What if the Risk Manager is Malevolent?

ABSTRACT

Risk is a fundamental aspect of human endeavors, and risk managers serve an indispensable role within organizations and society. Risk managers engage in identification, assessment, communication, and control of numerous types of risks. These activities support decision‐making about the relative benefits and risks of various courses of action in the pursuit of organizational or societal objectives. Risk managers, in their role as advisors on topics that potentially could result in negative outcomes, play an important part in risk‐based decision‐making. This perspective paper explores the situation in which the risk manager is not a neutral provider of risk‐related information but rather is actively malevolent, seeking to cause losses and mayhem by intentionally weaponizing the risk management process itself. We discuss the general role of the risk manager as well as how malevolence can manifest itself within a risk management context. Two brief vignettes on flood risk management and financial portfolio management are given to illustrate the potential impacts of a malevolent risk manager. Finally, we offer some potential countermeasures, attempting to answer the question, “Who manages the risks of the risk managers?”

1. Introduction

Throughout human history, people have been interested in finding ways to manage the multitude of risks encountered in life (Covello and Mumpower 1985). Risk management is used to address “pure” risks with no upside (e.g., hurricanes, earthquakes, and disease outbreaks) and “speculative” risks that involve the potential for both profits and losses (Colquitt et al. 1999). Businesses, for example, that take too few risks will fail to generate profits, yet exposing the company to too much risk, or the wrong risks, can likewise be detrimental (Damodaran 2008). Risk management typically does not seek to eliminate all risk but rather supports prudent and risk‐informed decision‐making (Harner 2010).

Successfully directing resources toward preventing and mitigating uncertain risk events is the goal of risk analysis and management (Thekdi and Aven 2023). Risk managers play an important role in accomplishing these tasks. Risk professionals typically work in two related areas—(1) studying, communicating, and managing the risks of a specific activity or domain (e.g., floods, cybersecurity, product safety, and human health); and (2) developing generic tools and practices to conduct risk‐based research that can be applied to the specific activities (Aven 2017). According to the Society for Risk Analysis (SRA), risk management is a process that “covers all measures and activities carried out to manage and govern risk, balancing developments and exploring opportunities on the one hand, and avoiding losses, accidents, and disasters on the other” and involves “balancing different concerns” in the decision of “how much risk to accept” (Society for Risk Analysis 2018). In doing so, the risk manager should not be influenced by conflicts of interest or ulterior motives—they should exhibit a posture of neutrality (Aven and Thekdi 2022). But what if the risk manager is malevolent?¹

In this paper, we explore this question. While risk professionals may have different job titles (e.g., risk manager, risk analyst, and risk assessor) and, correspondingly, different job functions, we will use the generic term of “risk manager” to describe a person whose job is to identify, assess, communicate, and treat risks. First, we will describe the role of the risk manager. Next, we will explore the concept of malevolence and how it relates to risk management. From there, we present some vignettes across different application domains illustrating what could happen as the result of a malevolent risk manager. Finally, we discuss the results of our exploration and provide some conclusions with implications for the practice of risk management.

2. What do Risk Managers do?

Risk managers oversee the processes of risk management throughout the organization (Ward 2001). Some organizations may have a formal risk manager position (such as a Chief Risk Officer), while others may have risk management duties dispensed across functional silos (product engineering personnel manage quality, safety, security, and reliability risks, while legal, finance, human resources, occupational health, and other functional roles similarly manage risks within their purview). For the purpose of this analysis, we define a risk manager as an individual within the organization who contributes to the identification, assessment, communication, and treatment of risks and who shares responsibility for the overall risk posture of the organization.

As Giddens (1999) noted, “the idea of risk is bound up with the aspiration to control and particularly with the idea of controlling the future.” Risk managers are tasked with understanding and controlling the portfolio of risks to which the organization is currently exposed and the risks that it might be exposed to in the future (Hull 2012; Keisler et al. 2011). Risk managers identify approaches and techniques for managing such risks, perform risk analyses for decision makers, and promote thinking about and raising awareness of risks by others across the enterprise (Ward 2001). Risk managers facilitate the process of risk identification and prioritization so that resources can be allocated to meet organizational objectives (Miller and Griffey‐Brown 2018). For risks that are deemed unacceptable by a decision maker, the risk manager is responsible for taking actions regarding how the risks should be treated (Hull 2012). Good risk management practices increase the likelihood of successfully achieving strategic objectives while simultaneously preserving and enhancing value (Frigo and Anderson 2011).

