Introduction
In Aotearoa New Zealand, health and safety is largely risk based and proposed to be framed towards critical risk management including through the new HSWA amendment bill.
In 2024 I carried out a study of a high-performing residential prison unit (click this link for the full thesis). One insight was that low incident rates weren’t explained by controls alone. Fences, cameras and procedures were present — but what truly shaped outcomes for prisoners, the community and staff was the social climate and culture of the prison unit.
Strong, consistent relationships. Clear boundaries. High shared standards. Distributed decision-making. A pro-social community that balanced safety, rehabilitation, wellbeing and whānau impact — all at once. Controls matter. But when controls fail — or are absent — culture fills the gap.
In complex social environments like prisons, health, safety and wellbeing risks are managed by controls, but outcomes are achieved through the quality of day-to-day human interaction.
If we focus only on managing risk, we miss the opportunity to shape the conditions in which risk is created — or reduced — in the first place. 🔗 Read the full article (and thesis link) here.
Risk Management Not Enough: Lessons from a New Zealand Prison Unit
Health and Safety in Aotearoa New Zealand has a strong emphasis on risk management, clearly embedded in the Health and Safety at Work Act 2015. Over time, this approach has been extended further to critical risk management which has become a central component of the new H&S parliamentary bill.
With critical risk management, executive teams and governing boards narrow their focus to the biggest “STKY” risks — Stuff That’ll Kill You. This approach sounds sensible at first glance but a subsequent media brief by the New Zealand Institute of Safety Management identifies why health and safety is not that simple.
Solving Health and Safety problems has never been that simple. Risk and critical risk management, on their own, have never provided all the answers for keeping people safe and well — particularly in complex, social work environments.
In 2024, I completed a study of a well-functioning residential prison unit in New Zealand (click this link for the full thesis). This prison unit was not defined by additional controls, but by strong unit culture and a commitment to positive outcomes. It operated as a pro-social community in a context where rehabilitation outcomes, and whānau wellbeing were considered together with staff safety and community safety.
Following in-depth interviews with more than 20 staff and volunteers, one insight stood out clearly: organisations cannot achieve health, safety and wellbeing outcomes through critical controls alone.
Disclaimer: I currently work for the New Zealand Department of Corrections as a health and safety professional, but I undertook the study under a separate contract as an independent researcher. This article is written through this independent lens.
Risk Management and Culture should not be merged
Culture development is not the same as risk management — but both are important.
At its core, risk management is a reductive process. Individual risks are identified, risk-specific controls are assessed for effectiveness, and controls are implemented to reduce exposure.
In control hierarchies, engineering controls sit at the top of this hierarchy, and the gold standard is to eliminate or minimise risk through design. It is analytical, structured, and largely top-down — and for technical factors, it works well.
Work factors like relationships, communication, and decision-making are considered ineffective as risk-controls in legislation and organisational hierarchies. In truth, these human, social attributes do not fit neatly into the reductive risk management process. Communication and relationship building are not risk specific and are generally outcome oriented and holistic in nature. People don’t build strong relationships to manage a specific risk, they do it for more human reasons and sometimes it can simply feel like the right thing to do. This might be a poor control for an individual risk but it provides a strength that is precisely what risk management lacks: culture is not topic or risk-specific. It influences everything.
This human nature was highlighted by a prison officer in my study: A first indicator is a feeling. You can walk into the compound in a unit and get a feeling about whether things are working. You can tell whether there is low tension and people are engaging with you and smiling.
How do teams work together to implement and maintain critical controls? What happens when critical controls are missing, or fail? How do teams operate in ways that change the risk context and so reduce the need for those controls in the first place?
These are not engineering questions. They are cultural ones.
Prison Units as High-Risk, High-Social Environments
Residential prison units can be most easily recognised by their controls and risk management controls could be seen all through the unit I studied. There were high fences, barbed wire, bars and locks. Staff wore vests and on-body cameras, and carried out cell searches and rub-down searches. But when staff described what enabled the unit to function so well and with low levels of incidents the emphasis was different.
“I think it's just a blend of a lot of things that work.” “It's a standalone unit. It's got a big element of that. Employment opportunities that are really good. Good staff – good team. A good rununga. The classification of prisoners definitely helps as well. The community concept - therapeutic community concept but without a therapy function. Good events – whanau days, BBQs, Hangi, and maintaining high standards.”
Prisons are inherently high-risk environments — but they are also deeply social ones.
The unit I studied held 80 men, held together in confined, tightly knit communities with lots of activity with people regularly coming and going. In this environment, Custodial officers were tasked with managing these men as prisoners but also encouraging and supporting them to achieve positive change. There is also a mix of orientations between staff groups. Nurses regularly visited the units, but their role required them to consider the men as patients. Corrections educators would also visit the unit to work with the men, but they would consider them as students and learners. Staff themselves also form their own internal social groups. Meanwhile prisoners have to navigate complex hierarchies within the unit with gangs and individual power relationships, and also maintain ongoing connections with whānau/family, and communities outside the prison walls.
