There has been much talk of cultivating “risk culture” since the financial crisis. That message has been underlined by a swathe of regulatory change and a large amount of industry guidance. It may now be possible to suggest that for the savviest of financial institutions, risk management has become so embedded at the forefront of their culture that it is actually leading changes and driving innovation. New products are being built around new concepts of risk and the creation of positive customer experiences.
While senior roles are seemingly inseparable from the influence of risk culture, in many businesses the question remains whether that attitude is shared across the entire organisation. If it is not, there is a further question as to how organisations ensure that behaviours and attitudes towards risk, at every level, are nurturing and not hindering the ongoing development of the desired risk culture and the benefits it can bring.
The need to assess behaviour and attitude
The culture change since the financial crisis has effectively been the biggest and longest running change management projects the financial services industry has seen. Like any organisational change, the way to know whether it has really been successfully implemented is to look at the way the change has been adopted across the business.
Is your risk culture firmly embedded in the very fabric of the organisation? Is it naturally reflected, without being awkwardly forced, in employees’ behaviours and attitudes? Senior employees may be on board with the risk culture, but is the “tone from the top” filtering down successfully to the employees on the ground and translating into good customer outcomes?
The Financial Stability Board in its Guidance on Supervisory Interaction with Financial Institutions on Risk Culture touched on some of the complex issues around culture and the way behaviour and attitude affect it. With an inadequate risk culture often being cited as the primary contributing factor of the global financial crisis, the report identified that any comprehensive compliance review must include an assessment of the level to which risk culture has been adopted within an individual organisation. That way it can identify and then address areas of weakness.
After all, a business’ norms, attitudes and behaviours directly influence the kind of actions and decisions the people within that business are making on a daily basis. If risk culture has been embedded properly, employees in all areas of the business will be operating in a legal and ethical manner.
Creating an environment that promotes integrity
The Financial Stability Board identified a number of important aspects that influence an institution’s risk culture including:
- adequate accountability of employees at all levels of the business;
- open communication and the freedom of employees to challenge and critique decisions (staff should feel free to “raise their hand” and question);
- and incentives that support core values and the culture of risk.
These elements should promote the integrity of risk culture by encouraging integrity at the individual level. Behaviours and attitudes are always tricky to assess but ensuring a risk awareness framework is in place and that the board and senior employees are leading from the top will help to foster that mindset among employees closer to the cogs and gears of the business.
Embedding those culture changes
The importance of the senior management skill set when it comes to risk culture cannot be undervalued. Some common recommendations to ensure this are schemes like job rotation between function and business lines to facilitate the circulation of knowledge across different parts of the business and introducing risk awareness to the decision-making process of the business line. Other alternatives include utilising senior interim professionals who specialise in cultural change to help assess and guide the process for organisations senior leadership.
Employee training also plays a big part in ensuring behaviour and attitudes towards risk are aligned across all areas of the business. Making training programmes available to all staff to develop risk management competencies for example was highlighted as one way to help create and reinforce positive risk behaviours and attitudes.
A multi-faceted approach
If management is to see the true value of risk culture reflected in the business, its implementation must be regarded as an ongoing project which involves multiple departments within the business from HR to IT and the communications function. Engaging an interim or skilled project manager who has experience in working though change programmes will help to guide this process, as well as offer best practice solutions to solving some of your areas of weakness.