Risk Escalation: 8 Distortions That Hide Critical Exposure

A risk register can contain a serious exposure without ever forcing a serious decision. The failure usually appears earlier, when evidence is softened, ownership is blurred, or escalation is treated as an administrative step instead of a change in authority.

Risk escalation is effective only when new evidence changes who must decide, what resources are available, and which operating limit applies. The eight distortions below explain why critical exposure often remains below the decision threshold, even when the organization has a documented process.

1. Treating escalation as a report instead of a decision

Many organizations define escalation as sending an email, updating a dashboard, or adding a red status to a risk register. Those actions may transmit information, although they do not prove that anyone with authority has accepted the exposure and chosen a response.

A real escalation changes the decision context. A plant manager may need to stop a task, approve temporary engineering support, change the production sequence, or accept a residual risk with a recorded rationale. If none of those decisions is required, the process has probably created visibility without control.

Andreza Araújo makes this distinction practical in Make The Difference: Be a Leader in Health & Safety. Leadership becomes visible when a person with authority acts on inconvenient evidence, not when the evidence is displayed with better formatting.

2. Waiting for certainty before raising the exposure

Teams often delay escalation because the evidence is incomplete. The supervisor wants a confirmed failure mode, the engineer wants a finished inspection, and the manager wants a cost estimate before the concern reaches the next level.

That sequence reverses the purpose of escalation. Escalation exists because the current owner does not have enough information, authority, or capacity to resolve the uncertainty safely. A credible concern should therefore move upward with its uncertainty stated clearly, including what is known, what is assumed, and what evidence would change the decision.

James Reason’s work on active and latent failures supports this discipline because organizational conditions can remain hidden when reviews accept the first plausible explanation. A leader who waits for perfect evidence may preserve the condition that prevents better evidence from appearing.

3. Letting the risk owner define the threshold alone

The person closest to the hazard often has the best operational knowledge, but that person should not always decide whether the risk is material enough to escalate. Local familiarity can normalize repeated exposure, especially when the team has learned to recover from weak controls without recording the recovery work.

Thresholds need a second lens. The review should consider potential severity, barrier dependence, exposure frequency, change in operating conditions, and whether the same weakness exists elsewhere. A risk that feels manageable in one shift can become unacceptable when maintenance, staffing, weather, or production pressure changes.

Andreza Araújo has worked across 30+ countries and 250+ companies, where the same lesson appears in different operating languages. Local ownership is essential, yet local ownership without an independent challenge can turn experience into normalization.

4. Confusing a lower score with a lower risk

Risk matrices create a numerical impression that can hide a qualitative change. When a likelihood score falls from four to three, leaders may conclude that exposure has improved even though the critical barrier remains unverified and the possible consequence has not changed.

The score should be treated as a decision aid, not as evidence that the hazard is controlled. Ask what changed in the work, which barrier became more reliable, and how that improvement was verified. If the answer is only that the team has operated without an event, the score has captured luck or limited exposure rather than control performance.

In Safety Culture: From Theory to Practice, Andreza Araújo argues that formal systems can look mature while operating culture tells a different story. Risk escalation fails when the matrix rewards a smaller number before the work has become safer.

5. Escalating the event while hiding the trend

A single defect may receive urgent attention while the pattern around it remains invisible. Teams escalate the failed valve, missed inspection, or delayed permit, yet they do not connect similar signals from other assets, contractors, shifts, or sites.

Trend blindness is especially dangerous when each local record appears too small to justify executive attention. The escalation question should therefore include recurrence, transferability, and concentration. Could the same weak assumption exist in comparable work? Has the organization seen the same barrier fail under a different name?

A near miss can be a local event, but repeated near misses reveal a management condition. The right response may be a cross-site review rather than another local action, because the cost of keeping the issue inside one team is the loss of pattern recognition.

