Risk assessments are supposed to help us understand uncertainty before making consequential decisions.

Yet the people conducting them do not arrive without expectations.

The difficulty begins when the importance of an outcome influences how we interpret the evidence.

A control that has worked before may receive considerable confidence, even when the circumstances are different. An assumption that supports continued operation may seem reasonable because challenging it would require additional work. A possible failure mechanism may be considered remote because nobody recalls encountering it.

Each judgment can sound defensible. Taken together, they may produce an assessment that is less independent than anyone intended.

Bias does not always result from carelessness or deliberate manipulation. It can emerge from the ordinary ways experienced professionals interpret information, especially when they share the same objectives and pressures.

A team can sincerely believe it is examining the evidence objectively while giving greater weight to information that supports its preferred direction.

Defined categories, scoring methods, and approval requirements make the discussion orderly. Differences are resolved, and the final assessment presents a coherent rationale.

But coherence is not necessarily completeness.

We may have developed a convincing explanation for proceeding without giving equal attention to what would make proceeding inappropriate.

Leaders influence risk decisions long before they approve them.

Sometimes the influence is direct. A senior executive challenges a recommendation, asks for additional justification, or questions whether the proposed response is proportionate.

Often it is less visible.

People remember how previous decisions unfolded. They remember the concern that delayed a launch and the reaction it received. They remember the investigation that continued because a technical specialist would not accept an assumption. They also remember occasions when an aggressive timeline was praised and difficult questions were left for later.

Those experiences accumulate.

Eventually, people become skilled at anticipating what will be considered reasonable.

This does not mean they abandon professional judgment. Many continue to raise concerns, challenge assumptions, and defend technical positions. But the environment influences how much resistance an uncomfortable conclusion encounters.

When a risk assessment supports the preferred course, the organization may accept the result with little discussion.

Now imagine the same team concludes that the evidence is insufficient to proceed.

Would that conclusion receive the same confidence? Would the team be asked to reconsider its assumptions, obtain another opinion, or find a more practical solution?

There may be legitimate reasons to challenge either conclusion. Technical judgment should withstand scrutiny.

What deserves attention is whether that scrutiny is applied with the same rigor regardless of which direction the evidence points.

Leadership cannot eliminate organizational preferences. Production commitments, financial consequences, and patient access are legitimate considerations.

Its responsibility is to prevent those considerations from changing what the technical evidence supports.

That requires more than telling people they are empowered to speak up. It requires demonstrating, particularly when the stakes are high, that an unfavorable conclusion will receive a fair hearing.

There is something comforting about a completed risk assessment.

The structure is useful. Without it, discussions can become inconsistent, overly subjective, or dependent on whoever speaks most confidently.

But a number can give an impression of precision that the available knowledge does not justify.

A control can receive credit because it exists, although its effectiveness has not been demonstrated under the conditions being evaluated. Previous success can quietly become evidence that failure is unlikely.

Sometimes considerable effort is spent debating whether a score should be “three” or “four” while the underlying assumptions receive far less attention.

During a discussion on risk-management maturity at the 2026 ISPE Annual Meeting & Expo, one participant compared the misuse of risk assessment to a GPS. The organization selects its destination, and the assessment is used to find a route that gets it there.

The analogy stayed with me. A process intended to inform a decision can gradually become a way to justify one already preferred.Risk assessment has a different responsibility. It must help us understand what could go wrong, what the evidence supports, and what remains uncertain.

ICH Q9(R1) recognizes the importance of addressing subjectivity and uncertainty in quality risk management.

Applying a structured method does not automatically produce sound judgment.

A completed assessment tells us that a process took place. Whether that process improved our understanding is another matter.

There are times when accepting risk is the responsible decision.

Waiting for certainty can carry consequences of its own.

Risk management helps us make decisions with an understanding of potential harm, available evidence, and the limitations of our knowledge.

Sometimes that understanding supports the course we intended to take. Sometimes it reveals the need for stronger controls, additional information, or a different approach. Sometimes it tells us that we should not proceed.

A risk assessment must be capable of changing the direction of a decision, and the organization must be willing to let it.

Capability depends on the quality of the assessment, the expertise involved, and the willingness to challenge assumptions. Organizational willingness is harder to establish. It becomes visible when the evidence points toward an outcome leadership did not expect or want. Willingness is more difficult to establish.

Leaders can begin by examining how the assessment is framed. The question brought to the team often determines which possibilities receive attention. Before asking what would allow operations to continue, it is worth establishing what is known about the potential harm and what remains uncertain.

As the evaluation progresses, assumptions supporting the preferred course deserve the same scrutiny as those challenging it. Proposed controls need evidence of effectiveness. Previous success should be considered in the context of current conditions.

The more difficult responsibility comes when the findings threaten a commitment or challenge an earlier judgment.

A recommendation to obtain additional evidence, strengthen controls, or change direction deserves serious consideration, even when the consequences are inconvenient.

A sound decision may still involve accepting residual risk. It may also require accepting the operational and financial consequences of refusing it.

What matters is that the technical understanding has not been adjusted to make the preferred choice easier.

Think about the last significant risk assessment in your organization.

Before it began, was there already a direction people hoped it would support?

That is not unusual. Most consequential decisions begin with preferences and expectations. The more revealing question is what happened when the evidence was examined.

When was the last time a risk assessment changed a decision your organization wanted to make?

Risk assessments will never be entirely free of human judgment. Nor should we expect them to be. Experience, scientific understanding, and professional judgment are essential when the evidence is incomplete.

The challenge is recognizing when those judgments are being influenced by the outcome we hope to achieve.

Organizations can invest in sophisticated risk methods, review committees, and approval processes. None of these can make an organization willing to hear an answer it would rather avoid.

That willingness becomes visible in the decisions we change, the assumptions we revisit, and the commitments we reconsider when the evidence requires it.

A risk assessment has served its purpose when it helps us understand the risk well enough to make a responsible decision.

Even when that decision is different from the one we wanted.

Leading through clarity,

Jose

If you have paid time left on an individual Granola plan, we'll match it with a Wispr Flow subscription that includes Notetaker and dictation, and add bonus time, up to 12 months total. Sign in or create a Wispr account and submit proof of your plan to check eligibility.

Try Notetaker Free