In many organizations, the job of the risk manager is not primarily that of a decision maker (Thekdi and Aven 2023; Stulz 2008; Paté‐Cornell and Dillon 2006; Ward 2001). Risk managers provide decision makers with information about risks that threaten the organization (Harner 2010; Ross and Sumner 2002). In organizations where the risk management and decision‐making functions are distinct and separate, the risk manager identifies, evaluates, and monitors risks and communicates that information to the senior management (e.g., the board of directors) (Stulz 2008). Top management makes the decision about what risks to take and how those risks should be treated (e.g., what mitigation strategies should be utilized) in alignment with the organization's strategy and risk appetite (Stulz 2008). The decision maker (or board) is responsible for setting a risk management philosophy and a risk appetite, understanding the organizational risk management process, reviewing the portfolio of risks, and staying abreast of the most significant risks and their responses (Harner 2010). The risk manager works with the decision maker to facilitate the development and implementation of risk management (Ward 2001).

The nature of risk is such that even with perfect risk management practices in place, negative outcomes can, and do, still occur (Thekdi and Aven 2023; Stulz 2008). A negative outcome is itself insufficient to conclude that the risk manager failed in some way (Thekdi and Aven 2023), while a positive outcome is not always indicative of success—for example, in the case of a near‐miss (Dillon and Tinsley 2008). Allocating responsibility when a risk materializes is empirically and theoretically complex, due to the existence of various conceptualizations for the terms “risk” and “responsibility” (Kermisch 2012). Nonetheless, perceptions of deficiencies in risk management can arise, as in the case of the magnitude 6.3 earthquake that struck the Italian city of L'Aquila in 2009, killing over 300 people and destroying around 20,000 buildings (Hall 2011). In that case, seven Italian scientists were convicted of manslaughter for allegedly failing to adequately warn the community of the risks following a string of lower‐magnitude earthquakes in the region (Sisto 2012; Hall 2011). While not a case study in malevolence, this incident illustrates the unique role that risk managers play within society.

3. Malevolence and Risk Management

3.1. Malevolence

Baehr (2010) defined malevolence as “opposition to the good as such.” Malevolence can be manifested in various ways, such as “the infliction of suffering, the destruction of life, and the deprivation of active power” (Bain 1883). It is willful and active, involving actual enacted attempts against the good rather than a passive belief or preference (Baehr 2010). Further, malevolence is something fundamental about the individual's self‐conception—malevolence is not merely an instrumental means for achieving another goal but instead is carried out for its own sake (Baehr 2010).

Malevolence involves intentionally acting with the aim of harming or imposing risks on others (Wolff 2006). This is contrasted with incompetence, which involves properly assessing a risk and deciding to take appropriate action but failing to accomplish that in some way (Wolff 2006). Intent is interrelated to a specific motive—an underlying reason for causing harm to the organization (e.g., financial reasons, desire for higher status and prestige, feeling in control, taking away the power, terroristic inclinations, espionage, revenge, personal psychological traits, and moral rationalization). Motives could conceivably overlap and do not necessarily operate independently. One motive leads to another, affecting the malicious intent in both short and long terms.

The motive should be taken into consideration through the whole process of detecting and counteracting malevolent risk managers. We therefore assume that a malevolent risk manager acts with the specific intention of causing loss or increasing risk for others (Wolff 2006), where loss is any “physical damage to property or bodily injury, including loss of use or loss of income” (National Association of Insurance Commissioners 2025).

Misconduct, by its essence, is a failure motivated by personal beliefs, frequently reflected in an individual's political ideology (Fewer and Tarakci 2021). It is characterized by person's values and opinions regarding the ideal social order and how it could be attained. Extreme political beliefs, whether liberal or conservative, might persuade a risk manager to apply a flawed approach and act erroneously, taking advantage of the organization as an instrument to achieve his or her ideal order.