6. Giving escalation to a role without giving it access

Policies often assign escalation to supervisors, safety representatives, or risk owners without giving them direct access to the people who control budget, scheduling, engineering changes, or contractor decisions. The role exists on paper, while the route to action remains indirect.

This arrangement creates a predictable delay. The person who sees the exposure has to translate it through several layers, each of which may remove urgency, alter the language, or wait for a routine meeting. By the time the concern reaches the decision-maker, the original evidence has lost its operational detail.

Visible felt leadership requires more than inviting concerns. Leaders must define when a supervisor can pause work, who must answer an escalation, how quickly the response is due, and what happens when the decision is contested. A channel is credible only when the person using it can see where it leads.

7. Closing the escalation with a promise instead of verification

Many escalations end when a manager assigns an action and records a target date. The risk then moves from the active queue to the closed queue, although the barrier may not have changed in the field.

Closure should require proof that the decision altered the exposure. The evidence may be a redesigned guard, a tested isolation, a revised staffing plan, a completed competence check, or a field observation that confirms the new control under real operating pressure. The proof must match the risk, because a signed procedure cannot verify a physical barrier.

Andreza Araújo’s experience in more than 250 cultural transformation projects reinforces this point. A polished record can show that the organization responded, while only field evidence shows whether the response earned trust.

8. Escalating bad news without protecting candor

An escalation system teaches people what the organization really values through the response to inconvenient information. If the first reaction is a search for fault, the next concern will arrive later, with fewer details, or not at all.

Psychological safety does not mean accepting every interpretation or removing accountability. It means that a person can report uncertainty, challenge a control, or question a decision without interpersonal punishment for raising the issue. Amy Edmondson’s research is useful here because speaking up is a team condition, not a personality test.

The leader still needs to test evidence, set boundaries, and distinguish an honest mistake from a conscious disregard of a known control. However, that evaluation should happen after the concern is understood. A silent system can produce clean dashboards while critical risk accumulates outside the record.

What should leaders change in the next risk review?

Start by asking whether each open escalation requires a decision that only the current level of authority can make. If the answer is no, clarify the owner. If the answer is yes, name the decision-maker, the deadline, the temporary protection, and the evidence required for closure.

The review should also separate uncertainty from inaction. A risk with incomplete evidence may still justify a temporary control, a pause, or a higher-level review. The absence of certainty is not proof that the exposure is minor.

• Record the decision required, not only the hazard description.
• State what is known, assumed, and still unverified.
• Test whether the threshold reflects barrier performance rather than event history.
• Search comparable work for the same weak condition.
• Close only after field evidence shows that exposure changed.

During her PepsiCo South America tenure, where the accident ratio fell 50% in six months, Andreza Araújo demonstrated why executive decisions and field verification must move together. The result is not a reason to copy a program without context. It is a reminder that escalation has value only when it changes the work that people face.

FAQ

What is risk escalation? Risk escalation is the controlled movement of a concern to a higher level of authority when the current owner cannot safely resolve the exposure with available resources, information, or decision rights.

When should a safety risk be escalated? Escalate when potential severity, barrier weakness, uncertainty, recurrence, or changing operating conditions exceeds the authority or capacity of the current owner. The trigger should not depend only on a completed investigation.

Why can a risk matrix hide critical exposure? A matrix can hide exposure when a lower score reflects fewer recorded events rather than stronger controls. Leaders should ask what changed in the work and how the barrier was verified.

Who should own a risk escalation? The owner should be the person with authority to change the relevant condition, such as design, staffing, schedule, budget, contractor requirements, or operating limits. The person who reports the concern may not control those decisions.

How do leaders know that an escalation is closed? Closure requires evidence that the decision changed exposure in the field. The evidence should match the barrier, be reviewed by a competent person, and include a check for comparable work where the same weakness may exist.

Risk escalation is not a communication ladder. It is a decision mechanism that protects people when the current level of authority cannot make the exposure acceptable. The strongest systems move uncertainty upward early, preserve candor, and require field evidence before a risk is allowed to leave the active decision queue.