These factors are complex and the relationship between outcomes and risk in this environment is not static and are shaped continuously by human interaction.
In the unit I studied, relationships with the men in the unit were prioritised — not as a “nice to have”, but as an effective way to understand people’s needs and personality traits, spot emerging issues early, and address them before they escalated into incidents. But the day-to-day interactions were not done as discrete ‘risk management controls’. Instead they were a way to enable positive outcomes and manage risks in general. It was considered the right thing to do for the good of the men, themselves and the community in general. This underlying intention is important because the men could tell if the staff member was not being authentic!
Strong Relationships Do Not Mean Weak Boundaries
To be clear: positive relationships did not mean blurred boundaries or vulnerability to coercion. Quite the opposite. Staff in this unit demonstrated a strong shared understanding of professional boundaries that were consistently communicated, monitored and maintained across the team. Less experienced staff were buddied-up with an established team member.
This culture of collective consistency extended well beyond relationships. The unit maintained very high and consistent standards in keeping the day to day regime running on time, and with various rules that staff and the men were expected to adhere to e.g. keeping cells tidy, clothing standards, fair portions of food for all.
This culture was set and maintained by a stable core group of around eight experienced staff — spread across two shifts — acted collectively as leaders of the culture. They buddied themselves up with new staff in the team and actively coached and supported them from week to week, to maintain a consistent unit culture. Rather than relying on formal authority alone, they set and maintained shared standards for how work was done, how decisions were made, and how people communicated with one another.
Because of this consistency built over time, decision-making could be highly distributed. Staff were empowered to talk directly with the men to solve problems themselves, supported through mentoring and coaching rather than constant escalation up to the unit leader. When things went wrong the team would focus on learning from it, rather than assigning blame.
This positive, relational culture also extended to include the 80 odd men held in the unit. The men were encouraged to contribute positively to the unit community and even maintained a Rununga, a prisoner committee. As a result, many risks were managed proactively through day-to-day interaction, rather than reactively through formal controls.
What this illustrates is that health, safety and wellbeing risk management does not occur in isolation. In social environments like prisons, it operates within a complex human context that shapes how risks are perceived, how controls are applied, and what gets noticed, reported, or acted upon.
So What Do We Mean by “Culture”?
Culture is often described as ‘the way we do things around here’. Through my study I was able to build on that definition. It was able to observe that an organisation can provide direction, policies, resources and risk management controls. But the ‘prison unit culture’ in this unit was ‘the way that staff work together with the men to build relationships, interact throughout the day, maintain standards, communicate, implement policy and process, make decisions and solve problems.
Importantly, the culture of the unit was also a bottom up phenomenon. While influenced by external factors, it was set and maintained locally. This highlighted how organisational culture is just a collection of individual team cultures but also how culture change cannot be imposed from the top down. It must be nurtured from the bottom up. This stands in contrast to critical risk management, which is typically rule-based, centrally designed, and legislated for. Critical controls are established, resourced, and governed from above. Frontline staff can certainly input into it, but it comes from the centre or ‘national office’. Conversely, culture can not be controlled in the same way.
Beyond “Safety Culture”
The term “safety culture” is widely used, but my work raises questions about the term. I found that decisions in the prison unit were rarely made with “safety” as a standalone objective. Frontline leaders and staff were constantly balancing multiple considerations at once: safety, security, wellbeing, rehabilitation, whānau impact, organisational reputation, and resource constraints.
Culture, in this sense, is holistic. It is the collective prioritisation of many outcomes at once. A culture can include safety — but it is never only about safety. There is no such thing as safety culture in isolation.
In summary
In high risk work environments like prison units, risk management and controls are important. But they are not sufficient by themselves. When controls are missing, or fail, it is culture that fills the gap. Culture shapes how people work together to respond, adapt, communicate, and recover. It influences the inherent risk context itself — for example, a prison unit with a strong pro-social culture will have a significantly lower baseline risk of violence than one without. Violence can still happen, as it can anywhere, but it is much less likely.
Culture cannot be engineered like a control system and it can not be easily legislated for in a parliamentary bill. Legislation can enable culture but it cant create it. Instead culture must be fostered from the ground up, and given space to develop but also supported. Leaders and teams need permission to shape their own local cultures.
Organisations that focus only on critical controls are managing risk. But we also need to remember that organisations also need to invest in culture to shape the conditions in which risk is created — or reduced — in the first place, and in complex, social environments, that difference matters. If the culture in a prison unit can be pro-social and positive then it can be in any social environment!
