What reactive risk management costs you and how to go proactive

How to shift to a proactive risk management approach

A proactive approach to risk management is acting before any incidents occur. Making the shift from reactive to proactive doesn't require a new system; all you need is to use systems you already have differently.

Here's where to start:

Start measuring what happens before incidents, not after

Focus on leading indicators instead of lagging indicators. If the data you’re working with only shows incident rates, lost time injuries, and damage reports, all you got is history.

Choose instead to focus on near-miss frequency rates, unsafe act observations, inspection completion rates, and how long it takes to close out corrective actions.

These are the numbers that give you something to act on. They show you where the system is under pressure before that pressure becomes an incident.

Treat risk assessments as living documents

Managing risks should be more than just completing a risk assessment, signing it off, and filing it away. That’s just you documenting a risk that was once considered.

Build a rhythm of reviewing assessments at meaningful intervals and updating them when the conditions they were built on change. Change the approach based on risks that are yet to happen, not the other way around.

Make pre-task planning a real conversation, not a sign-off ritual

What’s been happening is that pre-tasks checks have become just ticking a compliance exercise and not at all what it’s intended to be: identify the hazard before the workers go anywhere near the work.

Pre-task planning usually works when the people doing the work are the ones identifying the hazards. It typically involves asking them what's different today, what's changed since last time, what they're worried about, and other concerns or questions they might have. It should be more than just handing them a form to tick off that someone else wrote in an office miles away from the job site.

Close the loop on every report

Being proactive also means reacting to things, but in a timely manner. It means acting on what gets reported before the next shift even occurs, not the next quarter.  When employees report something and can track what happened next, reporting becomes worth doing and  instinctive.

But what usually happens is reports disappear into the system with no visible outcome or changes, which then leads the report to stop coming. Still, the hazards don’t tend to stop even when the reports do.

Proactive risk management in action

If you’re still wondering what proactive risk management looks like in practice, here’s a story that may help make it real:

GROWMARK, a large agricultural cooperative operating across more than 100 sites, is all too familiar with this problem.

Like many organizations with decentralized teams, they were dealing with a familiar problem: safety information slipped through the cracks, local knowledge stayed local, and reactive habits were harder to break at scale.

After incorporating Mitti (by SafetyCulture) to their systems, they were able to build a more proactive, data-driven way of working around scheduled inspections, good catches, near misses, and shared learnings across sites.

What once meant scattered paperwork and disconnected follow-ups became one connected system for spotting patterns early, sharing lessons faster, and acting before smaller issues turned into bigger, costlier ones.

Their manager of Safety and Environmental Engagement Matt Harken stated: “Our greatest victories are in things that never happen. And that's the thing we're using Mitti (by SafetyCulture) for. We take those good catches and near misses and transfer them into an opportunity to learn.”

It’s a story a lot of organizations that rely on lagging indicators and scattered reporting can relate to.

The difference is that GROWMARK no longer waits for risk to become an incident before paying attention to it.

Proactive risk management isn't the destination

If and when you achieve proactive risk management, you shouldn’t stop there. It’s not a certification you earn or a system to implement only once.

It’s a standard you maintain through honest reporting, consistent measurement, and a culture of continuous improvement where workers trust the systems they operate in to have their backs when they file a report.

The organizations with proactive systems aren’t necessarily the ones with the most well-documented processes. They’re the ones who provide their employees with the right tools for surfacing risk, and where leadership has made it worth their while to do so.

That’s how to shift to being proactive. Not by building a new system, but by creating a different relationship with the one you already have.

Most organizations have a risk management process, but very few actually have what matters: a risk management culture.

And there’s actually a big difference between the two. A culture prevents incidents, while a process produces paperwork. Focusing on processes alone leads to more work and buried incidents, leading to no proper resolution. A risk management culture is more about proactive risk management, while a risk management process is more reactive.

That difference matters more than most leaders realize.

What reactive risk management actually looks like in practice

Reactive risk management means responding to incidents after they occur, after an employee has been harmed, or something has gone awry.

Most reactive programs look harmless from the outside. But on the inside? It’s slowly carving out cracks in your organization.

These can look differently on the ground, but some of the tell-tale signs are:

• Risk registers that only get updated after something goes wrong: When it’s only revised in response to an incident, it becomes a record from the past, instead of a new tool for future incidents.

• Near misses that go unreported because nothing "technically" happened: When employees don’t see the point in reporting something because it didn’t cause visible harm, the loophole gets bigger and the early warning signals get ignored.

• Depending on corrective actions for future incidents: When there’s a dependency on corrective actions—specificallyones that fix only the symptoms and not the cause—the underlying problem that caused the incident in the first place never gets addressed.

Now, if a reactive approach isn’t the best approach for an organization, why does it still persist?

Two reasons:

One is because they’re easier to defend: just point to the report and the action meant to correct the problem. After that, the ticket is closed.

The other reason is because they’re also easier to measure. Incident counts are simple, visible, and countable data. Not to mention that acting on uncertainty is a risk most organizations are willing to take. See, proactive risk management asks people to respond to things that haven't happened yet, which takes more judgment and more trust in the data.

The costs of a reactive approach

As more cracks are carved into the system, the more it’ll cost to fill them up. And that’s not even the worst bit.

The worst part is that it doesn't just cost you your budget; it'll cost you your people, your operations, and the culture you've worked hard to build too.

In the US alone, private industry employers reported 2.6 million nonfatal workplace injuries and illnesses in 2023. Additional research shows 80–90% of serious injuries at work are caused by human error, which proper risk and safety systems could have caught earlier.

The human cost

Every incident reported is a result of known, recurring hazard patterns that nobody acted on in time. Behind every statistic is a person, someone who showed up to work and didn’t come home the same way they left, one way or another. In the grand scheme of things, it’s easy to forget the human aspect behind the work.

Incidents aren’t freak accidents, they’re the tail end of a chain of events that a proactive system would have broken earlier.

The operational cost

Unplanned stoppages, rework, regulatory liability, and insurance exposure don’t just appear suddenly. They’re a result of compounded risks managed after. Each incident handled following these chips away something from your organization: production time, team confidence, customer trust.

A single incident can lead to an unplanned stoppage that not only may cost hours to fix, but also cost downstream production, overtime to account for the time lost, and investigation time that pulls supervisors away from the floor.

The cultural cost

Employees used to a reactive environment tend to stay quiet. This translates to near misses not getting reported. And when these continue to go under the radar, the signals stop coming. Over time, your workforce stops telling you what you need to know.

That silence isn't safety; it's a warning. Culture doesn’t break it a day. Rather, it erodes over time. When workers see hazard reports get ignored and unaddressed repeatedly, they don’t think the workplace is safe, and conclude that reporting isn’t worth the effort.

Rightfully so too, because if you think about it, why report when it won’t do them any good anyway?