Identifying risk

In the previous steps, we learned about ethics, safeguarding, and trauma awareness in user research. We began with these as separate categories, because they are fundamental to good user research practice. They are about protecting the most important part of all user research – the people involved.

However, there are other forms of risk in user research that must be considered.

What do we mean by risk?

Reducing risk starts with awareness – we need to understand what it is. In user research, risk refers to anything that could cause distress, discomfort, or harm to anyone or anything involved, and can occur before, during, or after the user research takes place.

As we have already discussed, participants, and user researchers are often most at risk, as they are directly involved and more likely to be exposed to difficult or distressing situations.

However, other people or organisations may also be affected, including:

• observers, notetakers, or other team members
• external stakeholders, such as executives, senior managers, funding bodies, or ethics committees
• external organisations, including those commissioning or sponsoring user research, the organisation the user researcher works for, or third parties such as consultancies or participant recruitment providers

Different people and groups related to user research can be affected by different types of risk. Let’s explore these in more detail.

Types of risk

Emotional or psychological harm

As we discussed earlier this week, user research can involve difficult or distressing topics that may cause emotional or psychological harm to people involved.

This primarily affects user researchers and participants – the people directly involved in user research – but it is important to remember that you are often not alone in user research sessions. Observers and notetakers can also be affected. Even team members who do not attend user research sessions, but take part in discussions or data analysis, can be affected by exposure to distressing material.

Emotional or psychological harm most frequently occurs when it is unexpected. A user researcher asking a poorly-worded question might upset a participant, or a participant might suddenly share something distressing that catches the user researcher off guard. Moments like this are difficult to anticipate, but good planning and safeguarding will help to mitigate the risk of moments of shock, upset, or uncertainty from becoming more serious.

Good user research practice involves setting clear expectations and boundaries for the session, so everyone knows what topics to expect. Where distressing topics are expected to be discussed, everyone in the session should be aware of their exit plan and their ability to pause, take a break, skip a question, or end the session at any time. User researchers should always aim to engage their participants with care and sensitivity, especially when difficult topics are being discussed. User researchers should be prepared in advance and know how to discuss these topics, or be accompanied by someone who does.

As a user researcher, you should feel comfortable advocating for yourself and being honest about your own limits. You may be asked to conduct user research on a topic that you find upsetting due to personal experiences. In these cases, talk to your colleagues or experienced user researchers in your team or the wider community to find a safe and appropriate way to take part.

Bias

Bias can be intentional. When someone knowingly treats others unfairly based on personal beliefs or assumptions, this is a form of discrimination.

More often, however, bias is unconscious. Unconscious bias refers to the automatic judgements we make without realising that are shaped by our experiences, culture, and environment. These biases can influence how we design user research, interpret findings, or engage with participants, even when we are trying to be fair and inclusive.

In user research, bias is a form of risk. It can lead to skewed results, poor decision-making, and services that fail to meet user needs. That is why it’s important to be aware of both active and unconscious bias and to take steps to mitigate their impact.

We will explore this further in Week 3, where we will look at different types of cognitive bias and how they can affect both user researchers and participants.

Risk to physical safety

There are a number of different things that can cause risks to physical safety. As we explained in step 2.4, people have different needs, especially when it comes to health. An activity that one person considers routine may be a significant struggle or a health hazard for someone else.

Some examples of physical safety risks include:

• travelling or commuting
• meeting alone or in unsafe locations
• spaces that are not accessible for disabled people
• conducting user research in homes, where there are other people or pets
• meeting in person instead of virtually, where there is a risk of catching an illness, especially for people who are immunocompromised

We will learn more about accessibility, inclusivity, and removing barriers to user research in Week 3. For now, it is important to be aware of these things, and ensure that your user research plan takes different needs into account. If someone does not feel safe or comfortable, they will not be able to participate properly in your user research.

However, it is not just about keeping participants safe – it’s also about you. As a user researcher, you should also never feel uncomfortable requesting adjustments for your own personal safety. This could be something as simple as asking a participant to keep a pet in a separate room while you are conducting a user research session in their home.

Participants need to feel safe and comfortable in your sessions so they can participate properly, and you need to feel safe and comfortable so that you can do your job.

Aggression or abuse

User researchers may be at risk from participants becoming aggressive, hostile, or violent.

While this should be very rare – some user researchers might never experience it! – it is an unfortunate reality for some, and all user researchers should be aware of the risk and how to manage it.

Aggressive or abusive behaviour can be physical or verbal. Even someone raising their voice or changing their body language can be considered an act of attempted intimidation or aggression.

This sort of behaviour should never be tolerated and must be addressed immediately. You may feel comfortable attempting to de-escalate the situation yourself, but even if you choose to do so, you should always have an exit plan in case you need to remove yourself from the session. If at any point you feel unsafe, you should end the session immediately and follow your organisation’s safeguarding procedures.

