By Bob Cummins, the Founder and CEO at Sodak

Part 1: Risk is Multiplied, Not Contained

When we talk about risk, we often talk about it as though it sits neatly within the individual. One worker, one action, one outcome. But that’s not how risk actually behaves. Risk multiplies. It radiates outward.

Think about a worker at home, tinkering in their garage, doing DIY without eye protection. If something goes wrong, who suffers? Mainly the individual. The ripple is small – they may lose a day’s work, their family might take on the burden of care, and perhaps their employer is short a worker for a short time. Still, the circle of consequence is tight.

Now, move that worker onto a site with a gang of ten. The same act – working without protection – carries a completely different set of consequences. If they’re injured, the gang stops work immediately. That’s lost time, a dent in productivity, and an emotional impact on colleagues who’ve just watched their mate get hurt. The supervisor is pulled away from leading the work to deal with paperwork, investigations, and the fallout.

At the level of a contracts manager, that one injury may delay a project. Deadlines slip, the client is frustrated, penalties could be triggered. And if that client happens to be a repeat customer, their trust in the company weakens.

Go up another level: the subsidiary director. They now have another incident on their books. Their record of performance against safety KPIs is dented, their ability to win new contracts is weakened. They might face difficult questions in monthly reviews or from the board.

And if the company is part of a wider group? A single serious incident doesn’t just stay with the subsidiary. It lands on the group’s annual report. It can attract regulator attention, unsettle investors, and, in the case of listed companies, knock share price. Clients don’t usually make a neat distinction between one part of a group and another. If one brand in the group falters, confidence in the group as a whole suffers.

So risk doesn’t stay in a box. It doesn’t stop neatly at the level where it happened. The bigger the organisation, the further the ripple runs.

But it’s not only big accidents that ripple outward. So does the tolerance of small ones. A worker wearing glasses pushed up onto their helmet instead of over their eyes, a guard left off a machine, a lanyard unclipped “just for a moment.” These don’t trigger headlines. They often don’t cause immediate harm. But tolerated month after month, they quietly build a culture that says “this is normal.”

For a small contractor of five people, the cost of such tolerance is contained: it may increase the odds of one person getting hurt, but the fallout is local. In a group of 10,000 employees, those same acts multiplied across hundreds of sites become systemic risk. When leaders shrug at “minor” breaches in monthly reviews, they signal that breaches don’t matter. And when a serious incident does happen, they’ve already created the conditions for it.

In other words: as organisations grow, the multiplier on risk grows with them. What once looked like a personal decision now looks like an organisational vulnerability. What once was tolerable in a five-person outfit becomes catastrophic in a multi-subsidiary group.

This is the first lesson: risk is multiplied, not contained – by scale, and by tolerance.