Every organization working with children or vulnerable adults wants the same thing — safety. 

The problem isn’t the will. It’s the way. 

For more than twenty years, most prevention approaches have followed the same formula — background checks, policies, and training. 

It’s a familiar pattern — one that looks good in a report, fits neatly into audit templates, and satisfies regulators. 

But if it truly worked, the numbers would be falling. They aren’t. 

In fact, sexual abuse incidents and reports continue to rise across sectors that consider themselves the most diligent — education, religion, sport, and care. 

How is that possible? 

Because the old model was never designed to prevent abuse. 

It was designed to restore credibility after scandals. 

A System Built to Look Safe — Not to Be Safe 

In the early 2000s, the “safe environment” emerged from crisis. 

Abuse scandals across churches, schools, and youth organizations shattered public trust.  

Leaders needed to be seen taking action. 

So a compliance-based model took shape: visible, documentable steps that could be standardized — the background check, the training certificate, the policy binder. 

These steps mattered. They still do. 

But they were reactive solutions to a reputational problem, not proactive solutions to a risk problem. 

They restored credibility — but didn’t establish capability. 

Compliance can prove that rules exist. 

It cannot prove that risk is being managed. 

The Unspoken Problem: Drift 

Even when policies are well written and training is delivered, something happens quietly over time — drift. 

Drift is what happens when rules stay static while reality keeps moving. 

• Staff turnover changes the culture.
  
• Supervision weakens during busy periods.
  
• Behavior norms shift subtly — until small lapses become accepted practice.
  
• Daily routines change, but documents don’t. 

Every organization that’s faced a major abuse case has said afterward: 

“We thought we were safe.” 

That’s because compliance creates the illusion of safety. 

It focuses on inputs (what’s written down) rather than outcomes (what actually happens). 

And that illusion is dangerous — because it blinds good people to growing uncertainty. 

Drift doesn’t happen because people stop caring. It happens because systems stop learning. 

The Real Nature of Sexual Abuse Risk 

Sexual abuse risk isn’t a single hazard you can “fix.” 

It’s a living uncertainty — shaped by context, culture, and constant change. 

It doesn’t live in policy documents. 

It lives in: 

• moments of transition,
  
• gaps in supervision,
  
• blurred professional boundaries,
  
• overworked staff,
  
• power imbalances,
  
• environments where people are afraid to speak up.
  

It’s not primarily a matter of bad actors — it’s a matter of unmanaged uncertainty. 

You can’t eliminate uncertainty with rules. 

But you can manage it — systematically and transparently. 

That’s the shift that separates static prevention from living prevention. 

What Static Systems Can’t See 

Static systems — policies, checklists, annual training — are blind to what’s changing. 

They can’t: 

• Detect when oversight weakens.
  
• Recognize early warning signs in culture or relationships.
  
• Adapt to new technologies that create new risk channels.
  
• Track whether training translates into behavior.
  
• Learn from near misses before they become incidents. 

In other words, they can’t do the very thing prevention demands: see drift before harm occurs. 

Because the old model doesn’t monitor risk, it monitors compliance. 

And that’s a completely different thing. 

The Consequence: When Prevention Fails, Protection Fails 

Here’s the hard truth most organizations only realize too late: when prevention fails, people are harmed — and protection fails with it. 

For the person abused, the consequences are lifelong: profound trauma, lost trust, and the knowledge that the system built to keep them safe failed them when it mattered most. 

For the organization and its Board, the impact is equally far-reaching. 

Even when staff did everything the rules required, the result is the same — a preventable tragedy, reputational collapse, and scrutiny that exposes just how little confidence static systems can provide. 

Funding disappears. Partnerships withdraw. Communities lose trust. 

Because when prevention fails, everyone loses — but the person harmed loses first, and most. 

The public doesn’t judge safety by policies or certificates. 

They judge it by whether people were protected in practice. 

And without a system designed to adapt, learn, and manage uncertainty, even good organizations, with good people, will keep facing the same failures again and again. 

The Turning Point: From Compliance to Capability 

The good news is that there is a better way — and it’s already proven in other high-risk fields. 

For decades, Enterprise Risk Management (ERM) has helped organizations manage uncertainty in complex environments — hospitals, airlines, governments, and global businesses. 

The same principles that keep planes in the sky can keep children and vulnerable adults safe too. 

The key insight of ERM is this: 

Risk is not the danger itself. 

Risk is the effect of uncertainty on your objectives. 

In other words: 

If your objective is to protect people, risk management isn’t about eliminating danger — it’s about identifying and reducing the uncertainties that threaten that protection. 

That’s how real prevention works. 

Step 1: Acknowledge Uncertainty 

The first step toward genuine prevention is admitting uncertainty exists. 

That may sound simple, but in many safeguarding systems, it’s revolutionary. 

For years, we’ve treated uncertainty as failure — something to hide. 

But uncertainty isn’t failure. 

It’s reality. 

When organizations make space to discuss uncertainty — to ask, “Where are we least sure?” — they open the door to the very conversations that make abuse least likely. 

Step 2: Make Prevention a Living Process 

Once uncertainty is acknowledged, prevention can finally evolve. 

Living systems don’t rely on compliance snapshots. 

They rely on continuous sensing and adaptation: 

• Monitoring whether controls actually work.
  
• Reviewing whether the original assumptions that led to the controls still hold.
  
• Adapting controls as risks, people, and environments change. 

This isn’t bureaucracy. 

It’s learning by design — the same approach that drives continuous improvement in every other field where lives and trust are at stake. 

Step 3: Focus on Fit-for-Purpose, Not One-Size-Fits-All 

In most sectors, one of the biggest mistakes is assuming that what works for a school must work for a sports club, or what works for a diocese must work for a camp. 

That’s how systems break — they’re transplanted, not tailored. 

Fit-for-purpose safeguarding asks: 

• Does this control reduce the uncertainty we actually face?
  
• Can it be implemented reliably here, with our people and resources?
  
• Do those affected by it understand, trust, and use it? 

When a system is fit-for-purpose, prevention stops being about checking boxes. 

It becomes about delivering results. 

Step 4: Build Defensibility Before You Need It 

Defensibility isn’t about covering yourself in court. 

It’s about being able to explain — clearly, calmly, and credibly — why what you did made sense at the time you did it. 

A defensible system is transparent, documented, and reasonable. 

It proves intention and learning, not perfection. 

It’s the difference between saying “We did our best” and showing “Here’s what we did, why we did it, and what we learned.” 

That’s what earns lasting trust — from families, funders, regulators, and the public. 

The Path Forward: From Effort to Effectiveness 

If your organization feels stuck — doing everything right but still unsure if it’s enough — you’re not alone. 

That uncertainty is the signal that the old model has reached its limit. 

The next evolution isn’t more effort. 

It’s more effectiveness. 

It’s about replacing compliance with capability. 

Static rules with living systems. 

Silence with evidence. 

The Bottom Line 

The “safe environment” model gave us a starting point — visibility, consistency, and accountability. 

But now it’s time to move beyond it. 

Because no one should be forced to choose between credibility and capability, or between effort and effectiveness. 

Prevention that learns is prevention that lasts. 

And the organizations that embrace that truth are the ones that will finally deliver what the old model promised — but could never quite achieve: 

safety that’s real, resilient, and trusted.