The warning is rarely invisible. More often, it is seen, mentioned, logged or quietly worked around, then treated as something for another day. That is why teams miss warning signs: not because people are careless, but because operational pressure, familiar problems and unclear ownership change what people are prepared to notice and act upon.

In protective security, crisis management and operational risk, the serious failure is often preceded by smaller signals. A door that does not secure properly. A contractor whose behaviour causes repeated unease. An access control fault that has become routine. Conflicting information during an event. A team member who raises a concern but receives no useful response.

None of these signals proves that an incident will occur. That is the point. Judgement is required before certainty arrives. Teams that wait for proof often discover that the opportunity to reduce risk has already passed.

Why teams miss warning signs under pressure

The most common explanation is complacency. It is not wrong, but it is incomplete. Complacency implies that people simply do not care. In many organisations, people care a great deal. They are also busy, short of time, managing competing demands and trying to keep an operation moving.

A warning sign competes with immediate work. The queue needs managing. The site needs opening. The client expects a decision. Staff absence has created a gap. A technical fault has already consumed the morning. In that environment, a weak signal can feel less urgent than the task directly in front of the team.

This is where normalisation takes hold. A problem occurs once and is corrected informally. It occurs again and staff adapt. By the third or fourth occasion, the workaround becomes part of the operating routine. People stop describing it as a weakness because they have learned to function around it.

That adaptation can look like resilience. It is often the opposite. The organisation is not becoming more capable. It is becoming more dependent on individuals noticing, remembering and compensating. When the experienced person is absent, tired or under pressure, the gap is exposed.

A venue may have a recurring issue with visitor management at a busy entrance. Staff know how to handle it through personal judgement, but the process is not clear, consistently applied or tested. On a normal day, it appears to work. During a surge in demand, a staff changeover or a confusing incident, the informal fix unravels. The warning was not the later failure. The warning was the routine reliance on improvisation.

Familiarity makes weak conditions look acceptable

Teams are particularly poor at detecting gradual decline. A sudden failure attracts attention because it breaks expectation. Small deterioration does not. Standards drift one practical compromise at a time.

This happens in physical security, but it is equally visible in leadership and decision making. Briefings become shorter because everyone is experienced. Checks are assumed rather than confirmed. Incident reports become vague because the same issues are thought to be already understood. Concerns are discussed verbally but never converted into actions with an owner and a deadline.

The danger is not that every detail must be escalated. Over-reporting can create noise and drain attention from material risks. The issue is whether the team can distinguish a minor inconvenience from a condition that weakens its margin for error.

Good teams ask a more useful question than, “Has anything happened?” They ask, “What has changed, what are we relying on, and what would make this harder to manage today?” That moves attention from historic outcomes to current capability.

Hierarchy can silence the information people need

Warning signs often reach the team, but do not travel upwards in a useful form. Frontline staff may see a pattern that managers cannot see from reports. Managers may understand a wider threat picture that has not been translated into practical expectations for the shift. Both groups can believe they are communicating while the important detail is lost.

People also judge whether speaking up is worth the effort. If previous concerns produced no feedback, no visible decision or a defensive reaction, reporting becomes a compliance exercise. The report is submitted because it has to be, not because anyone expects change.

This is not solved by telling staff to be more confident. Leaders have to make challenge operationally safe. That means responding to a concern with proportionate curiosity, even when the answer is that no immediate action is required. A clear explanation builds trust. Silence teaches people that raising issues is futile.

The most effective leaders also avoid treating a challenge as criticism. A team member pointing out that a procedure cannot be completed in the available time may be identifying a design fault, not resisting the task. If every concern is interpreted as poor attitude, the organisation loses one of its best sources of early warning.

Reports are evidence, not a substitute for judgement

Dashboards, incident logs and assurance returns have value, but they can create false confidence. A report only reflects what people recognised, recorded and selected for escalation. A low number of reported concerns might mean risk is well controlled. It might also mean staff have stopped reporting familiar issues, do not know what matters or believe nothing will happen.

Numbers need context. A security manager should be able to ask those closest to the operation what is becoming normal that should not be normal. This question is simple, but it often reveals recurring faults, confusing responsibilities and pressure points that formal reporting has failed to capture.

Turning observation into action

Teams need a disciplined way to turn a concern into a decision. This does not require a complex new process. It requires clarity about what gets noticed, who decides, what action is expected and how the outcome is checked.

Start with recurring conditions, not only individual events. A single access anomaly may be resolved quickly. Repeated anomalies at the same time, location or handover point deserve a different response. Patterns indicate that the control, the environment or the workload may be contributing to the problem.

Then examine the work as it is actually done. Written procedures matter, but they do not show the full reality of a pressured shift. Speak to the people carrying out the task. Observe the handovers. Test whether required checks can genuinely be completed when demand rises. If a process only works in ideal conditions, it is not an effective control.

Assign ownership carefully. “The team will monitor it” is not ownership. It usually means nobody has a defined responsibility to decide whether the issue has improved, worsened or simply disappeared from view. A named person needs authority, a timescale and a clear threshold for further escalation.

Finally, close the loop. Tell the people who raised the issue what was found and what changed. Where no change is made, explain why. This is more than good communication. It improves the quality of future reporting because staff learn what information is useful and see that professional judgement is taken seriously.

Build capability before the next pressured moment

Training often concentrates on procedures, legal duties or individual awareness. These are necessary, but awareness without judgement can produce hesitation, unnecessary escalation or poor prioritisation. People need opportunities to practise recognising weak signals, discussing uncertainty and making proportionate decisions with incomplete information.

This is especially relevant for organisations preparing for Martyn’s Law. Documentation and training records may demonstrate that activity has taken place. They do not, by themselves, demonstrate that people can identify a developing concern, communicate it clearly and coordinate an effective response. Capability is shown in behaviour under realistic pressure.

Scenario-based discussion can be useful when it focuses on decisions rather than theatrical detail. Ask what information would change the response, who needs to know, what can be checked safely and when the team should stop treating an issue as routine. Review real near misses with the same seriousness as more visible incidents. They are often a better source of learning because they show where controls held and where people had to compensate.

Mildot Group’s approach to behavioural risk and capability assessment is built around this principle: theory only reduces risk when it changes what people notice, decide and do.

The uncomfortable truth is that teams can become very efficient at living with risk. They create workarounds, protect output and avoid disruption. Those qualities are valuable until they hide a weakening system. The better question for any leader is not whether the operation is coping. It is what the operation is having to compensate for, and how long that remains acceptable.