How might malevolence manifest itself within the context of risk management? Within the domain of risk management, Stulz (2008) identified several potential generic modes of risk management failure (or perceived failure):

1. Failure to use appropriate risk metrics.

2. Mismeasurement of known risks.

3. Failure to take known risks into account.

4. Failure in communicating risks to top management.

5. Failure in monitoring and managing risks.

Table 1 describes some ways, drawing from Stultz (2008, 2009) that a malevolent risk manager may leverage their influence within the organizational risk management process to intentionally cause loss or increase risk. As can be seen in the table, intentional risk management malevolence can be overt, such as deliberately not treating a risk or disabling countermeasures that are in place, or actions that are much more covert and difficult to identify. For example, the intentional use of misleading risk metrics, or analyses that are based on faulty probabilistic modeling assumptions (e.g., the use of the wrong probability distribution), can result in decision makers taking improper and suboptimal actions that expose the organization to risk. In this way, a malevolent risk manager can use the risk management process itself as an attack vector against the organization that the risk manager is meant to protect.

TABLE 1.

Examples of malevolent risk management failures.

Risk management failure	Examples of malevolence
Failure to use appropriate risk metrics	‐  Using a misleading risk metric ‐  Wrong risk tolerance (too risk averse or risk seeking) ‐  Use of metric with the wrong time horizon
Mismeasurement of known risks	‐  Wrong probability estimate ‐  Wrong consequence estimate ‐  Wrong probability distribution ‐  Ignoring correlations between risks ‐  Inaccurate extrapolation of past data into the future ‐  Use of low quality or distorted data
Failure to take known risks into account	‐  Intentionally ignoring known risks ‐  Intentional diversion from existing risks to fabricated ones ‐  Ignoring new risks caused by mitigations
Failure in communicating risks to top management	‐  Wrong weighting/prioritization of risks ‐  Intentionally confusing/misleading risk communication ‐  Poor visualization of risks (e.g., heatmaps) ‐  Intentionally delayed reporting
Failure in monitoring and managing risks	‐  Allocating scarce resources to mitigate irrelevant risks ‐  Utilizing ineffective mitigations ‐  Disabling or defeating countermeasures ‐  Not updating assessments as situations change ‐  Implementing countermeasures that cause new risks ‐  No efficient follow‐up approach towards previously overcame risks

3.2. Is This Really a Problem?

At this point, a reasonable question to consider is whether a malevolent risk manager is really a realistic problem in the first place. The authors are unaware of any documented cases specifically in which a risk manager has acted in a deliberately malevolent manner. However, malevolent actions are not entirely without precedent. For example, the case from 1982 of Tylenol tampered with cyanide resulted in the deaths of seven individuals in the Chicago area, a massive recall of over 31 million bottles, and an estimated over $1 billion in adverse brand publicity (Mitchell 1989; Markel 2014). While the perpetrator was never found, it is hypothesized to have occurred at the retail level after it had left the factory (Mitchell 1989; Markel 2014). This malevolent action led to changes in the way pharmaceuticals are packaged to prevent tampering. Or consider a somewhat different scenario: malevolent AI. For example, in an “AI takeover catastrophe,” a runaway AI leaves humans unable to control their own fate, resulting on a global catastrophe (Baum 2025). As AI systems are being rapidly adopted into more and more facets of everyday life (including risk management), it is important that AI acts in ways that are aligned with human values, as opposed to acting malevolently (Larsen and Dignum 2024).

Homoliak et al. (2019) noted that malicious insiders pose a unique risk because they can remain clandestine, especially if they know and can control the security measures in place, allowing them to remain undetected. A malevolent risk manager therefore represents a special type of insider threat—one that has access, familiarity, and proximity to the very risk management countermeasures meant to keep the system safe (Sokolowski et al. 2016). Given their specific role within an organization to manage important risks, a malevolent risk manager is uniquely poised to cause maximum loss and mayhem across an organization and society.

