The underrated benefits of a healthy risk culture

We’ve been helping financial services leaders in the Nordics to tackle these issues, explore the future of financial services, and understand risk management in a world of conscious consumers. And in a continuation of our series on value-adding risk management, we wanted to explore the necessity of a conscious risk culture – an organisation’s shared values, beliefs, and behaviours towards risk.

An untapped resource

While ‘risk culture’ can sound soft and fluffy, it has a tangible, hard-hitting impact on business if you do not get it right. Too much aversion to risk can become a harmful blocker for innovation or lead to lack of accountability due to the fear of penalty. On the other hand, too little risk awareness, or a risk appetite that is too high, brings its own issues. In the best-case scenario, this leads to extensive control setups and loss of investments; worse-case, it will lead to devastating issues owing to non-compliance.

In our work across markets, we see all of the different scenarios. Organisations caught by inertia who fail to adopt a new technology due to the perception that compliance is too cumbersome and/or a blocker to initiative; and clients who miss return on investment because they realise too late that what they have built will not be compliant or require large remediation programmes.

So, a healthy risk culture – one with the right balance – can serve as a source of stability and growth. Yet when we spoke to Nordic financial services leaders working in and around risk management, we found that:

• Sixty-three percent say that the lack of a risk culture is their biggest blocker to effective risk management
• Risk culture is rated as the second least mature aspect of organisations’ risk management frameworks, second only to control frameworks and assessments.

While risk culture is recognised as a key enabler for successful risk management, many organisations are still failing to connect risk culture to wider business value. So, how can leaders start fulfilling the potential of a healthy risk culture?

Define your desired culture

Your organisation’s attitude and approach to risk should reflect and be developed alongside its broader strategic ambitions. The leadership team needs to proactively define the values that support the business – emphasising the value of risk management. And if leaders can talk about risk in the right way, it changes the attitude and outlook for the whole business.

Tone from the top is not just what you say, but also what you do. Leaders need to walk the talk. It’s their job to model the attitudes and behaviours, as well as communicate them effectively. They need to facilitate an openness that allows people to feel they can and should speak up – and to demonstrate that they will listen to, act on, and escalate the issues raised to mitigate or ideally prevent larger incidents.

Assess your current risk culture

Assessing and evaluating to which degree a risk mindset is embedded in your current risk culture is a crucial next step. This allows you to work out where you are before defining where you need to get to.

Common indicators of a healthy risk mindset include a distinct tone from the top and incentives that support the values you promote. But reviewing policies and incentives structures are not enough. You need to understand structures, and processes, and look under the surface – for instance by listening to colleagues.

Other positive indicators include signs of effective communication around accepted and sanctioned behaviour, and clear accountability throughout the organisation. The last of these might be evidenced by employees proactively considering how certain changes in society or macroeconomics might impact their processes and customer behaviours, and the consequences of this throughout the wider organisation.

One example of a distinct tone from the top we’ve seen was in relation to a remediation project at a Scandinavian bank, where the director in charge actively promoted a ‘leave no stone unturned’ approach, while also taking the time to listen to all issues raised. This resulted in employees identifying and solving root causes, rather than simply treating symptoms while still taking damaging shortcuts.

Identify and delivering the changes

Leaders often tell us that risk management in financial services has become complicated and unwieldy. There might be a range of standard operating procedures that lead people to respond differently in similar situations. And many processes can feel like box-ticking exercises that fail to achieve anything.

To transform your risk culture into something that adds value, you’ll likely need to revisit the systems currently in place. Any redesign should clearly reflect your organisation’s appetite and attitude to the many different types of risks that financial services organisations face.

You’ll also want to close the gaps between your current and target culture. You might find that areas of accountability, such as decision mandates, are unclear, which would require clearer role descriptions and updates to governance structures. Or you might appoint risk champions across the business units to address potential reluctance towards using risk management tools. Along the way, this level of change will call for a plan supported by clear communication about the changes proposed. It might require redesigning operating models and managing significant change, but it will be a journey worth making – turning risk management into a powerful enabler for your business.

Tracking the changes

With the risk landscape ‘always-on’, the route to transforming an organisation’s risk culture – and evaluating it – must be more than a one-off exercise. It requires continuous evaluation and refinement – such as through leadership dialogues and – communication, and surveys that continue to assess the current risk culture. The goal is to reach a risk-aware culture; one that is neither risk-obsessed, nor neglectful of it. This means ensuring you continuously discuss and respond to risk in alignment with the evolvement in risk appetite, risk exposure, and types of risks.

Along the way, some indicators will be useful – and can provide quantitative insight around, for instance, the number and severity of operational incidents reported – or the time between an incident being detected and the response being initiated. But organisations should be wary about focusing too much on metrics. Instead, dedicate time and effort on dialogue to understand if the structures and processes in place support the desired risk culture.

The impact of culture

With simpler and streamlined risk management processes enabled by a sound risk culture, senior management will be better equipped to make informed decisions considering all the key risks that the organisation is facing. This should strengthen resilience, bolster compliance, and increase stakeholder confidence. Most of all, competitive advantage will come from the enhanced ability to anticipate and respond to emerging risks.

Elsewhere in our survey, our data uncovered the importance of recruiting the right people and managing data. In our next article in the series, we explore how those challenges can also translate into opportunities.

Coming next

This article is part of a series that delves into the future landscape of risk and regulation in financial services. In our ongoing exploration of this critical domain, we aim to empower leaders with insights and strategies to navigate the evolving landscape of risk management.