Risk culture under the microscope

Since the 2008 financial crisis, there has been increasing interest in organisational behaviour and culture. These factors are perceived to have been important determinants of the crisis and of many misconduct cases. But a dozen years on, what have we learned?

Financial services is still the least trusted industry sector, according to the 2020 Edelman Trust Barometer. Trust levels for the financial services industry run at 56% compared to the technology sector which tops the table with a trust rating of 75%.

At the same time, financial institutions worldwide have been fined $39 billion since 2008, the majority of which has been for sanctions and AML breaches. This speaks of a cultural malaise that cannot necessarily be fixed with better PR, more rules, or enforcement.

Culture defined

Culture is something we think we intuitively understand, until we have to define it. It’s often thought of as ‘the way that things are around here’. Or sometimes ‘the way that things get done when no-one is looking’. Although how they get done when everyone or only some people are looking is just as important.

A more formal definition is that culture is the collective assumptions, values, beliefs and expectations that shape how people behave in a group. This makes it more than a mission statement or list of company values. It’s how these are put into practice — how they are lived every day in the organisation that matters.

This impacts things such as what are the consequences for violations? How is culture taught to new joiners? And does a discussion of how culture has been lived form part of performance reviews and reward?

Culture is specific to an organisation. A one-size-fits-all culture is neither possible nor desirable. Naturally, several cultures may exist within an organisation. It would be unusual for the culture of the sales and finance departments to be the same, even within the same organisation. Cultures will also vary between organisations in the same industry, and over time.

Why culture is important

No-one said culture was easy, but it’s certainly important. Why? Because managed correctly, culture can be an economic and strategic asset. It can complement and support an organisation’s financial performance, plus be a source of competitive advantage and differentiation.

Two companies may have similar strategies and ways to implement them. But as culture shapes how things are done, what is valued and what isn’t within an organisation affects outcomes.

There has also been acknowledgement from regulators that rules and enforcement can only go so far. Sometimes too much regulation can be counterproductive. To take an example from another sector, investigations into failures of child protective services have shown that more policies and procedures would not have prevented recurrences.

In other words, slavish letter-of-the-law compliance and ensuring that ‘correct’ practices are followed is not sufficient to prevent wrongdoing in organisations. If people’s behaviour is driven by psychological and emotional factors rather than by logic, then it cannot be guaranteed by rules alone. The underlying corporate culture also has a significant role to play.

How to build a healthy culture

There are no silver bullets or quick fixes to culture. It’s a dynamic process that takes time. However, healthy cultures often have specific characteristics that educe harm. For example, a shared sense of purpose across the organisation and alignment between this and the firm’s values, incentive structures, policies and procedures.

Leaders clearly set out what is expected of everyone. They lead by example, walking the walk as well as talking the talk. This ‘tone from the top’ is essential. But it’s not enough to build a healthy culture, because culture involves everyone in the organisation. It only occurs when people’s experiences of how the organisation works together consistently match the defined values and behaviours. And when poor behaviour is challenged and addressed.

Risk professionals: your time is now

Risk professionals can add valuable insight to the cultural debate from their daily practice. When it comes to risk appetite in theory and in practice, they can offer advice on how to avoid conflict between risk appetite and performance goals to build an effective risk culture.

They have direct practical experience of compliance and due diligence. They can influence management’s attitude towards risk, so compliance breaches are not tacitly accepted even if they lead to results.

And with regard to ethics, integrity and reward systems, risk management professionals can directly input into how to champion integrity as part of corporate culture. This may be around admitting mistakes, being transparent or ensuring rewards are commensurate to performance and discourage poor behaviour.

Successful companies did not get to where they are today without taking risks. But it’s only those with healthy risk cultures, structures and confidence in them, who can be more enterprising and entrepreneurial. In short, take more calculated and controlled risks to boost their business, reputation, and bottom line.

‍

It’s time to put risk culture under the microscope and ensure it’s fit-for-purpose in 2020 and beyond. Risk management professionals are front and centre of this endeavour. We live in cultural times. If you work in risk management, your time is now!