Crossing a crevasse in the Himalayas during the assault on Mt Everest by Sir Edmund Hillary and Tenzing Norgay in 1953. Photographer Alfred Gregory. (Source: Alfred Gregory: Photographs from Everest to Africa. Penguin Books, 2008, ISBN 978-1-920-98961-3)
Ideas for Leaders #160

Managing Risks: Culture Matters More Than Rules

This is one of our free-to-access content pieces. To gain access to all Ideas for Leaders content please Log In Here or if you are not already a Subscriber then Subscribe Here.

Key Concept

Micro-regulation is not the most effective way to manage risks and improve services. The best guarantee of high standards is ethics-based risk control, underpinned by rules-based codes.

Formal risk management systems can encourage a box-ticking mentality, threaten internal and external relationships, and — in the literal sense of the word — demoralize people. The dangers are likely to be greatest where stakeholders have a strong emotional investment in self-regulation and ethics-based risk management.

Idea Summary

Formal risk management systems now provide the dominant logic for governing an uncertain world and are prevalent in public services as well as private firms. What happens when these systems interact with indigenous risk practices and ethics-based risk controls?

Existing literature suggests that hybridization is likely — that rules-based and ethics-orientated models complement each other and that tensions between them can be managed. A longitudinal case study challenges this view.

The study was based on four years’ fieldwork at a democratic therapeutic community (DTC) — a residential unit for people with serious personality disorders. (Such ‘extreme’ settings can be useful for studying dynamics that are more difficult to observe in other environments.)

The DTC model, introduced by the British National Health Service in the early 2000s, uses an ethics-based approach to risk management. Residents are expected to take responsibility for their own and others’ treatment as ‘co-therapists’ and to participate in community decision-making and community tasks. Staff members, who include psychiatrists, nurses, social workers and administrative staff, are all expected to participate in the day-to-day running of the community. Clinical risk is managed interpersonally.

Residents live in the unit for 12 months and agree to abstain from alcohol and drugs while there.

The unit studied had been described as the ‘jewel in the crown’ by its local NHS Trust and held to exemplify the Trust’s stated principles of service user engagement. It adapted outside influences such as the NHS Care Programme Approach for the mentally ill to strengthen in-house practices.

During the fieldwork period, however, its future was threatened by a critical incident involving two former residents, Mark and John. The two men had started a relationship while at the DTC and, unknown to staff, began living together after leaving the unit. Shortly afterwards, Mark stabbed John to death during a drunken row.

Officially, the homicide was not the DTC’s responsibility. Faced with strong external pressure, however, the Trust’s board imposed its standard risk management procedures, enforcing strict controls through weekly risk reports from the DTC and official inspections. This eroded the culture of the DTC — with disastrous results. The NHS commissioners and the local Trust eventually decided to close the unit — and to discharge all residents.

What contributed to the dramatic decline of the unit? There were four main stages:

  • Imposed formal risk assessment. This shifted the emphasis away from clinical first-order risks (e.g. suicide and self harm) to ‘calculable’ risks such as the level of physical security at the unit. (The therapeutic work that could reduce first-order risks was disrupted as managers began to consider the risks the DTC posed to the Trust’s reputation.)
  • External steering of clinical risk management. Trust managers and commissioners outlawed relationships between residents and began to dictate clinical practices. This steering was experienced by the DTC as interference in its democratic decision-making, leading to division and conflict.
  • Some adoption of rules-based regulation but growing contradictions. Anxious about their professional careers and livelihoods, some staff chose to relax DTC rules, covertly conveying confidential clinical information to external agencies. As a result, internal relationships began to break down.
  • Politicization of community space. Divided about how best to manage the increasing tensions and viewed with increasing suspicion by residents, staff began to lose their moral authority.

Anarchy ensued. Instead of upholding the DTC’s rules, residents protected each other from staff scrutiny as they devised drug deals and established a new norm of sexual relations between residents. A once self-regulating therapeutic community operating within a broader rules-based framework (the Care Programme Approach) had become a dysfunctional unit riven by conflict. 

Business Application

  • Don’t underestimate the importance of culture in the management of risk — it’s the greatest determinant of people’s behaviour.
  • Investigate critical incidents carefully: do not confuse cause and association; do not over-react or be too quick to impose new regulation.
  • Be aware that the two models of risk-management can resist hybridisation — and that the integration of formal and ethics-based systems needs to be carefully managed to avoid contradiction and conflict.
  • Broaden the risk management lens to the emotional impact of policies — what are the risks that the current system will implode if new rules are externally imposed and how can these risks be effectively managed?
Contact Us




Idea conceived

  • January 2013

Idea posted

  • June 2013

DOI number



Real Time Analytics