travel as a job aid. A one page escalation reference organised by the question a person is standing there asking, built from your own governance structure and your risk function’s logic, written to sit in your intranet or in the governance system your risk function already runs. We design the content that goes in it.
What makes risk management training effective when two situations present identically?
This subject has an unusually clean discrimination test underneath it, and building to that test is what separates a program that changes behaviour from one that changes vocabulary.
Two situations can present identically. A dependency slips a week on a project with float, and a dependency slips a week on the project that feeds a date somebody outside the company is holding you to. Same email, same tone, same reasonable owner saying they have it in hand.
Nothing visible in either situation tells a person which is which, because the fact that governs sits upstream, in what this organisation has already agreed it will absorb.
So the practice puts the placement question first and asks for the reasoning underneath it, out loud, before the situation resolves. A learner gives the call, names the governing fact, and drafts the first sentence they would actually say. Then the situation moves, in ways your own history says it moves, and the same person has to say whether the call changes and why.
What we watch happens inside the practice while it is running. Whether a person reaches for the governing question while the decision is still open. Whether the answer follows when the exposure changes shape. Whether the sentence they would say is one a sponsor could hear without getting defensive, or one that guarantees the conversation ends badly.
None of that is a claim about what your incident numbers will do next year. It is what the training is built to target, and it is a sharper thing to know about your people than whether they finished a module.
Frequently asked questions
Does this replace our ISO 31000 or ERM framework?
No, and you should be wary of anyone offering to. Your framework names the process, the ratings and the reporting lines. This training builds the judgment the framework assumes has already happened: recognising an exposure early, placing it correctly, and raising it in a way that survives contact with the person who owns it. We build it on top of your structure, using your vocabulary.
How is this different from your ethics training?
Ethics training is for the calls where two defensible things pull against each other and the wrong answer feels like loyalty or diligence. Risk training starts from agreement. Everybody in the meeting accepts that exposure matters. The open question is whether this particular instance is worth somebody’s credibility today, and where the threshold sits that would settle it.
Our risk register is in good shape. Why would we need this?
A register is a list of things somebody has agreed to watch, which is one of three available answers. It tells you nothing about the exposures that never made it onto a list because raising them was socially expensive, and those are the ones incident reviews keep finding.
Who should be in this program?
The people who see risks first and the people who receive them. Project leads, analysts, engineers and function owners on one side, sponsors and risk committee members on the other. Running only the first half is the common mistake, because it teaches people to speak into an organisation that has not practised listening.
Send us the last concern somebody raised that turned out to be nothing, and tell us what happened to them
Before you spend anything here, there is a decision that sits above the training, and it is worth checking whether your organisation has actually made it.
If nobody senior has said out loud how much of which exposure this company will carry, in which parts of the business, and who is allowed to accept it on everybody’s behalf, then no training tells anyone where the line is. We can rehearse the raising all year, and your people will still be guessing at a threshold, because there is not one to know.
And we do not produce that decision. It is not a statement we draft, a policy we write, or an artifact of any kind that we hand you at the end of a project. It belongs to your board and your executive team, it is theirs whether or not they have made it, and any vendor offering to supply it is selling you something that will not hold the first time it is tested.
Where the line does exist, our part gets smaller and more useful. Build the practice for recognising which side of it a live situation sits on, and for saying so to the person least happy to hear it. That is a real training problem, it is a buildable one, and it is ours.
Saying this costs us work, and we would rather say it in the first conversation than three months into a build. We would rather tell an organisation to hold off and get its own leadership to decide what the company will carry first. If that is where you are, the training is still worth having later, and it is worth more once there is a line to practise against.