If Your Team Is Hiding Control Failures, Your IRM Program Is Already Dead
Overcoming the Blame Culture in Risk Management
THE SAASCE BOUTIQUE | LET’S TALK IRM | ARTICLE 10
The risk register shows green. The attestations are completing on time. The dashboards look healthy across every business unit. Yet, somewhere in that program, a control owner has known for three weeks that a control is not functioning the way it is documented. They have not logged it, nor will they. They have made a rational calculation based on what their organization has demonstrated will happen when they do.
This is not a data quality problem. It is a culture problem. The platform cannot surface what the people feeding it have decided not to share. A psychologically unsafe organization produces a structurally unreliable IRM program, regardless of how sound the platform configuration is. The data inside your ServiceNow IRM instance is only as honest as the culture generating it.
What Blame Culture Actually Looks Like Inside an IRM Program
Attestations completing in under two minutes across a complex, multi-entity control environment. Every control marked Effective, every cycle, across every business unit with no variance. Issues appearing in the system after an auditor surfaces them, never before. Risk owners who surface only the risks they are confident can be mitigated, leaving the uncertain and uncomfortable ones out of the register entirely. Accepted risks sitting at the same status for twelve, fourteen, sixteen months because the person who originally accepted them has left. Nobody documented the rationale and no one on the current team wants to be the one who opens that conversation.
None of these behaviors are the result of malice. They are the result of rational decision-making under conditions of perceived threat. The control owner who marks a control Effective without reviewing the evidence has done the math. The last time someone flagged a gap in this organization, the conversation that followed was about who was responsible for it, not about how to close it. The rational response is to not flag the gap.
In highly regulated environments, the risk is not that employees break rules. The risk is that they hide near misses, early warning signals, and the ethical gray areas that only the frontline can see. Silence is not compliance. It is concealment (HR Executive: When Compliance Kills Trust, June 2026). The platform reads the submission it receives. It does not read what the control owner decided not to say.
The pattern looks like compliance in the dashboard. It is not compliance. It is the organizational version of fake safety data.
The Real Cost of Silence in IRM Data
A risk dashboard that looks green because people are afraid to mark it red is not a risk dashboard. It is a confidence dashboard. It reflects how comfortable employees feel reporting issues, not how well the controls are actually functioning. Those are two entirely different measurements, yet most programs only have one of them.
The cost compounds over time and in a specific direction. When leaders respond to disclosed failures with blame assignment rather than system-level problem solving, the rational response is to handle failures privately. In an IRM context, this means control gaps are known but not logged, accepted risks are reviewed informally but never formally revisited, and issues are managed outside the platform until they become unavoidable. Up to 80% of major incidents are preceded by unreported near misses (NIST Global: Breaking the Blame Culture, March 2026).
The BP Deepwater Horizon investigation found that about 50% of employees felt they would face backlash for reporting risky actions. Many ended up entering fake safety data rather than surface the real picture (Onspring: Why Psychological Safety Might Be Your Strongest Risk Control, April 2026). The IRM equivalent is an attestation marked Effective that the control owner knows is not, a risk response of Accept that the risk owner knows the organization cannot actually support, or an issue date that reflects when the auditor found the gap rather than when the control owner first noticed it.
What Organizations Get Wrong When They Try to Fix This
When organizations recognize they have a reporting culture problem, they almost always reach for the wrong intervention first. Three specific traps are worth naming because each one looks like a solution while producing a different version of the same result.
Mistake one: Adding anonymous reporting channels without changing the leadership response pattern.
Multiplying intake forms does not build transparency. Transparency is built on visible, fair, and consistent follow-through. When an employee submits an anonymous report and nothing visible happens, the message the organization sends is that reporting achieves nothing. The channel fills the compliance requirement, but the reason people are staying quiet remains unaddressed. In ServiceNow IRM, the platform has robust issue management workflows that can make follow-through visible. But a workflow only builds trust if the person who logged the issue can see what happened to it (HR Executive: When Compliance Kills Trust, June 2026).
Mistake two: Treating psychological safety as an HR initiative rather than a governance design requirement.
