Home > Risk > Is asking about risk culture the right question?

Is asking about risk culture the right question?

November 3, 2017 Leave a comment Go to comments

Everybody is talking about assessing and addressing risk culture.

They talk as if risk culture (the beliefs and so on that drive risk-taking behavior) is not only a major factor in whether risks are at desired levels, but is consistent across the organization.

But, while culture is a major driver of behavior (of all types, not just risk-taking), it is most certainly not consistent.

Consider the executive team.

Do they have an identical attitude towards taking risk? Aren’t some more careful and cautious than others? Isn’t there often a healthy debate when it comes to the timing of product launches or expansions into new markets?

If you don’t have a consistent attitude towards taking risk among the few members of the executive team, how can you expect to have a consistent attitude among the population of employees and decision-makers?

I am not saying that attention should not be paid to culture. If there are conditions (such as severe penalties and repercussions for making a mistake) that can drive behavior in the wrong direction, it is important to understand and address them.

What I am saying is that we should ask a different question.

How can we be reasonably sure that decision-makers will take the desired level of the desired risks, the level of risk that the board and top management want taken to achieve objectives?

Follow that with asking who (individuals and teams) is more likely to take a different level of risk?

Now that we have identified the potential sources of poor risk-taking (and decision-making, by the way), we can start to think about what we are going to do about it.

Options might include expanding or shrinking how we empower certain employees to make decisions and take risks without approval.

Let me close with this.

Are you paying too much attention to risk culture in general and not enough to people who you (or top management) are not confident will make intelligent and informed decisions and take the wrong level of risk (which may either be too little or too much)?

I welcome your comments.

  1. George Yap
    November 3, 2017 at 8:16 AM

    Risk cannot be differentiated by culture.

    The will of managing risk rest with the Board of Directors, and by delegating risk to Executive Committee is no excuse. When the horse has bolted its too late.

    There is no excuse that culture allows shades of risks profile….its not proper question.

    In fact the right question is to have a personality profile assessed aligned with lifestyle assessment annual declaration of income and net assets year by year be properly analysed, and Boards that ignore this aspect as the individual’s attitude to honesty, integrity, reputation and accountability with responsibility is done properly is meeting the obligations of an independent board consensus.

  2. Nik
    November 3, 2017 at 9:03 AM

    I’m not convinced there is something called “risk culture” that is meaningfully separate from just corporate culture. Your recent post titled “Are we doing enough about behaviour?”, and the article you linked to there, suggests that the lines between the two are very blurred at best.

    We can always have a specific conversation about the pros and cons of different kinds of actions and their consequences (and we might label this a “risk conversation”) but whatever we agree in that conversation is still tangled up with our overall corporate culture.

  3. Khanh Vuong
    November 4, 2017 at 3:57 AM

    There are times and circumstances when culture clearly exerts an overwhelming influence on personal and professional decisions. This is when culture becomes a factor to contend with as a part of risk management. At most times, however, when an organization’s culture is not particularly relevant, bringing it to the forefront of a risk management program can turn into a mostly academic exercise.

  4. Hans Læssøe
    November 6, 2017 at 12:56 AM

    The risk culture is an opaque entity behind a lot of decisions – and hence one I am sure is difficult to address directly. Instead, a company/organisation can use more tangible measures such as risk appetite (level they are willing to take, and therefore do not bother to mitigate) and risk tolerance (level beyond which risks are unacceptable).

    Having these, management will known when they can allow themselves to take on more risks, and when they are fully utilizing the risk tolerance (often provided by the Board). When that is done consistently, and eg. the board pushes for more boldness when they can see that the actual risk profile/exposure is well below the risk tolerance – they inherently drive a risk taking culture.

    Somebody stated “you cannot manage, what you can’t measure”. That goes for culture as well.

  5. vincent tophoff
    November 6, 2017 at 6:05 AM

    The right question is: “Does your organizational culture encourage people to take (related) risk into account when setting and achieving their (strategic) objectives?”

    • Norman Marks
      November 6, 2017 at 6:36 AM

      Vincent, yes – but is this sufficient when we know not only that individuals are individual but their attitudes towards change risk change?

  6. MD
    November 28, 2017 at 3:14 AM

    Risk and organisational culture are inextricably linked as with the chicken and egg debate. I think there is greater value in making risk management more tangible through risk appetite discussion and education on decision making cognisant of the risks involved. It would be rare to find an organisation without a delegated level of authority framework for financial expenditure but you would be hard pushed to find a dla for making decisions about taking and avoiding risk.

  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: