Expanding the discussion on internal management of risk communication: A critique of the current risk communication literature

Introduction

Risk may be defined as a potential danger or threat to people or the things they value (McComas, 2006). Within the definition of risk is an element of uncertainty—the probability that a risk might occur and its consequential reward or severity. Risk taking can be positive, such as the delivery of a healthy child or in winning the lottery, and it can be negative, such as a disease diagnosis due to poor lifestyle choices or losing money while gambling. As such, risk is likely and inherently a harm/benefit equation through which individuals and organizations engage in a harm/benefit analysis in risk decision-making. For instance, migrating to (through) the southern U.S. border is risky, but potentially beneficial. It is risk management.

Given this description, a risk event often yields predictable consequences (whether positive or negative), though its magnitude and victim(s) may be unpredictable. “Crisis” is a related but distinct concept: a crisis is the manifestation of risk—a predictable event with unpredictable timing and consequences (Health and Palenchar, 2009). Therefore, risk management and risk communication are concerned primarily with mitigating predictable events (e.g. it is predictable that transporting chemicals may result in a leak or spill during transport) before they manifest into crises with unpredictable timing and consequences (e.g. in the case of a chemical spill, how much was spilled? Can the spill be contained? To what extent are people and wildlife harmed now or in the future?).

Successful risk communication requires that infrastructures (at relevant scale) bring participants together to listen to and challenge each other to break down matters of probability and uncertainty, and to ask what is “safe” and when is “safe” safe enough, which are fundamental to the management of risk (Heath, 2006). Given the many sources of risk that may emerge in society, organizations frequently engage (proactively or reactively) in management of risks through risk analysis, governance, and communication about risks (Heath and McComas, 2015). In addition, internal risk management entails many components including technical, engineering, financial, and other resource considerations; safety is also inherent to sound management and operational practices, as is risk communication. Despite the advances in scholarship, internal corporate governance related to risk communication planning and risk manifestation mitigation is seemingly missing from the scholarly conversation. In addition, considerations for internal risk communication and those vulnerable within an organization are also minimally represented in the current body of research. Thus, a discussion around decentralizing risk communication is also necessary. Specifically, this paper addresses the challenges and opportunities of centralization and decentralization in risk communication.

Therefore, the purpose of this paper is to expand discussion of this infrastructural approach to risk communication by focusing specially on internal management of risk communication, and to better explain and conceptualize internal management of risk communication. This paper positions the infrastructural approach as a “pre-crisis” internal paradigm, which assumes that even if a crisis occurs, but is not inevitable, the response will be better and more strategic. Some of the risk communication literature is too broad in terms of recognizing the nuance of the locus of risk, and the role(s) of stakeholders and communicators, which limit understanding that could extend and enrich current risk communication literature. In doing so, this paper hopes to lead by example in examining risk communication, which is an opportunity to shift the focus of public relations scholarship from the ubiquitous discussion of crisis to risk event mitigation because successful risk communication governance and planning results in the mitigation of crises. In other words, no corporate apology is necessary if the risk, like developing and implementing protocols for mitigating a chemical leak or preventing plant explosion, is successfully managed. More often enough, communication regarding crises is about how risk management failed.

Several issues will be discussed in the following paper. First, how does an organization identify the locus of risk as an external or internal threat, both of which could lead to crises? Second, who in the organization is responsible for the management of risk communication, and what stakeholders are missing from the current risk literature? Third, what are the implications of decentralizing risk communication in an organization? We conclude with opportunities for future research that will help build upon the issues raised in this paper.

Infrastructural approach to risk communication

To begin, an overview of risk communication and the infrastructural approach is warranted. Risk communication in the U.S. began in response to private and public sector organizations’ failings to comprehend and demonstrate acceptable standards for corporate social responsibility by failing to adequately control risks associated with their business activities, which led to crises, including chemical spills during the 1980s; consequently, legislation was passed to mitigate the probability and severity of such manufacturing accidents in the future (Palenchar and Heath, 2007). McComas (2006) defined risk communication as “an iterative exchange of information among individuals, groups, and institutions related to the assessment, characterization, and management of risk” (p. 76). As she and Slovic note, “inherent to the understanding of risk, and the practice of risk communication, is an awareness that risk encompasses both objective and subjective qualities and that risk judgments are, to some degree, a by-product of social, cultural, and psychological influences” (McComas, 2006: 76). Of interest to this paper is the role of communication in internal risk management practices. Specifically, this paper is focused on the concept of “internal” as a way of examining the selection and arrangement of how risk communication is organized and practiced in the organization—from a corporate governance perspective and from the perspective of where risks may manifest.

The risk communication literature spans across many sub-disciplines, including studies of public relations, health and environmental risks. The literature to date has focused on important topics largely aimed at understanding how organizations and publics co-exist in a risk society, including examinations and debates about fair and ethical processes for organizations to authentically engage publics in risk communication and decision-making, examinations of risk publics external to organizations (e.g. their predispositions, perceptions, and other characteristics), and the characteristics, antecedents and outcomes of risk messaging and risk communication between organizations and publics (Greenberg et al., 2012; McComas, 2006; Palenchar and Heath, 2007). Largely missing from this literature is an examination of how internal corporate governance related to risk communication planning might facilitate risk manifestation mitigation—a particular focus on the organizational structures for risk communication, considerations for internal risk communication, and broadening the scope of risk to include those vulnerabilities that may exist within organizations.

An infrastructural approach to risk communication, as explicated by Palenchar and Lemon (2018), presumes the need for organizations to facilitate the mechanisms and spaces where discourse about risk occurs and the collective outcomes that are achieved. This approach to risk presumes and argues that how well risk is managed and communicated to and by depends on the quality of the relevant infrastructure(s). Palenchar and Lemon (2018) note that:

Ideally, risk communication, through its structures and functions, endeavors to create and maintain a management and communicative infrastructure. . .that assists people to share and to understand ideas before making a choice. . .[and] position risk generating organizations. . .toward engagement. . .and effective dialogue [with risk bearers] regarding issues, products, or services that have the potential to generate acceptable or unacceptable levels of risk, based on community standards, culture, and experiences (p. 420).

Similar to research that suggests deliberation is important, particularly for gaining satisfaction with solutions to mitigating or adapting to risks (Rowan et al., 2009), the infrastructural approach is heavily oriented toward deliberation quality; its emphasis is on the context where discursive deliberation occurs and the quality of the infrastructure to support high quality, polyvocal deliberation. It is inherently a rhetorical model of competing perspectives, but ultimately capable of concurrence, if not consensus. It is fact and reasoning-based but is not devoid of subjectivity.

Paradigmatically, infrastructures presume that the workplace is safe, and risk is managed and communicated to achieve internal and external publics’ safety. Although the approach is focused on deliberation quality, it too is focused on the procedural protocols that employees follow at the direction of management and the culture of workplace practices. For example, regardless of the extent to which deliberation contributes to an organization’s protocols and how often such protocols are revisited, the requirement to follow them is non-negotiable in order to foster safe operations. Another dimension is planning, which can prevent the manifestation of risk; this is the focus of the current manuscript: to better articulate how corporate planning and governance might situate and broaden an organization’s approach to managing risk communication.

Rethinking the locus of risk

Risks can be found in all aspects of everyday life. Inherent to society is the “collective management of risk,” which can range from accidents to disease to death and even childbearing (Heath and McComas, 2015: 121). A risk society assumes that everyone involved has a role to play in the management of risk, including the negotiation of resources to mitigate or adapt to various risks (Palenchar and Heath, 2007). Therefore, every member of a fully functioning society has some role in risk management and potential communication about it. Determining the role one might play in such scenarios is dependent upon the locus of risk.

The risk literature is vast. For example, two leading risk journals include Risk Analysis and Journal of Risk Research. These scholarly journals publish findings from various disciplinary and methodological approaches. Risk Analysis publishes research findings on topics including human health and safety risks; microbial risks; ecological risks; engineering; mathematical modeling; risk characterization; risk management and decision-making; risk perception, acceptability and ethics; laws and regulatory policy; and risk communication. Journal of Risk Research’s aims and scope note that it publishes research findings about the relationships between risk, decision-making and society; how to promote better risk management practices; and regarding the development of risk management methodologies in the social, physical and health sciences, engineering, public policy and administration, and media and communication studies. And as demonstrated in the Handbook of Risk and Crisis Communication (Heath and O’Hair, 2009), there also are many different paradigms, perspectives, approaches, contexts, and considerations when studying and practicing risk and crisis communication.

This paper sees risk as an inherent to public relations. When taking inventory of the risk communication literature in public relations, it seems as though the locus of risk is narrowly defined to external manifestations of risk (i.e. crises that affect publics external to an organization) that are disastrous in nature and minimize other situations that may be less prominent—though no less essential—to comprehensive and effective risk communication planning and event mitigation. As a communication sub-discipline, the public relations literature mostly discusses risks such as hazardous waste or environmental problems as the focus for risk communication with limited to no consideration of internal governance of risk communication and comprehensive planning for risk manifestation mitigation (Palenchar and Heath, 2007).

Related literature on internal communication for crisis management, which should include risk communication (if following best practices; Seeger, 2006), can provide some guidance. Although risk communication researchers have noted the importance of a strategic approach to risk communication (Rowan, 1991, 1994), case study findings suggest a limited strategic orientation in communication professionals’ role during internal crisis communication (Heide and Simonsson, 2014); communication professionals’ role typically focused on distributing information through internal company channels, and they were only called upon after a crisis had occurred. As these findings imply, a reactive, tactical communication function that responds to risk manifestations is problematic given the body of literature that demonstrates public relations is best used as a proactive function that informs organizations’ decision-making and actions. From a risk communication perspective, perhaps examination of such organizations’ corporate governance structures would reveal basic internal risk entry points that future researchers and practitioners should consider for risk mitigation; for example, positioning public relations and/or risk communication as a strategic function that plans for a range of internal and external risks may be warranted to stave off crises.

Similarly, interview research findings comparing management and employee perceptions in the aftermath of a scandal indicated that both groups perceived crisis communication efforts as successfully informing the public and the media, but reported discrepancies regarding internal crisis communication—employees felt that they had not received adequate information and that the scandal was perhaps a consequence of organizational culture whereas management did not perceive the crisis as a consequence of a culture problem (Strandberg and Vigsø, 2016). Again, this research points to potential conflict between management and employees—another internal entry point for risk to manifest. Indeed, conflict management is a key part of risk manifestation mitigation planning and communication. Conflict occurs when “groups direct their efforts against each other, devising actions and communication that directly or verbally attack the other group” (Wilcox et al., 2015); for example, labor unions may protest the treatment of workers and organize worker strikes until concessions are met. This is another area of focus where research and practice should expand consideration of what aspects of an organization may be at risk—expanding the locus of risk.

The research to date suggests that organizational structures, cultures and norms should invite and reinforce communication and collaboration around safety and risk mitigation behaviors to avoid manifestations of risk, making organizational structures and cultural norms relevant for mitigation measures and communication protocols. Specifically, survey research findings suggest employees’ individual-level factors and perceptions of organizational risk information-seeking processes are better predictors of employees’ risk information-seeking behaviors, safety self-efficacy, and risk knowledge than individual or organizational factors alone (Ford and Stephens, 2018). A systematic review examining the effectiveness of emergency risk communication training found that, in general, training should emphasize collaboration across organizations, training in working with media, and a focus on strategic message design (i.e. considering specific audience needs), though the authors mentioned the need for more robust research in this domain to develop stronger evidence-based guidance (Miller et al., 2017). In attempts to mitigate risks and avert crises, research findings suggest that engaging in participatory communication practices (e.g. sending and receiving information; organizational openness; foregrounding training) establishes and promotes collective mindfulness among workers and reduces organizational risk (Novak and Sellnow, 2009).

Public relations scholarship may solely focus on public-facing organizational risk manifestations, like security breaches, CEO credibility issues, or social media crises, but the process of engaging internal stakeholders as a best practice often is minimized or forgotten. For example, Liu et al. (2018) found that when hospitals are experiencing a crisis, successful navigation of the crisis is dependent upon effective communication with internal stakeholders like nurses, doctors, and administrators. The inability to effectively communicate with internal stakeholders can lead to additional internal problems such as increase of risk to employees or patient care delays, which impacts the safety of both internal and external stakeholders (Liu et al., 2018).

Therefore, we recommend rethinking the locus of risk and encouraging a more robust understanding of where, how, and why internal risk events may occur. Just as the locus of crises may vary and has become fuzzier with ever-changing, complex corporate environments (Lee et al., 2018), the locus of risk is plagued with the same issues, highlighting the complex nature of managing risk communication both internally and externally. Risk communication scholars should strive to fully investigate risk entry points in organizations and the complexities of the locus of risk—giving particular attention to informing and understanding theory and best practices for internal risk communication. In so doing, scholars would fill an important gap in knowledge considering the vast literature on risk and would facilitate more work on (internal) risk event mitigation. The risk communication literature could benefit from more research-based suggestions from varying contexts that provide guidelines to navigate risk. In doing so, the locus of risk becomes considered more broadly and more strategically.

Given the complexity of the potential emergence of risk in today’s society, a conversation about who is responsible for managing such complicated matters is discussed next.

Rethinking who manages risk communication

For risk communication to be effective, the message source needs to be trusted (Leiss, 1996), and in most cases, the message source is an organization. However, what happens when the primary source, the organization, is a complex system, where the boundaries are permeable, and the environment is dynamic and fluid in nature (Gilpin and Murphy, 2010)? How does the organization build trust with internal and external stakeholders when the organization is an unidentifiable source? One example to illustrate such complexity would be a government contractor (c.f. cite blinded for review). Government contractors are independently operated LLCs, formed by member expert companies, where the work is fluid and risk is inherent. These organizations are separate from the government but still closely linked as a governmental department is the “client.” The work is highly sensitive and oftentimes top-secret, which means risk is inherent. Unlike other industries, employees of government contractors are career employees and very loyal to the sites (not the organizations) in which they work. This loyalty to the site versus an employer is due to the fact that major change is inherent every five to 10 years, in which changes to leadership, goals and objectives, employee benefit packages, and even daily roles may occur, sometimes overnight.

Risk communication literature discusses and encourages the role of the organization in managing risk and treats the organization as a monolithic entity (Johnson and Chess, 2006). At a cursory view, the organization is tasked with establishing systems and processes that minimize risk and develop risk communication in the event a risk manifests (Chess et al., 1992). However, the role of the organization in the management of risk and communication about risk is much more complex (Chess et al., 1992), yet there is limited research on the organizational system and risk communication (Chess, 2003). Scholars should consider complex, high risk organizations like government contractors and how such entities can build trust in a fluid environment.

Rethinking communication decentralization

Scholars examining the role of risk governance, management, and communication in organizations have considered whether or not such responsibilities should be centralized or decentralized in organizational structure. Some companies have empowered employees to unquestionably say something if necessary, and even to stop processes. The concept of decentralization is complex but presumes a strategic decision-making and action-taking model that arises from core procedures that only become decentralized in operation. In support of decentralizing the risk communication function, for example, Chess et al. (1992) proposed that organizational personnel who have risk management responsibilities should also maintain and share responsibility of risk communication efforts. The authors argued that the addition of dedicated communication personnel in an organizational hierarchy “has the potential to buffer managers from dealing with community pressures by defining the job of communications staff as ‘handling’ outside constituencies” (p. 435); although, they acknowledge that such a diffusion of responsibility might increase the potential for the communication function to become overlooked by managers or may produce a scenario where there is no accountability or responsibility for the communication function. Using the case study of Sybron Chemicals, Inc., the authors demonstrated that the organization avoided these potential issues by hiring an independent public relations consultant to provide community relations counsel, rather than relying on in-house community relations staff (Chess et al., 1992).

As previously mentioned, deliberation and structures that enable such are imperative for effective risk communication planning and risk manifestation mitigation as is a strategic orientation. And perhaps decentralization of the risk communication function is best in an ideal world. However, in some organizations—such as smaller organizations that employ one or two employees—the risk communication function is decentralized by necessity (i.e. one or two employees are responsible for risk communication and every other function at the company) and perhaps deprioritized out of necessity (e.g. due to competing obligations, such as operations or accounting, risk communication may not be a priority). That is, risk communication planning and risk manifestation mitigation may not receive the necessary attention because other demanding, salient obligations take precedence. Our aim here is not to debate the merits of any (de)centralization argument, nor is it to advocate for or against decentralization of the risk communication function, but rather—in building from the work of Chess et al. (1992)—to encourage future research that examines the conditions in which decentralization or centralization of risk communication may be more effective in theory and in practice.

For example, one might surmise that potential pitfalls of the approach to decentralize outlined by Chess et al. (1992) may include a lack of dedicated, undivided attention to the organization’s risk communication needs by a public relations consultant or agency (who often juggle the needs of multiple clients), and perhaps a steeper learning curve or lack of specialized knowledge about the organization and/or industry in which the organization operates. This could hinder a nuanced understanding or appreciation of the organization’s unique risk circumstances. A related consideration, and a key premise of this manuscript, is that risk communication is dually important with both external and internal publics; thus, a lack of comprehensive risk communication planning and programming, including internal risk communication, may be a missed opportunity (e.g. for team-building, employee morale, and risk monitoring) or a source for future problems (e.g. employee strikes).

Although a naïve assumption may be that any personnel (even those without explicit training in risk communication or public relations) may be able to handle the communication function along with other organizational responsibilities, such policy may (at least implicitly) devalue the legitimacy of the modern public relations profession, which is guided by evidence-based theory and a body of scholarly literature, including research that seeks to understand and inform communication strategies necessary for engagement with and successful risk communication of endeavors that target a variety of stakeholders (Taylor and Kent, 2016). This is not to say that only public relations practitioners or related professionals should be the only ones to practice or take ownership of risk communication in an organization—but this is to say that if risk communication planning and risk manifestation mitigation are to take a proactive strategic orientation in an organization, public relations and/or risk communication expertise in some form (e.g. in-house; consultant; training) should inform how risk communication structures fit in corporate governance and how risk communication is practiced to ensure it is prioritized, practiced with accountability, and able to be evaluated and adjusted in the event objectives are not met. This is particularly important to consider as some research suggests that decentralization of the risk communication function may not be the ideal practice in all situations (VanDyke and King, 2018; Zuidema and de Roo, 2015).

