Understanding risk culture and its effect on performance
The culture of a people is defined as the sum of attitudes, customs, and beliefs that distinguishes the people from another. These attitudes, customs and beliefs affect all practices of the people or organisations including their risk management practices.
Advertisement
Effective risk management, therefore, requires the right culture, be it in the household, business, community or the nation. Without the right culture, any worthwhile risk management process and system is unachievable, (Freeman, 2013). This right culture is what is known as risk culture.
According to the Institute of Risk Management – (IRM, 2012) risk culture describes the risk management values, beliefs, knowledge and understanding that is common to a people with a shared purpose.
Risk culture is, therefore, the aggregate set of individual and collective values, attitudes, competencies and behaviours that demonstrate the risk management approach of any group of people.
Determinants of an effective risk culture
In 2013, the Financial Stability Board, an international body that monitors and makes recommendations about the global financial system, identified four key contributors to a strong risk culture.
According to the board, the effectiveness or otherwise of these factors will go a long way in determining the risk culture of any organisation.
Tone at the top
Tone at the top refers to the ethical atmosphere that is created in the workplace by the organisation's leadership. Whatever tone management sets will have a trickle-down effect on all employees.
If the tone set by management upholds ethics and integrity, employees will be more inclined to uphold those same values. However, if management appears unconcerned with ethics and focuses solely on the bottom line, employees will be more prone to commit fraud because they feel that ethical conduct is not a focus or priority within the organisation.
Employees pay close attention to the behaviour and actions of their bosses, and they follow their lead. Thus, if management bends the rules, everyone will also bend the rules.
If leaders fail to do the right things, no matter how much they preach the doing of the right things, it simply will not get done, be it in the household, community or the nation. Indeed the tone at the top is the unseen hand that directs and controls activities regardless of the stated policies and objectives.
Accountability: Accountability is the obligation to account for actions, accept responsibility for them, and to disclose the results in a truthful manner. To determine the risk culture of an organisation one needs to understand how various stakeholders, including employees and managers, are held accountable for their action.
According to Chandler and Plano (1988), “Accountability is a condition in which individuals who exercise power are constrained by external means and by internal norms.” Whether in the private or public sector, employees need to understand that they will be rewarded or held to account for their behaviour.
An unclear understanding and lack of enforcement is the reason for the culture of impunity we see everywhere in our nation.
• Effective challenge: An effective risk culture will facilitate the constructive challenge of long held opinions and practices. This means that employees must be encouraged to provide alternate views or questions.
These should be valued and respected and should be allowed to occur in practice. There should also be processes or mechanisms in place to ensure that alternate views can be expressed in practice.
Many organisations always boast of having a non-retaliatory policy but this is only in theory as there are no structures in place to ensure employees can actually challenge and report actions that are not in line with the organisation’s policies.
This is compounded by our culture of silence, in a typical Ghanaian traditional setting no one challenges the opinion and actions of those in authority.
• Compensation: There is an old adage which says, “If you want to understand why people behave the way they do, ask how they are paid”. This is as true today as ever.
In an effective risk culture, compensation, including career development, will be geared towards the long-term interests of the organisation. Inappropriate pay policies will eventually lead to failures as seen in the organisations affected by the global financial crisis.
Desired competencies for key management positions should include risk management experience and not only revenue-based accomplishments. This is because understanding the key risks inherent in the operations of the organisation is a critical skill set for effective management.
Advertisement
Relationship between risk culture and performance
Following the GFC, a number of studies commissioned to investigate the corporate failures drew linkages between risk culture and organisational performance. The Walker Report concluded that the principal causal agents in many cases were behaviour and culture (Walker, 2009).
The European Commission (EC) also highlighted the “absence of healthy risk management culture” as the cause of the organisational failures (EC 2010).
According to Ashby et al. (2012), the concept of risk culture has grown steadily since the GFC. The term did not appear much in literature prior to the GFC. Risk culture is, therefore, an emerging terminology which encapsulates an organisation’s risk management practices.
Advertisement
The very definition of risk management implied that every business needs to take risks to achieve its objectives and fulfil its vision. Thus the existing risk culture within any organisation, can enhance its collective performance.
An organisation’s risk culture can greatly impact its capacity to take “strategic risk decisions and deliver on performance promises” (IRM, 2012). Defects in risk culture were, therefore, seen as a precursor to the business failures documented by various commentators on the corporate failures leading to the global economic crisis, (Walker, 2009; House of Commons Treasury Committee, 2009).
Conclusion
Conclusively, it is important to note that many corporate failures are attributable to weak risk cultures (Ashby et al., 2012). Indeed, much of our failings are as a result of the lack of the understanding and blatant disregard for simple risk management practices.
In a prophetic tone, organisations with inappropriate risk cultures will inevitably allow activities that are completely at variance with their stated objectives. Thus resulting in failures.
Advertisement
However, it is important to underscore that no organisation, be it the household, business entity or even the nation can develop an effective risk culture without the active support of its leadership.
The writer has extensive experience as a risk management practitioner and a business consultant. Presently he is the Country Risk and Quality Manager for PricewaterhouseCoopers (Ghana) Limited. You can reach him at: benjamin.kpodo@gh.pwc.com).