Placing a probability of occurrence on a malevolent risk manager is difficult. Nurse et al. (2014) speculated that actors demonstrating high levels of the dark triad personality traits (i.e., Machiavellianism, narcissism, and psychopathy) would theoretically be more likely to be an insider threat than individuals who do not demonstrate these traits—such traits are characterized as transgressive, norm‐violating, and of a “malevolent social character” (LeBreton et al. 2018; Muris et al. 2017; Paulhus and Williams 2002). LeBreton et al. (2018) estimated that while clinical expressions of dark triad traits are relatively low (“well below 1% in the general population”), subclinical expressions may be much higher—even as high as 15% of the general population.

In summary, while the likelihood of occurrence is low, the consequences are potentially high, given the leverage a malevolent risk manager might have over the risk countermeasures of the organization. Such low‐probability/high‐consequence risks are difficult to assess, yet their management may nonetheless be prudent. In the following sections, we present two simple vignettes that are intended to serve as thought experiments about malevolence within the risk management process.

4. Example 1: Flood Risk Management

One of the important roles of flood risk managers is to provide warnings in advance of flood events with the goal to reduce the damages and losses. Flood warning systems are effective to the extent that such losses are avoided (Molinari and Handmer 2010).

To explore the impacts of a malevolent risk manager, we adapt the case study described by Molinari and Handmer (2010) of the Gippsland flood in June 2007. Gippsland, a region of Victoria, Australia, was subjected to heavy rainfall for a period of several days between June 26–30, causing severe flooding. A flood warning was first issued on June 25, with several subsequent warnings. As a result of the flood, around 40,000 head of livestock were lost, and one person died. Approximately 1500 properties sustained damage, including 320 buildings, and over 18,500 ha of land was damaged (Molinari and Handmer 2010).

Molinari and Handmer (2010) developed an event tree that captured estimated probabilities of warning effectiveness. For example, based on surveys conducted after the flood, 40% of respondents heard an official warning, while only 60% of those who heard the warning thought it applied to them, while 55% of people became aware of the flood from “unofficial” cues like personal observation or warnings from friends. Some people who received a warning (around 24%) trusted the warning, while 76% sought additional confirmatory information. Almost all (> 99%) of people who heard and heeded a warning took some action to reduce the losses to their property, but those who did not receive a warning took no action. This baseline scenario is summarized in the event tree in Figure 1a. The event tree shows that 78.21% of the community took action to reduce flood damages, while 21.79% did not take action.

FIGURE 1.

(a) Event Tree with Warning (Baseline Scenario); (b) Event Tree without Warning (Worst Case Scenario). Adapted from Molinari and Handmer (2010).

Figure 1b shows the event tree in the presence of a malevolent risk manager. Assume that the risk manager knows of the impending flood but intentionally does not communicate that information to the decision maker in charge of issuing an official warning. Setting the probability of hearing an official warning to zero (P(official) = 0) and assuming that in a worst‐case scenario, those people who would have heard an official warning if it were given ended up hearing no warning, the new event tree shows that only 54.45% of the population would take action, while 45.55% of the population would not take action. Since virtually all of the people who heard a warning took some action to reduce property damage, we can infer that in this extreme worst‐case scenario, damages would have increased proportional to the amount of people not taking action—in this case, increasing from 21.79% to 45.55% in the absence of a formal warning. This equates to around 3136 properties damaged, 669 buildings damaged, 83,616 head of livestock lost, and two people perishing. In other words, the malevolent risk manager could (as an upper limit) roughly double the losses associated with the flood event.

Of course, it may be unrealistic to assume that, of the population that would have received an official warning, none of them received an informal warning (although this is the limiting, worst case). Perhaps instead the malevolent risk manager simply delays relaying the warning information until it is too late for many who hear the warning to take proper actions. In any event, it is likely that some proportion of those who originally received a formal warning in the baseline scenario would have instead received an informal warning if the formal warning had not been issued. Figure 2 plots this proportion on the x‐axis, along with the resultant probabilities of taking action or not taking action (P(act) and P(no), respectively). The horizontal lines plot the baseline probabilities for P(act) and P(no) for reference. Interestingly, when the proportion of those receiving an informal warning in the absence of a formal warning is > 0.6, the outcomes are better (i.e., more people take action) than in the baseline scenario. This is because the unofficial warning is actually more effective than the official warning (P(act|official) = 0.2376 and P(act|unofficial) = 0.5445). A malevolent risk manager could inflict more harm on society as long as < 60% of those who would have received a formal warning received no warning.

