Leadership

Asking people to speak up is easy. Leadership begins when a credible warning has the legitimate power to pause a launch, a software release, a production line—or the strategy itself.

Executive summary

• Psychological safety permits people to speak. It does not, by itself, ensure that a warning changes the decision.
• High-reliability leadership gives expertise temporary precedence over hierarchy when abnormal conditions arise.
• Four operating rights matter: the ability to bypass a conflicted chain of command, pause activity, obtain a documented response, and learn from the signal.
• Challenger and recent Boeing findings show the cost of escalation paths that exist formally but fail operationally. CrowdStrike shows how stop authority can be encoded in release architecture. Toyota shows how stopping can become ordinary work rather than career-threatening defiance.
• The board-level question is not “Do employees feel free to speak?” It is “Show us the last time a warning stopped something important, what happened next, and whether the messenger was protected.”

The warning is not the control

Many leadership teams now say the right things about candor. Employees are invited to challenge assumptions, ethics hotlines are advertised, and executives ask for “bad news early.” Yet the decisive moment comes after someone raises the concern. Can that person interrupt momentum, or must the warning climb the same hierarchy whose incentives favor proceeding?

This distinction matters because modern organizations move faster than their formal governance. A software update can reach millions of devices in minutes. A compliance interpretation can be embedded across markets before a board committee meets. A procurement exception can propagate through a supply chain. The velocity of execution has increased; in many companies, the authority to slow execution has not.

A speak-up culture is therefore necessary but incomplete. A warning that is heard, acknowledged, and then absorbed without changing the decision can create the appearance of openness while leaving the underlying risk untouched. Leaders need something more demanding: an escalation system in which credible signals acquire defined procedural force.

This is not an argument for paralysis, or for giving every objection an unlimited veto. It is an argument for designing the conditions under which the burden of proof changes. In normal operations, the person who wants to stop may need to justify the interruption. Once a pre-agreed safety, legal, ethical, financial, or reputational threshold is crossed, the burden should move to those who want to continue.

A practical theory of stop authority

Amy Edmondson’s research on psychological safety explains why teams need an environment in which interpersonal risk-taking is possible: people must be able to ask questions, admit errors, and voice concerns without expecting humiliation or punishment.^[1] That is the social foundation. But psychological permission is not the same as decision authority.

Karl Weick and Kathleen Sutcliffe’s work on high-reliability organizations adds a second element. Organizations operating under dangerous, uncertain conditions remain alert to small failures and defer to relevant expertise when the situation departs from the routine.^[2] “Deference to expertise” does not abolish hierarchy. It means that, during an abnormal event, authority temporarily migrates toward the person closest to the evidence.

Albert Hirschman’s classic account of exit, voice, and loyalty supplies a third insight: people who care about an institution may use voice instead of leaving, but voice only works when decision-makers are capable of responding.^[3] Organizations often misread loyalty as quiet support. In reality, loyal dissent may be the last repair mechanism available before talent exits or failure becomes public.

Finally, a just-culture approach separates good-faith error and reporting from reckless conduct. Without that distinction, leaders face two bad outcomes: employees hide mistakes for fear of punishment, or accountability becomes so diffuse that serious disregard carries no consequence.^[4] A mature system protects the messenger while still examining the quality of the judgment.

The six rights of escalation

These ideas can be translated into six operating rights. A right here is not a slogan. It is a documented capability with an owner, a route, a response time, and evidence that it works.

Right	Operational meaning	What failure looks like	Control to test
Notice	People closest to the work can see relevant data, anomalies, assumptions, and prior exceptions.	Critical context is fragmented, normalized, or filtered upward.	Trace a recent weak signal from source data to the decision record.
Speak	A good-faith concern can be raised without retaliation or status loss.	Silence, euphemism, or anonymous reporting becomes the only safe route.	Review retaliation claims, survey comments, and promotion outcomes—not only hotline volume.
Bypass	The concern can move around a manager or function with a conflict of interest.	The same owner controls schedule, budget, risk acceptance, and escalation.	Run a live test of the independent escalation route.
Pause	Named roles can stop defined activities when agreed thresholds are met.	Everyone may raise a hand, but only the most invested executive may change course.	Identify stop owners, deputies, triggers, and restart authority.
Closure	The concern receives a timely, reasoned decision visible to the raiser.	Reports disappear into review, or “closed” merely means administratively completed.	Audit response time, rationale, evidence, and feedback to the messenger.
Learn	Near misses change processes, incentives, training, or system design.	The incident is blamed on an individual and the same conditions recur.	Compare corrective actions with subsequent recurrence and control effectiveness.

