AdSlot 1 (Leaderboard)

Capitalising on culture

SIX YEARS on from the global financial collapse, the UK is starting to see increased confidence in the economy and we seem to be turning a corner. In 2008, the general consensus was that “organisational culture” in financial institutions was a major contributing factor to the economic crisis. For most of the intervening years, culture has remained on the agenda.

Several financial institutions have changed leadership and many have defined a new tone at the top in a bid to rebuild the reputation of the sector. Most financial organisations report that they have increased their focus on both culture in general and specifically on risk culture.

Conduct risk and risk culture are now both firmly on the regulatory agenda, but financial performance is also improving for many institutions. Against that background, many people have started to ask: if performance is improving, surely the fundamental organisational culture issues have been addressed and the ‘culture crisis’ is over? Given the change in the economy, is it even important any longer?

Christine Lagarde, the boss of the International Monetary Fund, who spoke on the subject recently, clearly thinks not. Not enough has been done and the change in culture required within our financial firms so far is “not deep or broad enough”. Financial institutions need to “take values as seriously as valuations” and see “culture as seriously as capital”.

Understanding culture and risk culture
We may have come a long way since 2008 but there’s still further to go towards embedding the conscious management of culture into the strategic agenda of organisations.

There are a number of definitions of organisational culture, but one that seems to get right to the heart of the matter comes from Herb Kelleher of Southwest Airlines in the US. He said “Culture is what people do when no one is looking”.

Often quoted, and misquoted, Kelleher understands that leaders need to build and sustain an organisational culture that prevails even when they are not around to oversee the day to day behaviour of their workforce. In the case of the financial services sector, ‘risk culture’ is about how people actually behave and deliver risk management practices when no-one’s watching.

While many leaders will recognise the increased focus on culture and risk culture from the regulators, not all have translated this focus in to their own strategic agendas. This in itself carries an inherent risk. Leaders who fail to manage their organisation culture will find that over time, it starts to manage them.

A global survey carried out by Protiviti last year found that three quarters (74%) of respondents felt they had a clear understanding of risk culture with 57% stating that they evaluated it in some way (albeit through subjective methods such as management self-assessments).

So why do so many organisations still bury their heads in the sand when it comes to truly understanding and managing their culture? In reality, culture often gets parked in the “too difficult” box. It’s viewed as ill-defined, difficult to grasp, something that could be of great benefit but also something that just gets in the way of good business.

Yet culture, really, is fundamental to how an organisation behaves and performs. The risk is that by ignoring risk culture you really don’t know what people are doing behind your back.

It’s about getting the balance right
Protiviti, in tandem with the Risk Management Association, have come up with following definition of ‘risk culture’: “It is the set of encouraged and acceptable behaviours, discussions, decisions and attitudes towards taking and managing risk within an institution. Risk culture reflects the shared values, goals, practices, reinforcement mechanisms, and attitudes that embed risk into the institution’s decision-making processes and risk management into its operations.”

In the wake of the financial crisis, it is no longer good enough to hide behind risk management frameworks, risk appetite statements, processes and procedures and say – “we’ve got it covered”.

Too often though, when people look at failings in risk management they focus on the processes and fail to look at the behavioural aspects. Effective risk culture is about achieving the right balance between the physical aspects of a risk management framework and those behavioural aspects. It is critical to have alignment across both so that everyday behaviour supports and enhances processes within the risk management environment, rather than undermining them.

Achieving that alignment will come through building a better understanding of the current organisational and risk culture that exists within an organisation. Understanding the current position will help leaders identify the basic underlying assumptions and the values that are driving the way their people do things.

Investing in a robust diagnostic survey tool can provide leaders with a method for assessing the culture against a number of management practices and translating this in to business language. The results of such surveys will identify possible gaps that need to be addressed to bring the organisation to a more balanced position.

Culture and the bottom line
An organisation’s culture and management of risk should be viewed as being just as important as more traditional business concerns such as cashflow, branding and product development i.e. an integral part of a firm’s strategic agenda, whatever the economic environment.

And despite an improving economic environment, the focus on risk culture by regulators is growing in intensity. The challenge for businesses is to retain their own levels of intensity in the assessment and management of their own risk cultures.
Managing organisation and risk culture is good business sense and can enable the overall performance of an organisation and its people, leading to a better working environment and stronger business model – whatever the economic outlook.

Culture should be an integral part of the overall strategic agenda. It connects every single function and every single employee no matter what level.

Peter Richardson is managing director at Protiviti UK

Related reading

/IMG/350/328350/intelligence-database
/IMG/022/271022/diamonds44
/IMG/932/163932/export
/IMG/370/178370/graph-arrow-upwards-growth

  • Addressing the aspect of people risk is the only way an organisation can improve the way their people respond to a situation of risk and the effectiveness of their risk management function.

    Risk Culture Building is the process of growth and continuous improvement in the way each and every person in an organisation will respond to a given situation of risk as to mitigate, control and optimize that risk to the benefit of the organisation.

    [This comment has been amended]

  • Lisa McCarthy

    A very well written article, that really highlights the importance of organisational culture. So often, “risk” and “culture” are separated out, with “risk” being seen as a hard business process that needs attention, while “culture” is more easily ignored. However, linking the two together can go a long way to raise the profile on the executive desk. Let’s not take our foot off the pedal now.

    • Lisa. Absolutely! Too often we over-emphasise often in a “tick box” manner, the “mechanics” of risk management i.e.the governance, systems, processes and procedures, and overlook, at our peril, the “dynamics” i.e. the culture and the people.