Fixing capability leakage in risk teams

Where capability starts to leak

If you look across most risk functions today, there’s no obvious shortage of knowledge. Teams understand the frameworks they’re working within, they’re familiar with the models and methodologies that underpin decision-making, and they operate in environments that are, on paper, well governed and clearly structured. From the outside, it would be reasonable to assume that capability is strong and that decisions should follow accordingly.

And yet, when you look more closely at how risk is managed in practice, a different picture starts to emerge. Decisions take longer than expected, similar situations are handled in different ways across teams, and in moments where the answer isn’t immediately clear, confidence can drop off more quickly than it should. It’s not that people don’t know what to do, it’s that the capability doesn’t always show up in the moment it’s needed.

That’s what sits behind capability leakage.

It’s not about knowledge disappearing over time or expertise being lost through turnover, although those things can happen. It’s about something more subtle and more pervasive, which is the gap between what people know and how they behave when they’re required to apply that knowledge in real situations.

This helps explain why risk teams are still sometimes associated with friction rather than forward movement, read more about this in this piece: Why risk teams are still seen as growth blockers.

How capability leakage shows up in practice

In most cases, capability leakage doesn’t appear as a clear or dramatic failure. It tends to show up in smaller, more familiar ways that are easy to overlook in isolation but become more significant over time.

You might see it when early warning signs are identified but not escalated, either because they don’t feel material enough or because there’s uncertainty about what action should follow. You see it when models are relied on too heavily, with outputs taken at face value without enough challenge around assumptions, data quality, or relevance to current conditions. And you also see it in the opposite direction, where models or frameworks are bypassed altogether because the situation feels different or because there’s pressure to move quickly.

It also shows up in how policies are interpreted. In theory, frameworks are designed to provide clarity and consistency, but in practice, they’re often read in slightly different ways depending on experience, confidence, and context. Over time, those differences lead to inconsistent decisions, even when everyone’s working from the same underlying structure.

None of this reflects a lack of training. It reflects a breakdown in how that training is applied.

Why this is an L&D problem

For learning and development leaders, this is where the conversation needs to shift.

Most risk training is designed to build a strong foundation of knowledge, which is entirely appropriate. The frameworks, the models, the regulatory requirements, they’re essential, and without them there’s no consistency, no shared language, and no basis for governance.

But if development stops there, it leaves a critical gap.

Because the effectiveness of a risk function isn’t determined solely by what people know, it’s determined by how they interpret, challenge, and apply that knowledge in situations that aren’t clearly defined. That’s where capability either holds or starts to leak, and it’s also where traditional approaches to training tend to fall short.

What needs to change in how capability is built

Closing that gap doesn’t come from adding more content or expanding existing programs in the same way. It requires a shift in how capability is developed in the first place.

Training needs to move beyond explaining frameworks and toward helping people interpret them, particularly in situations where the answer isn’t obvious. That means creating learning experiences that reflect real conditions, where information is incomplete, where trade-offs need to be made, and where different interpretations can be explored and challenged.

It also means placing more emphasis on how people engage with the tools they’re given. Not just how to use a model, but how to question it. Not just what the policy says, but how to apply it when the situation doesn’t fit neatly within its boundaries. And not just when to escalate, but how to take ownership of a decision before escalation becomes necessary.

Equally, it requires reinforcing the behaviors that support a strong risk culture, encouraging people to surface concerns early, to challenge assumptions constructively, and to communicate their thinking in a way that others can act on.

What this requires in practice is a more applied approach to capability development, which can be explored further in How to build stronger risk capability in practice.

Where stronger capability starts to show

When capability is built in this way, the difference isn’t theoretical, it becomes visible quite quickly in how the function operates.

Decisions move forward with greater clarity, not because risk is being taken more lightly, but because it’s being understood and communicated more effectively. Escalation becomes more targeted and purposeful, rather than a default response to uncertainty. And perhaps most importantly, there’s greater consistency in how similar situations are handled, even across different teams and levels of experience.

Over time, that changes how risk is experienced across the organization. It becomes less about enforcing rules and more about supporting decisions, less about slowing things down and more about helping the business move forward with a clearer view of what sits ahead.