The problem is not interpersonal. It is structural. It is about what the governance model has demonstrated will happen when a control failure is reported. That demonstration is not in a policy document or in a survey result. It lives in what leadership actually did the last time someone brought them a real gap. A culture initiative that fails to change the observable response pattern changes nothing.
Mistake three: Assuming survey scores reflect reality.
Organizations with poor psychological safety see confidential concerns ignored and unaddressed until they produce an operational breakdown (Noomii: Guide to Psychological Safety in the Workplace, 2025). The measurement trap is that employees who feel unsafe do not answer safety surveys honestly. A 78% positive psychological safety score in an unsafe culture is exactly what you would expect to see. The survey score is subject to the same dynamic it is trying to measure. The attestation data is a more reliable signal: observable, platform-based, and harder to perform than a self-report.
How to Configure the Human Side of Your IRM Program
The platform cannot create the conditions for honest reporting. What the platform can do is reflect those conditions once they exist, and amplify them once they become organizational habits. Three specific operational shifts move the needle. None of them require a new tool or a platform reconfiguration.
1. Reframe what a finding means organizationally.
A control failure that is found and reported is a program working correctly. Conversely, a control environment that never produces findings is a reporting culture problem, not evidence of strong controls. Name this distinction explicitly in every governance session, assessment kickoff, and leadership review. Not once in an onboarding document. Repeatedly and visibly, from whoever carries authority in the program. In ServiceNow IRM, the issue management workflow should be positioned to control owners as the mechanism that proves the program is functioning, not as the paper trail that follows a failure.
2. Separate the messenger from the message in escalation design.
When a control failure is escalated, the conversation should be about the failure and its remediation, not about who knew and when. Build the escalation workflow in ServiceNow IRM to route issues to remediation owners, not back to the control owner who surfaced them as a form of accountability. Issue assignment, remediation ownership, and SLA tracking can all be configured to reflect this principle. The configuration follows the governance design decision, but that decision must come first.
3. Make the cost of silence visible.
An audit that uncovers a known, unlogged control failure costs far more than one that surfaces a genuinely unknown gap. Name that cost explicitly at the leadership level. When an issue resolves faster because someone reported it early, say so in the next governance session. When a stale accepted risk produces a finding, name what the missed reporting opportunity cost the organization. Over time, making these patterns and outcomes visible changes the rational calculation for the next control owner deciding whether to log a gap (Onspring: Why Psychological Safety Might Be Your Strongest Risk Control, April 2026).
The Program That Earns Honest Data
A ServiceNow IRM program earns the data it deserves. The platform can automate workflows, route issues, generate dashboards, and surface indicators from live data. What it cannot do is make a control owner feel safe enough to report a failure they know will be received as a personal indictment.
Building a program that earns honest data requires the same intentionality as configuring the platform itself. It requires naming how failures will be received before the first failure is reported. Most importantly, it demands leadership behavior that demonstrates the observable difference between accountability for hiding a problem versus accountability for having one. High-performing organizations hold people accountable for hiding problems, not for having them. That distinction, lived visibly over time, is what changes the data inside the platform.
The platform does not stall on this. The culture does. And unlike the platform, the culture cannot be configured. It has to be earned.
Connect on LinkedIn to continue the conversation. If your program is running on data you do not fully trust, that is worth naming out loud.
Sources
1. Onspring: Why Psychological Safety Might Be Your Strongest Risk Control (December 2025, updated April 2026) — https://onspring.com/resources/blog/psychological-safety-in-risk-management/
2. HR Executive: When Compliance Kills Trust — The Psychological Safety Blind Spot (June 2026) — https://hrexecutive.com/when-compliance-kills-trust-the-psychological-safety-blind-spot/
3. Noomii: Guide to Psychological Safety in the Workplace (2025) — https://orgs.noomii.com/psychological-safety-in-the-workplace/
4. NIST Global: Breaking the Blame Culture — Building Trust in Workplace Safety (March 2026) — https://nistglobal.com/blog/2026/03/breaking-the-blame-culture/
