Skip to content


Harry Cassin
Publisher and Editor

Andy Spalding
Senior Editor

Jessica Tillipman
Senior Editor

Bill Steinman
Senior Editor

Richard L. Cassin
Editor at Large

Elizabeth K. Spahn
Editor Emeritus

Cody Worthington
Contributing Editor

Julie DiMauro
Contributing Editor

Thomas Fox
Contributing Editor

Marc Alain Bohn
Contributing Editor

Bill Waite
Contributing Editor

Shruti J. Shah
Contributing Editor

Russell A. Stamets
Contributing Editor

Richard Bistrong
Contributing Editor

Eric Carlson
Contributing Editor

What causes ‘risk creep’ and how do you prevent it?

For three enterprising professors from Georgetown University, the early days of Covid-19 — before the vaccines, when none of us knew what to do outside our homes — created a pristine environment to study how people perceive and handle risk. Part of what they found reveals the way corporate culture impacts compliance.

The profs (two from Georgetown’s b-school and one from the psych department) tracked 304 students who’d returned to Georgetown’s campus and nearby neighborhoods. The profs took a baseline survey of the returnees’ outside activities and seven weekly “pulse” surveys.

The surveys tracked how many times each student went out to participate in any of six categories of activities. The six categories were divided into two types: “discretionary activities” such as exercising, socializing in smaller groups, and attending larger events, and “non-discretionary activities” such as food shopping, pharmacy runs, and attending required events.

The three profs published their findings in a data-dense paper that’s over my head. But separately the two business profs wrote a recent Harvard Business Review article that applied some of the findings to management theory.

In the HBR article, they ask: Why does risk-taking spread through an organization and sometimes become excessive?

The surveys showed that the students’ non-discretionary activities didn’t change much from week to week. But discretionary activities steadily increased.

Why the increase?

People decide how much risk is acceptable in two ways. Either by watching what others do or by doing things themselves and learning from those experiences.

“Together,” the profs said, “our results suggest that norms for discretionary activities evolve over time based on both social learning cues and experiential reflection of risk and consequences.”

That evolution of norms is what the profs call “risk creep.”

Where culture is strong, watching what others do is a bigger part of learning behavioral norms but also leaves room for some experiential learning, so the two reinforce each other. But where there’s less chance for social learning — because the culture is weak or disrupted — people are forced to rely more on trial and error.

What happens to a person after their trial and error — whether or not they suffer harmful consequences — largely determines if their risk tolerance goes up or down. When the students tried new discretionary activities and didn’t catch Covid, they repeated the activities and added new ones.

“People may ‘test the waters,’ taking a modest amount of risk and then assess the result — an assessment that is guided by emotions more than by rational calculation,” according to the HBR article.

In other words, a weak culture — perhaps due to remote work? — results in less social learning and more trial and error. And when trial-and-error risk-takers get away with it, they’ll probably repeat the risk-taking behavior and even escalate it. Further, colleagues who see such risk-taking without negative consequences copy it, quickening the spread of risk-taking.

The fix?

Inculcate a strong culture to maximize positive social learning and minimize harmful trial and error. Recognize that weakness in the culture, from whatever cause, is likely to lead to more frequent and severe risk-taking.

“The more managers understand what guides employees’ behavior, the better they can predict it,” the business profs said. “Ultimately, this can help them anticipate downstream consequences in order to preemptively communicate with employees and calibrate risk more appropriately.”

In short, the feds are right; we can’t separate culture and compliance. A strong compliance culture teaches individuals acceptable behavior and restrains excessive risk-taking.


The three Georgetown professors — Jennifer Logg and Catherine Tinsley from the business school and Matthew Leitao from the psychology department — reduced part of their findings to a formula. Quant-minded readers might enjoy trying to work through it.

The original paper and source of the formula is here.

Share this post


Comments are closed for this article!