Eight Reasons to Get an External Review

How to know when it's time to bring in an outside perspective

Research across safety-critical industries, including outdoor and experiential programming, found that roughly 80% of a program's risk is introduced before anyone reaches the trailhead or steps into a canoe (Dallat et al., 2017). The remaining 20% happens in the field, like when a leader changes the route plan due to inclement weather, a guide swaps out a broken WhisperLite stove, or staff diligently monitor the group's morale and how they're getting along.

But, the context for these good decisions and actions in the field is set by organizational decisions and plans long before anyone shows up on day one. Upstream from field activities is the other 80%. Somebody wrote the curriculum and trained the field leader to read the weather. No-go policies for inclement weather and checklists for packing an extra stove were created before staff's prep days, and these protocols and habits were refined over years of reporting and incident learning.

Safety isn't determined solely at the field level, so a meaningful review shouldn't stop there, either. A good external review looks at the whole system. It considers the regulatory environment and industry standards, moves through risk governance, organizational planning, and program design, and follows how each of those influences staff judgment in the field and, ultimately, participant learning and safety.

The executive directors who commission external reviews tend to see risk management the same way, as part of running and growing a sustainable organization. Their reasons for a review reach well beyond the field. Eight come up again and again, and any one of them is enough to commission a review.

1. How does the program compare?

Are our incident rates normal? Is our training in line with the field? Do our policies match current standards? Benchmarking questions like these are what I hear most often when directors first reach out, and answering them is core review territory. A reviewer measures the program against the regulatory requirements, industry standards, and the current accepted norms and practices that apply to it, and formulates actionable recommendations to keep up or stay ahead of a constantly evolving industry. For organizations that don't fit neatly under one accrediting body and its list of standards, a review can help identify which standards make reasonable comparisons in the first place.

2. Practice and paperwork have drifted apart

Programs and staff's work changes season to season, and it's tough to keep up the documentation to match. At some point, it becomes hard to know which is the source of truth. Is it the written protocols that staff should follow? Or is it staff's social norms and routines that are appropriately safe and get the job done? Sometimes, manuals are written based on assumptions and circumstances that are no longer relevant, and new protocols are necessary to appropriately guide staff decisions. Other times, the protocols are still relevant and necessary, but something else is driving staff to work around them.

I once worked with a youth-serving nonprofit whose board instructed the executive director to commission a review. Somewhere in the process, I asked about their child protection program. The response was that they didn't have one. Of course, they did have one, but they didn't consider that all their normal work and practices were part of a larger strategy and commitment to protect youth from abuse and neglect. When someone showed up to simply ask questions, the org leaders were able to quickly reframe and clarify the purpose of their risk management program. We could then easily see all the good policies and practices they were doing, and the improvements were evident. The final result was that the staff, senior leaders, and board members are more clear about which risks they are addressing, and they are aligned in the next steps to build on decades of already good work.

3. A transition in leadership

New executive directors, heads of school, program directors, and risk managers inherit systems and context they didn't build. One new CEO told me she could see many areas that needed work and couldn't yet tell where to begin. She wanted a third-party opinion before directing resources at any of them. A review provides an incoming leader with an independent and objective assessment of the organization's risk management plan and outlines the priorities to act on first.

More simply, an external review is the easiest way to get oriented quickly and to get everyone pointed in the right direction.

4. Growth and organizational change

Consider a school that buys a new property to start an outdoor center, or a provider scaling their operations to handle more clients and more programs. Leadership can see the obvious to-dos, like preparing the facility and hiring a director, or hiring and training a ton of new staff to run new programs. Other questions are less obvious, and they involve the wider organization. Who approves the center's programs? Which of the organization’s existing policies neatly apply to the new property or activities, and what new policies are needed to support the new ventures? What about culture? Which aspects of our culture will help the new venture be reasonably safe and successful, and which traits do we need to be mindful of and attentive to?

New elements and scaling operations shouldn’t be tacked on or built in a silo. An accurate assessment of the current state of risk management informs the baseline and a thoughtful approach to a new build, and helps ensure complete organizational support and readiness for it.

5. Too many responsibilities rely on too few individuals

In nearly every review I am a part of, some essential part of safety, operations, or programming rests on one or two experienced people. These heroes act as the glue to keep things running smoothly and safely. Unfortunately, this scenario is all too common and is practically unavoidable in our small industry. But there is more organizations can do to reduce the reliance on a few heroes and strong staff members. After all, if they become injured or ill, or once they leave, you don’t want them to take all the institutional knowledge and know-how with them, and you don’t want to be left looking for a unicorn in the hiring pool to fill an unfillable hole.

An obvious preventative measure is to ask those people to write down everything they do and leave it on the desk for the next person to pick up and take it all in. But, speaking from experience, it’s never enough (nor is it fair to the new person). The heroes who keep the ship sailing forward are usually too close to their own work to see how the rest of the org relies on every aspect of their work. Moreover, they rarely have time, anyway. After all, they’re busy keeping the ship afloat!