The sequence matters. A company can have an excellent hotline and still fail at bypass, pause, or closure. It can empower a stop and then punish the employee indirectly through performance ratings. It can investigate an event and fail to change the incentives that produced it. The chain is only as strong as its weakest right.

Case one: Challenger—when the warning never acquired authority

The loss of Space Shuttle Challenger on January 28, 1986 remains one of the clearest examples of the difference between technical knowledge and organizational power. The Rogers Commission concluded that the launch decision was flawed. The senior decision-makers were unaware of important O-ring history, the contractor’s initial written recommendation not to launch below 53°F, continuing engineer opposition after management reversed its position, and the full extent of a separate ice concern.^[5]

The Commission described failures of communication, conflict between engineering data and management judgment, and a management structure that allowed flight-safety problems to bypass key Shuttle managers. The formal readiness process existed. So did people with relevant expertise. What failed was the conversion of their concern into a durable stop.

There is a subtle leadership lesson here. The engineers could not quantify the risk with the precision management wanted because the launch conditions lay outside the available data. In uncertain situations, the absence of complete evidence is often treated as evidence of safety. A well-designed stop system reverses that logic when the potential consequence is severe: outside the validated envelope, uncertainty itself can be a reason to pause.

Challenger is sometimes reduced to a story about individual courage or groupthink. That framing is too comfortable. Courage is an unreliable control. A sound organization should not require an engineer to defeat hierarchy through exceptional persistence at the exact moment schedule pressure is greatest. Leadership is the work of designing the decision so that expertise cannot be procedurally erased.

Case two: Boeing—formal channels, contested trust

In February 2024, an expert panel convened under U.S. law published a review of Boeing’s safety culture, safety-management systems, and delegated certification organization. Its evidence base included more than 4,000 pages of Boeing documents, seven surveys, more than 250 interviews, and work across six company locations. The panel produced 27 findings and 53 recommendations.^[6]

The panel observed a disconnect between senior management and other parts of the organization on safety culture. Interviewees questioned whether reporting systems would ensure open communication and non-retaliation. It also found that complex, changing procedures created confusion and that employees lacked awareness of safety metrics. The review noted improvements in the organizational independence of certain delegated representatives, while finding that opportunities for retaliation could remain through salary and furlough rankings.^[6]

Those findings should not be used to claim that the panel established the cause of a particular accident; it explicitly did not investigate specific incidents. The later National Transportation Safety Board investigation of Alaska Airlines Flight 1282 addressed a different evidentiary question. In June 2025, the NTSB said the January 5, 2024 door-plug separation occurred after the plug had been opened without required documentation and then closed without the resulting quality-assurance inspection. Eight people received minor injuries.^[7]

Together, the two official records show why leadership architecture cannot be measured by the existence of a reporting channel alone. Employees must understand the system, trust its independence, know what constitutes a stop condition, and see that documentation and quality gates cannot be bypassed without detection. The FAA later said it agreed with all 53 panel recommendations and was tracking their completion.^[8] That is a corrective process; it should not be mistaken for proof that cultural change is complete. Culture is demonstrated through repeated decisions under pressure.

Case three: CrowdStrike—encoding the right to stop

On July 19, 2024 at 04:09 UTC, CrowdStrike issued a content configuration update for Windows sensors. The company’s preliminary post-incident review said a bug in its content validator allowed problematic data to pass. When loaded, the data produced an out-of-bounds memory read and a Windows crash. The update was reverted at 05:27 UTC.^[9] Microsoft estimated that 8.5 million Windows devices were affected—less than one percent of all Windows machines, but with broad impact because many were used by organizations running critical services.^[10]

This case expands the idea of escalation beyond human reporting. In fast digital systems, the right to stop can—and often must—be engineered into the release process. A canary deployment is a small initial release that generates evidence before full distribution. A rollback trigger gives an observed anomaly the power to halt propagation. Neither depends on a junior engineer persuading a senior executive during a crisis.

CrowdStrike said earlier instances of the same template type had performed as expected, contributing to trust in the validation process. Its stated corrective actions included more testing and validation, staged deployment beginning with a canary, better monitoring, and greater customer control over when and where updates are delivered.^[9] These are company-reported actions, not independent proof of their long-term effectiveness. Even so, they illustrate a central point: past success can weaken skepticism. Good leadership turns that skepticism into architecture so that each high-impact release must earn the right to scale.

