RiskUKAugust2017

State of Mind: Developing ‘Risk Culture’
intelligence. Risk professionals often deal with
culture as if it can be controlled and managed
rather than recognising its evolving and
complex character. Disciplines such as
psychology and organisational development
which bring methodologies for working with
organisational cultures remain little explored.
When organisations attempt to change their
risk culture, they often delegate that objective
to risk professionals: individuals ‘siloed’ in their
functional discipline and who perhaps lack
broader operational leadership experience.
Alternatively, this task is delegated to Human
Resources professionals who may not
understand financial risk, for example.
Risk culture needs the support of leadership
across the whole business to change
effectively. A series of high-profile fines and
failures in the finance world over the last
decade show that approaches based on
conventional risk processes have little impact.
During the last few
years, we’ve moved
from thinking about
risk as a technical
issue to
understanding that,
once the technical
basics are covered,
it’s primarily one of
culture. What kind of
risk culture prevails in
your organisation?
How does it influence
risk management?
How might you
transform your risk
culture such that it’s
then a key asset in
managing risk? Alex
Poppleton addresses
these core questions
The 2008 financial crisis was underpinned
by ineffective and entrenched risk cultures
in investment banks. Following the crash,
financial regulators began asking for evidence
of how institutions were changing their ‘risk
culture’ and, in the time since, the idea that
‘risk culture’ is a critical aspect of managing
risk has steadily gained currency.
Dr John Kotter, founder of Kotter International
and Emeritus Harvard Professor of Leadership,
has spent decades studying the factors that can
derail even the best-laid of business plans.
Kotter’s research demonstrates that 70% of
transformation efforts still fail to meet the
expectations that were laid out when those
efforts began. Kotter has observed that the
human factors critical to effective change can
become lost in the simplicity of a ‘formula’.
Despite this history, the idea that you can
transform culture primarily through a predetermined
process or project plan has
pervaded our organisational life. However, a
key challenge for today’s risk management
professionals is that they often don’t have
experience of the leadership capabilities
needed to change the culture of their business.
Typically, risk has been understood primarily
through systems and processes, creating a
tendency to value numeracy over emotional
Complex and nuanced
Dr Kotter’s work demonstrates that only 5% of
organisations fully succeed or exceed their
transformational intentions. Culture change is
critical to that success. Risk culture isn’t about
binary compliance or non-compliance. Rather,
it’s complex, nuanced and intrinsic to the
organisational DNA. So can it be ‘changed’? The
answer is ‘Yes’, it can, but institutions first need
to alter their frame of reference.
To draw a parallel here, we generally accept
that we’re not able to ‘manage’ national
cultures. Rather, we generally experience them
changing over many years. Attempting to treat
risk culture as part of a project plan belies its
intrinsic complexity.
Many begin to look at organisational culture
change by defining the behaviours that will be
needed as a future ‘blueprint’. However, as
becomes obvious once you deal with complex
risk, behaviour alone isn’t enough. Individuals
can display the right behaviours, but with the
wrong motivation, which still represents a key
risk. This critical insight demonstrates the need
to look beyond behaviours in organisational
change initiatives which would otherwise
operate on a superficial level.
Risk professionals understand that rules and
procedures are of limited value without a set of
underpinning principles to guide decisions. For
their part, organisations are increasingly
recognising the need to move from setting out
rules to establishing guiding principles.
24
www.risk-uk.com