We think we know risks, but we often deal with uncertainty… and sloppy management

“It is not enough to focus on probabilities. The knowledge on which these analyses are based can be more or less strong, even wrong.” – Terje Aven, 2022.

The idea of knowledge as a source of certainty is slowly fading. Scientific and technological advancements, once thought to offer predictable solutions, increasingly reveal their unpredictability. From genetic modification to handling crises like BSE (remember?) and COVID-19, it has become clear that no single framework—scientific, political, or otherwise—gives all the answers (B?schen et al, 2004).

As Terje Aven, professor of risk science, points out, focusing on probabilities overlooks the fact that the knowledge supporting those probabilities can be incomplete or flawed. As he writes, uncertainty must be embedded in decision-making:

“Good risk management places a strong emphasis on resilience. If we are to be able to meet dangerous situations that arise, we must have systems that react in the right way, including when these situations involve surprising events. Modern risk science is concerned with potential surprises and the unforeseen—the black swans—and how we should handle such events.” – Terje Aven, 2022.

From theory to organizational practice - Where we often fall short

In theory, organizations aim to balance efficiency and adaptability. They focus on minimizing risks while staying flexible enough to react to unforeseen changes. Rather than freezing decision-makers, uncertainty is supposed to inspire innovative strategies (B?schen et al, 2004). Traditional models of risk management, which rely heavily on scientific certainty, are not sufficient when the full scope of risks is unknown. Institutions need to be more flexible, open to uncertainty, and equipped to handle risks that cannot always be predicted. While risk science remains important, its role is shifting, as different scientific models compete for interpretation and reputation. As Aven suggests, knowledge should be viewed not as absolute but as evolving and limited. But, this is theory…

Drew Rae captured the reality of safety management at the EHS Congress in Berlin, where he spoke about how organizations rely on complex and automated risk assessments—often even after decisions have been made—to transform uncertainty into what they think is manageable risk. This trade-off reduces anxiety for the organization, Rae (2024) explained. While these risk assessments help reframe unknowns as calculable risks, reliance on them mask real uncertainty, and give decision-makers a comforting yet inaccurate sense that everything is under control. Workers don’t passively absorb knowledge about working safely by reading job safety assessments, but actively construct this knowledge in interaction with their task and context. In practice, this means that workers and lower-level managers often manage situations that have not been anticipated in risk management processes.

For example, in many organizations, job safety assessments (JSAs) are required by law. It’s not uncommon for organizations to lack the in-house expertise to perform them properly. Instead, they hire consultants – without knowing what to ask for and how to judge the resulting documents. The consultants visit the site once – often taking too little time to assess all different tasks and different lighting/weather conditions -, assess risks, and produce a report. These reports often fail to reflect the reality of daily operations, particularly when unknowing external contractors or temporary workers enter the scene. Management may be satisfied simply because the JSA box has been ticked, but the knowledge captured may be incomplete or irrelevant. In these cases, it’s not risk but uncertainty that organizations are dealing with.

So, while we often think we are managing risk, the reality is that uncertainty is a constant factor. Knowledge must always be balanced with an understanding of its limitations. The shift from a focus on certainty to resilience is at the core of modern risk management. Resilience comes not from eliminating uncertainty but from improving the work environment, the tools, the tasks, and the team that performs them. Employees often have to deal with uncertainty instead of calculated risks.

All this should require organizations to rethink their approach. Instead of ticking boxes, organizations can focus on building flexibility and resilience. By encouraging reflexive learning and engaging all levels of the workforce, systems can be equipped to face the unknown challenges of the future. Whether in science, politics, or industry, success lies not in the certainty of knowledge but in the ability to adapt to the unknown. We need systems that are not just knowledge-based but resilient, flexible, and adaptable. Reflexive learning, which encourages ongoing reflection and learning from both successes and failures, can help create governance structures capable of handling the unpredictable. Engaging employees in the process ensures that the people at the sharp end have a say in managing them.

?But then again, this is also woulda, coulda, shoulda thinking. We can comfort ourselves, to paraphrase the late sociologist Barry Turner (Turner, 1994), with the thought that a lot of people deal with sloppy management.

?

Sources:

Aven, T. (2022), Risk and Risk Science – Stories and Reflections, Oslo: Scandinavian University Press.?

B?schen, S., Schneider, M., Lerf, A. (eds.) (2004), Handeln trotz Nichtwissen – Vom Umgang mit Chaos und Risiko in Politik, Industrie und Wissenschaft, Frankfurt/Main: Campus Verlag.?

Rae, D. (2024), False Assurance, Keynote at EHS Congress, Berlin, May 23, 2024.

Turner, B.A. (1994), Causes of Disaster: Sloppy Management, in: British Journal of Management, Vol. 5, pp. 215-219.