Case four: Toyota—making interruption ordinary

Toyota’s production system offers the contrasting model. Its concept of jidoka is built around stopping when an abnormality is detected. Equipment may stop automatically, or an operator may pull a stop cord. Toyota says this prevents defects from flowing onward and makes abnormalities visible so they can be addressed and prevented from recurring.^[11]

In Toyota’s description of assembly work, an employee who identifies a problem presses a call button that activates an andon board; work does not resume until the problem is resolved.^[12] The important feature is not the cord or board. It is the legitimacy attached to the act. Stopping the line is part of doing the job correctly, not an accusation against the hierarchy.

No operating system is infallible, and Toyota’s practice should not be romanticized as evidence that the company cannot experience quality failures. The transferable lesson is narrower and stronger: stop authority works best when it is local, visible, rehearsed, and linked to rapid problem-solving. If pausing is treated only as an exceptional ethical gesture, employees will use it exceptionally.

What the four cases reveal

First, information and authority are different resources. Challenger had relevant information, but the decision system did not give it sufficient force. Boeing’s expert review found formal safety arrangements alongside confusion and doubts about non-retaliation. Leaders should map not only who knows, but who can change the state of the system.

Second, independence must be practical. A bypass route is not independent if the same executive controls the employee’s pay, promotion, project budget, and risk acceptance. Functional reporting to risk, legal, compliance, safety, or the board can help, but only if that route is accessible and its decisions are respected.

Third, stop authority must travel at the speed of the risk. A quarterly committee cannot control a release that propagates globally in minutes. Automated gates, rate limits, canary populations, kill switches, and rollback criteria are leadership mechanisms because they determine who—or what—can interrupt momentum.

Fourth, the restart matters as much as the stop. Indefinite vetoes produce delay, gaming, and resentment. Mature systems specify who assesses the concern, what evidence is needed, how quickly a decision must be made, and who authorizes resumption. The objective is disciplined interruption followed by disciplined resolution.

Finally, incentives disclose the real constitution of the organization. If executives say safety comes first but reward only schedule, volume, and margin, employees will infer the effective rule. A leader’s values become credible when a justified pause does not damage the career of the person who called it—and when senior compensation reflects the quality of controls, not only the speed of output.

What leaders should do now

1. Define stop conditions before the crisis. Set thresholds for physical safety, legal compliance, data integrity, customer harm, cybersecurity, financial exposure, and reputational risk. Ambiguous language such as “material concern” should be translated into examples and decision rules.
2. Name the people who may stop—and their deputies. Authority should sit close enough to the evidence to act quickly. Where the exposure is systemic, include independent risk, legal, safety, or compliance owners.
3. Create a real bypass. Give employees, contractors, and critical suppliers a route around a conflicted chain of command. Test it as an operating control, not merely as a policy.
4. Separate stop authority from restart authority. The person who pauses should not carry the burden of proving the entire case. A designated group should assess the evidence and document the decision to resume, modify, or cancel.
5. Protect good-faith escalation. Examine performance ratings, assignments, promotion, and redundancy decisions after major escalations. Retaliation is often indirect and delayed.
6. Design digital stops. For high-impact technology, require canary releases, staged deployment, observable thresholds, customer controls where appropriate, and tested rollback procedures.
7. Measure closure, not noise. Raw report volume can rise for healthy or unhealthy reasons. Track time to acknowledgment, time to resolution, quality of reasoning, recurrence, override frequency, and whether the raiser received feedback.
8. Rehearse the difficult moment. Run simulations in which a deadline, influential sponsor, or major revenue opportunity conflicts with a control. The exercise should test whether leaders honor the stop when the cost is real.
9. Bring evidence to the board. Report recent stops, overrides, retaliation allegations, unresolved high-risk items, and recurring exceptions. Ask whether the organization’s declared hierarchy of values matches observed decisions.

Conclusion

Leadership is often described as the ability to create movement. In consequential organizations, it is also the ability to make interruption legitimate.

The real test is not whether the chief executive welcomes challenge in a town hall. It is whether a manufacturing operator, engineer, compliance officer, country manager, supplier, or automated control can stop something important when the evidence crosses a defined threshold—and whether the institution responds with speed, rigor, and respect.

