The culture of an organisation has a significant influence on the way employees and leaders behave, which in turn impacts the organisation’s risk maturity. Even the most robust risk management frameworks become redundant, if the environment in which they are applied is misaligned and encourages behaviours that lead to poor risk outcomes.
With increased industry focus on the topic, organisations are under increased pressure to define and improve their risk culture. The question is: Do companies know the truth about how their underlying organisational culture impacts their risk maturity?
The myths around risk culture
Risk culture can be somewhat misunderstood, and this lack of understanding can prevent an organisation from addressing any underlying issues. We encounter six common misconceptions that prevent organisations from getting to grips with their risk culture.
(Click to view)
1. ‘Risk culture’ is separate to ‘organisational culture’
Risk is such a fundamental part of the value creation formula for all organisations that it is impossible to isolate it. Yet many firms still treat risk and organisational culture as separate.
2. Organisations have only one culture
Within any organisation, dynamic sub-cultures will exist across business units and teams. You also want to understand who exerts the most influence over culture—and this not always the most senior people in the organisation.
3. Employee engagement surveys can be used to measure risk culture
While many organisations use engagement surveys to understand risk maturity, these concepts are distinct and require different approaches to measurement. It is entirely possible to have a highly engaged employee who unknowingly displays poor risk behaviours.
4. Culture cannot be measured
Though often seen as immeasurable, it’s possible to implement a data-driven, evidence-based approach to culture and risk maturity which can meet regulatory and shareholder requirements.
5. Risk culture is just a risk issue
Risk culture is not just the responsibility of the Risk function; it needs a strong, cross-functional approach and will benefit from the expertise provided by leadership, change, strategy and finance experts across your company.
6. Risk is bad
The objective for any organisation is not to reduce risk appetite, but to enable smarter risk-taking. This is quite different from reducing risk and requires that decision-makers incorporate a degree of risk acumen in their decision-making.
Governance and consistency is key
Most measurement strategies struggle to separate how people say they will act when they are under pressure (and thus prone to poor risk decisions) and how they actually act. An effective measurement strategy has to recognise this and use a range of tools such as simulations and people analytics to resolve this gap.
Improve your risk culture
There are 4 ways to do this:
• Develop a continuous listening strategy that helps you stay across risk maturity and track progress.
• Implement a robust, validated model of risk maturity.
• Incorporate measurements to help separate intended behaviour from actual behaviour and highlight where the ‘gaps’ or ‘trade-offs’ occur most.
• Help link risk culture insights to all aspects of your business and people strategy, in order to develop real insights on how to drive performance through improved risk maturity.
Start a conversation with us
If you would like to assess and develop the risk culture within your organisation, get in touch with us today.