Operational Risk Management: Weak Signals and Hard Decisions

Tony Ridley, MSc, CSyP, FSyI, SRMCP. Originally published 12 August 2026.

Catastrophic failures rarely start with one bad decision. They start when an organisation quietly redefines a recurring anomaly as normal, because the last mission survived it. This is the trap risk professionals call the normalisation of deviance, and it sits alongside a second, less discussed threat: risk by drift, where critical hazards and safety trade-offs are dispersed across email threads, undocumented conversations and slide decks, without ever landing on a leader's desk for an explicit, authorised decision.

This piece examines how the U.S. Navy and the U.S. Marine Corps built formal doctrine, Operational Risk Management, to force that decision into the open rather than let it happen by default. It looks at how a warfighting organisation separates risk to its people from risk to its objective, how it expects risk awareness to operate continuously, and what it asks a commander to do when the available controls are not enough. It also returns to the loss of the Space Shuttle Columbia as a case study of what happens when an organisation stops treating weak signals as information and starts treating them as noise.

For boards, executives, and risk, safety and security professionals, the question this raises is uncomfortable: is your organisation's risk process actually producing decisions, or is it producing paperwork that lets drift continue unchallenged?

This is a member article. The full piece is available to members. Become a member to read it in full.