FIGURE 2.

Sensitivity analysis of flood risk management event tree.

5. Example 2: Use of Misleading Risk Metrics

The choice of risk metrics is an important one within the risk management process. For example, Cox (2012) compared three metrics for the prioritization of risk reduction budgets: the risk magnitude itself, risk reduction potential, and risk reduction per unit cost and found that risk reduction per unit cost was the highest‐performing metric. According to the simulation analysis performed by Cox (2012), use of other metrics, for example, risk magnitude, for the allocation of scarce risk management resources would have yielded suboptimal results relative to the allocation using risk reduction per unit cost. Yet even risk reduction per unit cost (essentially a benefit‐cost ratio) can sometimes yield misleading results, especially if some mitigation strategies are inexpensive relative to others (Collier et al. 2023).

Another area in which risk management metrics are critically important is in finance, where risk managers must balance risk with reward. As a simple example, consider a portfolio composed of four stocks. Five years of monthly adjusted closing prices were obtained from Yahoo Finance from February 2021 to January 2026 for four stocks (TSLA, COKE, NVDA, and AMC). The summary statistics are shown in Table 2.

TABLE 2.

Summary statistics of adjusted closing prices for four stocks.

	TSLA	COKE	NVDA	AMC
Max	$456.56	$162.95	$202.48	$566.80
Min	$123.18	$24.57	$12.12	$1.52
Mean	$272.36	$79.04	$71.03	$88.53
Monthly volatility	0.173	0.121	0.148	0.355
Expected return	2.52%	3.72%	5.58%	−1.20%

Consider a malevolent risk manager seeking to subtly expose a client to more risk. One strategy might be to use misleading risk metrics. Assume an investment of $1,000,000 and a risk‐free rate of 2%. A simple portfolio optimization problem is to allocate weights across the four stocks such that they maximize the portfolio's Sharpe ratio subject to the constraint that the weights sum to 100%. The Sharpe ratio (S_p ) of portfolio p is a measure of the expected portfolio return (E[R_p]) above the risk‐free rate (R_f ) relative to the portfolio's risk (as measured by the standard deviation of returns, σ_p ):

$${\mathrm{S}}_{\mathrm{p}}=\frac{\mathrm{E}[{\mathrm{R}}_{\mathrm{p}}]-{\mathrm{R}}_{\mathrm{f}}}{{\sigma }_{\mathrm{p}}}$$

Suppose the risk manager presents two alternatives: in one scenario, the risk manager does not allow short positions (i.e., negative portfolio weights), while in another case, short positions are allowed. Table 3 shows the results of these two scenarios, reporting the portfolio weights of each of the four stocks and the resulting Sharpe ratio, along with two common risk metrics: the portfolio value at risk (VaR) at the 95% confidence interval and the expected shortfall.

TABLE 3.

Portfolio optimization outcomes (weights may not sum to 100% due to rounding).

No short positions allowed
	TSLA	COKE	NVDA	AMC
Weights	0	0.353	0.647	0
Sharpe ratio	26.42%
VaR @ 95%	$ (134,646.83)
Expected shortfall	$ (185,109.66)

Short positions allowed
	TSLA	COKE	NVDA	AMC
Weights	−0.179	0.347	1.020	−0.189
Sharpe ratio	29.77%
VaR @ 95%	$ (119,558.93)
Expected shortfall	$ (205,471.20)

When no short positions are allowed, the Sharpe ratio is 26.42%, and the monthly portfolio value at risk (VaR) at a 95% confidence interval is equal to −$134,646. VaR is defined as a loss that will not be exceeded given a specified time period and confidence interval (Hull 2007). However, when short positions are allowed, the Sharpe ratio increases to 29.77% and the VaR decreases to −$119,558. These results alone, if presented to a decision maker, might be misleading. At face value, it would appear that allowing short positions strictly dominates not allowing short positions, since the Sharpe ratio is higher and the VaR is lower.