Each department should have a safeguarding policy that outlines how to report or escalate abusive behaviour. This should be clarified before user research begins, and contact details, such as names, phone numbers, or email addresses, should be easily accessible to all team members.

It is important to remember that not every instance of someone raising their voice or getting agitated is a sign of aggression. People can become frustrated or emotional, and you should allow them to express their feelings, but you will need to use your judgement.

Managing difficult situations becomes easier with experience. As you grow in confidence and familiarity with different types of user research, you will develop a stronger sense of how to respond, and when to seek support.

Disclosure of (potential) harm involving participant or someone else

User researchers are required to report instances where they become aware of:

• a risk of harm to a child or vulnerable person
• an immediate, serious risk to the participant’s safety
• an immediate, serious risk to the safety of others

As a user researcher, you have a duty of care, but it is not your responsibility to take action yourself. Your role is to report and escalate your concerns to the relevant party or authority, so they can respond accordingly. This is about protecting the person you believe may be at risk, and ensuring the right people are informed.

Your team and organisational safeguarding policies should include a clear escalation route, and identify a nominated person to notify in the event of a concern.

Raising a safeguarding concern is always the right thing to do. Even if it later turns out to be a false alarm, you have acted responsibly by reporting it. It is far better to speak up and have it checked than to stay silent and risk someone coming to harm.

If you are a new user researcher, you should not be intimidated by this. These situations are rare, and you may never encounter a safeguarding concern, but it is important to be prepared. As with many aspects of safeguarding, your confidence will grow with experience.

Legal, financial or reputational harm

As a user researcher, you represent your organisation, and should reflect its values and standards in the way you conduct your user research.

If you fail to account for risks during your user research and a safeguarding failure or data breach occurs as a result, it could have consequences for you personally, but it could also have wider implications for your organisation. This can include legal action, financial penalties, or reputational harm.

Legal action, fines, loss of funding, or a breakdown in trust could affect your organisation and its ability to commission or conduct user research in future. User research relies on integrity – people need to be able to trust that it is conducted ethically and responsibly so that they can trust the results.

In government, this is essential – we must set the standard for quality and integrity, and that means everyone involved in user research has a role to play in upholding it.

Scope creep and stakeholder disagreement

Scope creep is the expansion or change of user research scope.

This can happen for a number of reasons, but most commonly it is because user research is not fully planned and scoped before it begins. It is a risk, because a lack of focus in user research means that the resulting data may not be as useful as it should be, which can mean that time and resources are wasted.

Stakeholder disagreement is a related but distinct issue. It occurs when different people or groups involved in or affected by the user research have conflicting priorities, expectations, or interpretations of findings. This can lead to pressure to change direction, ignore results, or accommodate preferences that do not align with the user research goals.

Both scope creep and stakeholder disagreement can undermine the integrity of user research.

For example, teams may find themselves trying to please everyone rather than focusing on the original user research aims. People may also try to influence user researchers to achieve specific outcomes due to their own bias, which is a risk to the usefulness and credibility of user research results. You might also find yourself at odds with senior stakeholders who do see the value of user research, or who want to ignore your findings in favour of their own preferences.

New user researchers can work with senior user research colleagues to help navigate these risks. Speaking up or challenging senior stakeholders can feel daunting, but it is an important skill to develop. With experience, you will become more confident in advocating for good user research practice, and ensuring that decisions are guided by evidence.

Data protection

All user research data is confidential, and must be gathered and stored according to robust data protection plans. All participants must give informed-consent to their data being gathered, stored, and used, with a clear option to withdraw consent at any time. You must comply with your organisation’s data protection policy.

Your data protection plan should clearly state what you intend to do with the data, who will have access to it, and when and how it will be deleted after the user research has concluded. You will often need to protect participants by pseudonymising or anonymising their data (removing information that could be used to identify them), and you should also only collect personal data when it is relevant to do so.

Data breaches can have serious legal or reputational consequences, and may put participants at risk if they can be identified.

We will learn more about this in step 2.12.

You can never be too prepared

Even with careful planning, user research always carries some level of risk. While risk cannot be eliminated entirely, you can reduce the likelihood of harm.

Minimising risk means thinking ahead, planning thoroughly, being open and transparent with your team and your participants, and being ready to respond if something unexpected happens.

Task

In the next step, we will look at planning and risk assessments in more detail.

Think of your current or previous roles. Have you encountered risks of this nature, or any other sort? What sort of risk management policy or approach did you use?

Think of your current or previous roles. Have you encountered risks of this nature, or any other sort? What sort of risk management policy or approach did you use?

Share your thoughts with your fellow learners in the comments below. If you have not encountered situations like these before, try to imagine how you might react, and read and reflect on other learners’ experiences.