Risk leader's / Compliance leader's view

Because channels remove friction, not fear. People calculate: what happened to the last person who raised something with their name attached? If the honest answer is “nothing good” — or “nobody remembers anyone doing it” — reports arrive anonymous, late or external-first. Speak-up systems fail behaviourally, not technically, and the missing variable is courage: the willingness to act while it still costs something.

Practically, risk culture is the answer to one question: what happens in this organisation between someone noticing a problem and someone with authority acting on it? Strong risk culture shortens that path; weak risk culture lengthens it until the problem surfaces externally. The Four Steps of Courage — Step Up, Step In, Step Forward, Step Together — describe exactly the behaviours that path depends on.

With a behavioural baseline, not attestation statistics. The Organisational Courage Audit produces a systemic diagnostic across the Four Steps, benchmarked against the Courage Index, triangulated with speak-up channel analytics (volume, anonymity rate, time-to-report, retaliation signals). Baseline, documented intervention, re-measurement: that is an evidence pack supervision recognises.

Because training answers “what should be raised?” and the moment answers “what will it cost me?”. Every major enforcement case features fully trained professionals who saw the issue and stayed silent — the control that failed was not knowledge but courage. Escalation is a courage moment: fear plus responsibility. Building that capacity requires practice under realistic pressure, not another module.

Psychological safety is the condition leaders create; courage is the behaviour individuals need when the condition is imperfect — which, in real escalation moments, it always is. Control environments cannot wait for perfect safety: the concern must move even when raising it is uncomfortable. That is why risk culture work needs both tracks: leaders lowering the cost of speaking, and everyone building the capacity to speak anyway.

Consistently. Risk and compliance professionals soften findings to preserve access, hedge reports for political survivability, and time bad news for palatability — for exactly the same fear-based reasons as the first line. A credible risk-culture programme works both lines: the business learns to escalate to the function, and the function learns to deliver the unsoftened finding upward.

A one-day, in-person workshop (8–24 participants) run as a circuit through the Four Steps of Courage, anchored to live material: the finding that keeps getting softened, the business unit nobody challenges, the concern currently sitting unescalated. Run for the risk/compliance leadership, for priority business units, or jointly — the joint format builds the escalation norm across both lines at once.

Your systems are the pipework; courage determines what enters it, how early, and whether names are attached. The intervention does not replace channels — it moves reporting upstream: from anonymous to attributed, from late to early, from external to internal. Channel analytics before and after are one of the cleanest measurement pairs in the whole field.

Conduct risk materialises in the gap between first internal knowledge and first effective action — and that gap is behavioural. Shortening it means more concerns surfacing earlier with better information. The measurable early indicators: rising attributed report share, falling time-to-report, more concerns raised directly to line management. Each is a leading indicator of fewer late-stage conduct events.

With the data you already hold: anonymity rate, time-to-report, and the internal-versus-external surfacing history of your last five significant issues. That is your courage-gap baseline. Then: risk-culture scoped audit, one Catalyst day with your own leadership team (the second line goes first), and a rollout plan through the priority business units.