However, this would intentionally obscure the risk of allowing short positions in the portfolio, since the magnitudes of the downside losses are larger. Another risk metric, the expected shortfall, is the expected loss over a given time given losses greater than the VaR level and better measures such tail risks (Yamai and Yoshiba 2005; Hull 2007). In other words, it explicitly accounts for the magnitude of the catastrophic losses in the tail, whereas VaR does not (Stultz 2008). The expected shortfall, when not allowing for short positions, is −$185,109, while it increases to −$205,471 when shorting is allowed. In other words, when VaR is used as a risk metric, the portfolio without short positions looks riskier, but when expected shortfall is used as the risk metric, the portfolio with short positions looks riskier. This is summarized in Figure 3. A malevolent risk manager, wishing to convince the client to invest in the riskier portfolio, could mask the risk by simply reporting on the VaR metric of the two portfolios instead of reporting on the expected shortfall. This example is related to the “failure to use appropriate risk metrics” identified by Stultz (2008). While more subtle than the previous flood risk management example, it highlights how the use (and potential misuse) of risk metrics can lead to suboptimal risk management decisions.

FIGURE 3.

Results of portfolio example.

6. Who manages the Risks of the Risk Managers?

This question is modeled after the question famously posed by the Roman satirist Juvenal, “quis custodiet ipsos custodes?” translated as “Who will guard the guards themselves?” or “Who watches the watchmen?” (Braund 2015). As we have shown, the impact that a malevolent risk manager can have on a system can be quite significant but also potentially difficult to detect. How then can organizations and communities effectively manage the risks associated with the actions of a malevolent risk manager?

6.1. Governance Mechanisms

First, good model risk management practices should be practiced, including risk model validation and governance (Thekdi and Aven 2024; Collier and Lambert 2019). Risk modeling is an important process within risk management, and decision makers rely on the accuracy of risk models to be able to make well‐informed decisions confidently (Molinari et al. 2019; Lee and Stevenson 2005). Model risk arises when models are used that inadequately or incorrectly perform their function (Goldberg 2017). A malevolent risk manager who tries to manipulate risk models and their results (by tactics listed in Table 1) may be thwarted by an independent model validation and governance process (North American CRO Council 2012). Model governance involves the allocation and segregation of duties related to model use, maintenance, support, and implementation (North American CRO Council 2012).

Oversight of the risk management function is also an important way to mitigate the risk of a malevolent risk manager. Within an organization, for example, the board of directors is responsible for overseeing the efficacy and quality of the risk management processes and regulatory compliance (Fraser 2016; Purdy 2010; Ingley and Van Der Walt 2008). The board (or other decision maker or decision‐making body) can exercise full oversight themselves or delegate oversight to an audit committee or risk committee (Fraser 2016). The “three lines of defense” (or 3LOD) model is one that is used to provide risk oversight. The first line of defense is the process owners and managers responsible for managing day‐to‐day risks; the second line of defense includes organizational risk management and compliance functions; and the third line of defense is independent auditing (The Institute of Internal Auditors 2020; Deloitte 2020). The activities of a malevolent risk manager embedded within, for example, the first line of defense, could be identified by the other two lines of defense.

Periodic independent audits are an important check on the risk management function. The auditor provides the decision maker with an expert opinion on the level of adequacy of the risk management controls and offers recommendations for improvement (Fraser 2016). Whether the audit is internal or external, it should provide independent assurance about the quality and effectiveness of the risk management processes (Fraser 2016). It is likely more difficult for a malevolent risk manager to adversely sabotage an external audit than an internal one over which the risk manager may exert (partial or full) control.

