In Marching Off a Cliff in Silence: How a Lack of Psychological Safety Kills Major Transformations, my wonderful colleague Kimmy Arrowsmith explains why psychological safety is critical to effective change management: it's what lets problems surface early, before they derail a transformation. The people closest to the work often see problems long before they appear on an executive dashboard, but only if they feel safe enough to say something.
I'd take that argument one step further: speaking up is only the first half of the equation.
Let's paint a picture that's familiar to anyone who's spent a career in large-scale enterprise project delivery. A team is deep into a major transformation. Months of design work are behind them, the go-live date is locked in, and momentum is building. Then, in a routine review, someone flags a major gap: the system doesn't handle a specific scenario the way it needs to. It's not a minor fix. Addressing it means reworking foundational code, on a timeline that isn't moving.
It took psychological safety for this risk to be raised. But raising a risk only matters if something happens next. Is the risk evaluated, owned, and acted on? Or is it logged in a tracker, marked red, and forgotten? If we want people to keep raising concerns, they need to see that speaking up leads somewhere. That takes more than good intentions. It takes a risk management system that decides, owns, communicates, and follows through.
Build the Decision Path Before You Need It
Once a risk is identified, any decisions needed to mitigate it require a clear escalation path. That path, and a decision-making framework flexible enough to cover different types of decisions, should exist before the project begins, not get built in the middle of a crisis. That sounds obvious, but escalation paths are usually built for a handful of anticipated scenarios, and the first risk that falls outside them exposes the gap.
Teams need to know who can make what type of decisions, when to escalate, what information is needed, and how quickly a response is required. This matters most when mitigation crosses organizational boundaries and no single person controls the outcome.
If we're figuring out who can make a decision only after a risk emerges, we've already lost time. And people notice. When raising a concern leads to confusion or an extended search for a decision-maker, it reinforces the idea that speaking up creates friction without producing action.
Psychological safety encourages people to surface risks. A clear decision-making framework ensures the organization can respond when they do.
Keep Risks Alive: One Owner, Many Hands
Transformations are dynamic. Dependencies shift, assumptions change, and decisions in one area create consequences somewhere else. An initial risk assessment won't account for everything the team encounters on the journey.
Risk management can't be a one-time exercise, or the standing agenda item that gets dropped whenever the project gets busy. A risk that isn't regularly reconsidered might as well not have been identified. Regular risk reviews should ask:
- Is the risk still relevant?
- Has its likelihood or impact changed?
- Are warning signs beginning to appear?
- Do we need to act, or should we continue monitoring it?
- Who is accountable for driving the response?
- Who else is responsible for monitoring, communicating, or mitigating it?
Ownership needs to be assigned carefully. One person should be accountable for ensuring the response doesn't stall, but shouldn't manage it alone. Many people may watch indicators, assess impacts, communicate changes, or carry out mitigation. Every substantively affected function should be represented and understand its role.
The strongest programs don't stop at psychological safety. They turn their project teams into a unified risk network, building shared accountability so every team member feels responsible for monitoring conditions, raising concerns, and participating in solutions, backed by one clearly accountable owner and a defined escalation path. That creates broad participation without letting shared responsibility become no responsibility.
Make the Risk Visible
Risks rarely stay contained within one team. Once identified, they need to reach beyond the person who raised them and the person accountable for the response, so everyone substantively affected knows the risk exists and what role they may need to play in mitigating it.
That doesn't mean sending everyone the same message. A risk owner needs enough detail to act; someone three teams over may only need to know the risk exists and what to watch for. At minimum, people need the potential impact, the warning signs, who's accountable, and how to escalate, matched to what each audience needs to know. Curating that context is what puts the risk network to work: it gives people what they need to monitor the risk and contribute to the solution.
Close the Loop
Communication can't stop once a risk is raised. People need to hear what was decided, what action is underway, or why the organization chose to monitor or accept it. Not every concern requires mitigation. But silence is also a response, and usually not the one we intend.
Large transformations are emotional. They disrupt familiar processes, ask people to learn new ways of working, and require real sacrifices. An individual's difficult experience may not represent a material project risk, but it still deserves acknowledgment. And if the same concern appears across teams or functions, it may be an early sign of a broader adoption, capacity, or operational problem, the kind of signal your change management team should be hearing about as quickly as your risk owners do.
Leaders can acknowledge the impact, explain the tradeoffs, and be transparent about why action is or isn't being taken. Bringing people along preserves trust, even when the answer isn't the one they hoped for.
Speaking Up Has to Lead Somewhere
Psychological safety gets people to tell us the truth. Action decides whether that truth matters.
Successful transformations need both: an environment where people feel safe about surfacing risks, and a system that acts on them. That takes clear ownership, defined decision rights, a reliable escalation path, and visible follow-through.
That doesn't mean solving every concern or acting on every proposal. It means responding on purpose and making that response visible. That's where risk management and change management meet.
When people see risks turn into real decisions and real action, they keep raising them. That's what makes the organization effectively respond while there is still time to act.
Resource — Risk Checklist :
Regular risk reviews should ask these questions.