Organizations that distribute the right to stop do not weaken leadership. They make leadership less dependent on the judgment, attention, or courage of any single person. That is not a loss of authority. It is authority designed to survive contact with reality.

Key evidence

• January 28, 1986: the Rogers Commission found Challenger’s launch decision-makers lacked critical O-ring and engineer-opposition information; it judged launch highly unlikely had all facts been known.^[5]
• 27 findings and 53 recommendations: the 2024 FAA-convened panel reviewed more than 4,000 pages, seven surveys, and 250-plus interviews across six Boeing locations.^[6]
• No required record, no quality inspection: the NTSB found that undocumented door-plug work prevented the required inspection before Alaska Airlines Flight 1282; eight people later received minor injuries.^[7]
• 8.5 million devices: Microsoft’s estimate of Windows machines affected by the July 2024 CrowdStrike update—under one percent of Windows devices, but concentrated in critical enterprises.^[10]
• Stop until resolved: Toyota states that when a worker signals an abnormality through the andon system, work does not resume until the problem is resolved.^[12]

Glossary

Andon: a visual signaling system used to alert operators and leaders to an abnormal condition on a production line.

Canary deployment: releasing a change first to a small, controlled population so failures can be detected before wider distribution.

Deference to expertise: temporarily shifting decision weight toward the person with the most relevant knowledge during an abnormal situation, regardless of rank.

Jidoka: the Toyota production principle of building in the ability to detect an abnormality and stop immediately.

Just culture: an accountability approach that protects good-faith reporting and distinguishes human error from reckless conduct.

Psychological safety: a shared belief that interpersonal risks such as questions, disagreement, or admitting error can be taken without humiliation or punishment.

References and further reading

1. Amy C. Edmondson, “Psychological Safety and Learning Behavior in Work Teams,” Administrative Science Quarterly, Vol. 44, No. 2, June 1999, pp. 350–383.
2. Karl E. Weick and Kathleen M. Sutcliffe, Managing the Unexpected: Sustained Performance in a Complex World, 3rd edition, Jossey-Bass/Wiley, 2015.
3. Albert O. Hirschman, Exit, Voice, and Loyalty: Responses to Decline in Firms, Organizations, and States, Harvard University Press, 1970.
4. Sidney Dekker, Just Culture: Restoring Trust and Accountability in Your Organization, 3rd edition, CRC Press/Routledge, 2016.
5. Presidential Commission on the Space Shuttle Challenger Accident, “Chapter V: The Contributing Cause of the Accident,” Report to the President, NASA History, June 1986.
6. Federal Aviation Administration, Expert Panel, “Section 103 Organization Designation Authorizations for Transport Airplanes Expert Panel Review Report,” February 26, 2024.
7. National Transportation Safety Board, “Boeing’s Inadequate ‘Training, Guidance and Oversight’ Led to Mid-Exit Door Plug Blowout on Passenger Jet,” June 24, 2025.
8. Federal Aviation Administration, “Review Panel’s Final Report on Organization Designation Authorizations for the Design and Production of Airplanes,” updated September 5, 2024.
9. CrowdStrike, “Preliminary Post Incident Review: Content Configuration Update Impacting the Falcon Sensor and the Windows Operating System,” July 24, 2024, updated July 25, 2024.
10. David Weston, “Helping Our Customers Through the CrowdStrike Outage,” Microsoft, July 20, 2024.
11. Toyota Motor Corporation, “Toyota Production System,” corporate reference page, consulted August 18, 2026.
12. Toyota Motor Corporation, “Toyota Virtual Plant Tour: Toyota Production System,” corporate reference page, consulted August 18, 2026.
13. James Reason, “Human Error: Models and Management,” BMJ, Vol. 320, March 18, 2000, pp. 768–770.

Source and methodology note

Research was completed on August 18, 2026. The article relies on primary corporate materials, official accident and regulatory records, and established academic works. Official findings are distinguished from the author’s leadership analysis. The FAA expert panel did not investigate specific Boeing incidents; its cultural findings are therefore not presented as a causal determination for Alaska Airlines Flight 1282. CrowdStrike’s remedial commitments and Toyota’s description of its production system are company-reported. They demonstrate stated processes, not independent proof that those processes are uniformly effective in every operation. The Challenger case is used as an institutional decision-making example, not as a claim that all modern failures reproduce its exact conditions.

Leadership #CorporateGovernance #RiskManagement