A malevolent risk manager is a special type of insider threat. Homoliak et al. (2019) identified several defenses against insider threats. In terms of mitigation, means of deterrence, prevention, information camouflage/disinformation, and access controls were suggested. Anomaly and misuse detection systems were also identified. Additionally, the use of decoys and “honeypots” can aid in the identification of an insider threat (Homoliak et al. 2019). Further, zero trust architectures may be appropriate for situations with very low trust (Collier and Sarkis 2021). A zero trust architecture ensures that all organizational resources are accessed securely through authorization and authentication protocols, adopts a “least privilege” access control strategy, and inspects and logs all network traffic (Kindervag 2010). Shared responsibility architectures are another proposed approach to security that emphasizes collaborative, multi‐layered defenses between stakeholders across a system's lifecycle. Crowther (2024) provides a detailed comparison and synthesis of zero trust and shared responsibility philosophies.

Professionally, Thekdi and Aven (2023) have suggested that there is a strong argument for the risk analysis community to adopt certification and licensing requirements for risk professionals. Such licensure may require ongoing training, as is common in other disciplines, that promote a familiarity and strengthened understanding of fundamental risk science topics (Aven and Thekdi 2022). They further suggest adopting a professional code of conduct, based on the pillars of integrity, ethics, and professionalism (Aven and Thekdi 2022). Aligning and embedding these professional attitudes within an organization's risk culture (Harner 2010) could strengthen the overall risk posture of the organization and discourage malevolent risk actors.

Aven (2023) described the concept of “risk literacy” as the ability to understand and evaluate risk to make appropriate decisions. A risk‐literate individual is one who can properly understand and evaluate risks and use information about risk and uncertainty to make decisions. A malevolent risk manager may use their position to provide misleading risk characterization and risk communication, leading to others possessing an incorrect understanding of the risks involved. Strengthened risk literacy could serve as a corrective against misleading risk information, and continued educational efforts by professionals in the risk science and risk management fields are needed.

6.2. Behavioral Analysis Mechanisms to Detect Malevolent Risk Managers

Detection of malevolent risk managers and minimizing their negative impact on organizations’ functions, desired outcomes, and future governance is a challenging issue requiring a proactive approach introduced in a timely manner. Behavioral analysis (BA) provides an effective solution for uncovering and identifying malicious acts.

BA explores numerous aspects of human behavior and is applicable in areas such as detection of hostile individuals and spotting deceitful attitudes and malevolent intent. Although it is considered a psychological term, its prevalence is increasingly emerging not only in social sciences but also in security and defense, critical infrastructure protection (U.S. Department of Homeland Security 2024), corporate areas, and detection of suspicious software activity (Maniriho et al. 2022).

BA can be introduced as a precautionary instrument within an organization's governance through a four‐step model (illustrated in Figure 4), generated for the purpose of the current article. Depending on the needs, risks, and threats of a particular organization, the framework could be adjusted. It is not a universal BA model; it is more likely a possible approach in dealing with malevolent risk managers.

1. Initial behavioral assessment is required during the recruitment process, a crucial phase in malevolence prevention. It aims at identifying in advance the deceitful and hostile nature of a candidate and uncovering behavioral red flags concerning attitude traits and malevolent tendencies. The assessment is achieved in the selection process through interview observation, personality tests, reactions towards hypothetical scenarios, solving case studies, etc. Reported details by a former employer might facilitate the assessment, as well as internal/external HR personnel, professional BA experts, consultancy agencies, and individuals specialized in organizational psychology and lie detection. The initial assessment ought to provide the benefit of the doubt, not to hamper the recruitment process. Over‐vigilance may discourage candidates from applying and hinder enrollment.

2. Periodic scale evaluation should be performed of the risk manager's professional culture, loyalty, and potential breaches of authority. This is performed by HR specialists or BA experts regarding a predetermined eligibility criterion, based on a list of behavioral indicators. The criterion sets an acceptable sum of assessed amounts. For example, if a list consists of 15 indicators with a 6‐scale assessment (where 0 is not exhibited behavior and 6 is strongly observed behavior), the lowest sum is 0, while the highest is 90. Hence, if the criterion is 25 and the risk manager exhibits a higher number, then there might be an intent for malevolence. The following are examples of behavioral indicators appropriate for evaluation:

   • Insubordination.
   • Not following hierarchy and levels of approval.
   • Not working under the set time frame and trying to prolong the process.
   • Lack of timely response or no response at all.
   • Creation of tension between coworkers.
   • Not seeking cooperation and assistance.
   • No coordination approach, intending to work alone.
   • Incompliance with existing internal policies.
   • Imposing corporate changes and failing to justify them.
   • Worsened state of the assigned issue.
   • Unclear reporting of processes and performed work.
   • Unclear reporting of incidents.
   • Hindering the sharing of valuable information.
   • Inability to quickly inform decision‐makers of occurred issues or incidents.
   • Unwillingness to take responsibility for caused unfavorable outcomes.
   • Frequent excuses and blaming others.
   • Defensive tone, prone to verbal aggression, etc.