In describing (de)centralization of risk governance at the governmental level, Zuidema and de Roo (2015) discuss the rationale and intentions for decentralization:

The idea is that local authorities are in a better position to engage in bargaining or collaborative processes with local stakeholders and civil organizations. In addition, familiarity with local circumstances and interests helps local parties developing more integrated policies that are tailored to the local situation. Hence, local authorities are assumed important players in helping governance respond to the complexities of our twenty-first century societies. (p. 60)

They discuss that many scholars note that decentralization is frequently pursued without consideration of its potential or probable outcomes, such as lower levels of local performance, and urge that “even if we pursue decentralization to develop more dynamic policy approaches that are tailored to complex local circumstances, central policies and regulations [should] remain to play a key role” (Zuidema and de Roo, 2015: 60).

Central policies and regulations, including accountability and responsibility, should play a key role in how organizations identify, discuss, plan for, and manage risk. From this perspective, risk governance (e.g. who decides what risk is “safe” and “safe enough”) may be viewed as a bridging concept between risk management and communication. Risk management, for instance, is the development of safety controls and procedures that are implemented, monitored, and updated. Internal risk communication is informed and moralized persuasion to increase internal risk management vigilance and compliance with risk mitigation procedures. Risk communication and risk management are a complex blend of systems that rely on deliberation to cultivate throughput and produce successful outputs (e.g. decisions; policies). However, as Heath and McComas (2015) noted, pushing the responsibility for risk governance onto individual organizations or agencies “can, and often does, fail to ask in whose interests is control brought to bear or even possible regarding certain risks related to their management and decisions about who benefits and loses in the context of each risk” (p. 118). Successful risk governance requires sound infrastructural and interpretive mechanisms to analyze competing interests and to promote the need for collective self-efficacy and legitimacy as fundamental to achieving a fully functioning organization and society (Heath and McComas, 2015). Dialogues are no better or no worse than the quality of infrastructures in place to support risk decision-making and behaviors.

Based on prior research and anecdotal evidence, we see at least two factors that demonstrate a need for future research to explore the success of (de)centralization of the risk communication function in organizations, including (a lack of) resources (e.g. time, money, expertise) and (a lack of) appropriate training and/or the appropriate skillset.

Moving forward

We hope that the discussion above spurs risk communication scholars to consider the arguments to advance the current body of risk communication scholarship. Specifically, we hope risk communication scholars broaden the scope of understanding regarding the locus of risk in addition to developing research-based recommendations from varying contexts to develop specific guidelines to navigate those risks. In addition, we challenge scholars to consider the complexity that underpins many organizations as the message source, especially complex organizations, and how such entities build trust. In doing so, scholarship would take into consideration alternative messages sources like internal publics. Last, we suggest an examination of the boundaries under which the (de)centralization of the risk communication function may be ideal in theory and practice. All of these points are not to diminish previous risk communication scholarship, but rather to hone our understanding so the management of risk continues to enhance society as a whole. In doing so, we hope the discussion among scholars shifts from the heavy focus on crisis communication to risk manifestation mitigation, where research is primarily positioned to investigate the successful management of risk and subsequent communication to strive for the reduction of crises.

Given the above discussion, we have a few suggestions for moving scholarship forward. The first suggestion is to rethink and examine the internal management of risk in regard to the COVID-19 pandemic and the implication of such risk manifestation for internal stakeholders. Contexts like the meat packing industry or prisons would provide valuable insights given the burden of risk placed upon those internal stakeholders. Second, Pieczka (2018) and Lemon and Palenchar (2018) suggested that research should discover the contexts in which disengagement is present. One such suggestion would be to further explore the experience of the risk communication manager and how she or he may or may not experience disengagement, given the amount of work that is required with limited resources (Zuidema and de Roo, 2015). Such investigations would delve into the tensions that underpin disguised job duties (Rickard, 2011). This research stream would align with Erikkson ’s (2017) call to conduct risk communication research from more vantage points, including the risk communication manager. Future research should also consider what are the conditions for bottom-up risk management working compared to the conditions for top-down risk management? A one-size-fits-all approach limits the complex risk landscape and therefore, multiple approaches need to be further investigated and compared using various methodological approaches to extend understanding and inform both risk communication and management practices.