A good review maps the dependencies and evaluates the risks they pose to safety and learning goals. Recommendations typically span the redistribution of responsibilities, clarity and foresight of operating and emergency plans, mentorship, updates to training curriculum, and various aspects of reporting and organizational learning. My analysis of the official Camp Mystic investigation shows how dependencies can contribute to tragedy, because nearly everything that night depended on a single devoted person.

6. Incidents and trends need explaining

Any time there is a new, unexplainable trend in behavior or unwanted outcomes, outside perspective should be called in. Internal investigators are a) busy, and b) disadvantaged when it comes to asking questions and connecting the dots between their own work, their peers’, and their bosses’ work. Sometimes, new trends aren’t specific to any one organization, but actually many organizations are experiencing something similar, or at least some shade of it.

Take, for example, the rise of behavioral concerns and psychosocial safety incidents after COVID. Everyone experienced it, and those who doubled down on tracking these situations and learning from them were the ones who were able to get a handle on this “new normal.” Outside perspective is helpful in naming and diagnosing issues, and identifying the organizational factors that help or hinder them. External interpretation and guidance add independence and existence, as well as relevant experience and takeaways from comparable situations and successes.

7. Organizational learning and improvement have stalled

It’s easy to stall out. It looks like re-dating manuals year over year, instead of updating and revising, or repeating trainings with the same examples and scenarios from the previous year, and staff gets an annual refresher, instead of genuine learning and improvement. Debriefs and incident reviews ask the same questions and come to the same conclusions, again and again. Maintenance is a normal part of program leadership, and plateauing on learning and improvement happens to good organizations.

An external review brings a fresh lens and a new take on the same old questions. For example, consider the program that has been reaccredited time and again. It’s clear that they’re capable of meeting industry standards (and that the accreditation process is working as intended). An external review, however, can push the organization to mature. A review can go beyond standards and benchmarking to assess how mature the risk management program really is. It can assess the effectiveness of risk oversight and the accountability structure, the distribution of workload, the impact of organizational priorities, and how intentionally the safety culture has been developed rather than passed down.

8. Someone wants evidence of due diligence

Boards want to see evidence that the organization is managing risk responsibly. Insurers ask similar questions at renewal, and some accreditors require periodic external reviews. Due diligence means acting reasonably and being able to show the documentation, and an external review, together with the organization's written response, provides exactly those records.

Evidence works internally, too. At one review kickoff, an organization's in-house legal counsel said she didn't have a clear picture of how physically safe the organization's properties were and didn't want the organization to be sued. The review gave her documented answers she could take to her executive team. A review also documents strengths, so program and executive directors get external validation for good work, and something concrete to show when they ask the organization or board for support.

The 80%

Remember where most risks are introduced. Twenty percent shows up in the field, where programs already pay close attention. The other 80% is introduced earlier, in decisions that are harder to see, yet easier to inherit.

If any of these eight reasons resonate, know that an external review exists for exactly that situation. I’ve written a guide called What Is an External Risk Review? that walks through the steps of commissioning one, determining scope and format, and it discusses what happens when the review is finished.

Slay Risk conducts program risk reviews for schools and providers of outdoor and off-campus programs across Asia and North America, with worldwide availability. A short conversation is the easiest way to figure out if it’s the right time for a review and what it should look like.

References

Dallat, C., Salmon, P. M., & Goode, N. (2017). Identifying risks and emergent risks across sociotechnical systems: the NETworked hazard analysis and risk management system (NET-HARMS). Theoretical Issues in Ergonomics Science, 19(4), 456–482. https://doi.org/10.1080/1463922X.2017.1381197

FAQ

What are the most common risk management gaps in outdoor programs?

Every program has a unique set of circumstances and context. But, in the 2020s, and based on external review data, shades of several issues seem to be common: Safety often depends on a few trusted, experienced people instead of written systems. Emergency and crisis plans exist, but haven't been practiced. Policies and forms borrowed from other organizations don't fit the program's own context. Risk communication with families often stops at waivers and packing lists, and protocols for behavioral and mental health lag behind the medical protocols already in place. Every program's mix is its own, and a review ranks the gaps by priority for that program.

Do review findings mean a program is unsafe?

A review finding is not necessarily a safety verdict. Findings identify where a program's risk management can be strengthened, such as opportunities for tasks to be made less dependent on any one person. Every program has areas to improve, including mature and well-run ones. Continuous learning and improvement is a normal part of how a program builds more resilient systems over time.

Why do experienced teams miss risk management gaps in their own programs?

Experienced teams often overlook their own gaps because work practices evolve gradually, with each small step seeming normal to those involved. This slow drift makes it difficult to notice from within the team. Program leaders, busy managing their programs, rarely see the broader field or peer programs. Even a skilled safety leader faces challenges, as changing organizational practices involves altering individual behaviors, which can be difficult due to personal relationships, hierarchy, and professional boundaries.

Should a program wait for an incident to get a review?

No, and the best programs don't. Most reviews are initiated proactively due to growth, leadership changes, or a board's desire for an independent assessment of good stewardship and strategies for a continuous improvement plan. Conducting a review before any significant incident happens enables the program to capitalize on its strengths and plan its next moves independently, with its own team and schedule. This approach is how a well-organized organization functions.