FIGURE 4.

Behavioral analysis model for detection of malevolence.

The list of indicators could be adjusted towards the different work position and required level of trust towards the evaluated person.

• 3. Financial magnitude assessment of the risk manager's performance (both positive and negative) may be a part of a regular financial audit or a periodic assessment when financial responsibilities are entrusted to the individual. It is based on the assumption that a malevolent risk manager's action will inevitably lead to financial losses. In practice, though, that is not the case. Initially the risk manager's performance might raise no suspicion or even lead to a positive financial outcome, fostering certainty and praise. Eventually, when the trust is high, his/her actions may become malevolent, staying spotless for a certain period of time. Instead, a more effective approach could be conducted. Firstly, observe whether there is a change in pattern in dealing with the entrusted risk management responsibilities, including unexplainable actions out of the ordinary or atypical shifts in performance, regardless of whether the consequences have a positive or negative outcome. Secondly, analyze the potential for risk metric poisoning in order to shift risk outcomes in a different direction or to conceal true intentions. Any undertaken initiatives to apply new metrics or withdraw existing ones without providing reason and receiving approval should be treated as a red flag. Thirdly, evaluate alternatives in a monetary manner, when applicable. It is alarming when financial indicators show that a different approach could lead to a positive, instead of a negative, fiscal outcome. The goal is raising awareness, leading to additional investigations, aiming at verifying or rejecting potential malevolence.
• 4. Whistleblowing system for reporting suspicious individuals and abnormal activities. In order for this step to be effective, introduction of thematic trainings and seminars is required. It will enhance not only the detection process but also hinder malevolent individuals from acting in an unfavorable manner, knowing they might be spotted and reported. An ethical code is essential for the whistleblowing system. It ensures integrity by regulating professional behavior. An unbiased approach is a must from both whistleblowers and those verifying reported cases.

7. Conclusions

Risk management countermeasures are rarely silver bullets, and with them come additional costs and implementation challenges. Just like the layers of Swiss cheese in Reason's model of organizational accidents (Reason 1997), a malevolent risk manager may still find a way to defeat each of the layers of defense, especially if the risk manager has an intimate understanding of, and control over, the defenses themselves. Further research is needed on devising effective systems of countermeasures to thwart malevolent risk managers.

Another area of further study is that of the behavior of the whistleblower. While some have categorized whistleblowers as a special type of insider threat, they are usually motivated by loyalty to society or nation, rather than malevolence (Homoliak et al. 2019). However, they may represent a threat from an organization's perspective, since whistleblowers may break a formal policy to bring about a correction to the organization's perceived wrongdoing (Homoliak et al. 2019; Smaili and Arroyo 2019) or report wrongful accusations (both intentional or unintentional). Around 39% of fraud cases are reported by whistleblowers, for example (Smaili and Arroyo 2019). Protections should be in place to ensure that whistleblowers or other actors with altruistic motives (e.g., creatively risk‐taking to achieve beneficial outcomes) are not misidentified as malevolent.

Organizations, governments, and society at large depend upon the work of risk professionals. A rogue risk manager acting out of malevolence instead of in line with accepted professional norms and codes of conduct has the potential to cause immense losses. However, little to no attention has been given to the risk posed by the risk managers themselves, especially when they covertly manipulate the risk management process and metrics used to support decision‐making. To strengthen the effectiveness of risk management across the multitude of contexts in which it is practiced, additional research into this problem is suggested, including a detailed investigation into the links between this topic and risk study quality.

Conflicts of Interest

The author declare no conflicts of interest.