What Is the Definition of Risk Culture?
The Institute of Risk Management (IRM) defines a risk culture as the values, beliefs, knowledge, attitudes, and understanding of risk shared by a group with a common purpose. This applies to all businesses and organisations, including private companies, public bodies, governments, and not-for-profits.
Risk management identifies, assesses, and manages risk threats and opportunities to a business.
The importance of risk culture within risk management cannot be underestimated.
Risk culture is the values, beliefs, knowledge, attitudes, and understanding of risk shared by a business’s stakeholders.
Associated with risk culture is the business risk appetite – the amount and type of risk a business is willing to accept in pursuit of key objectives.
Risk tolerance reflects the acceptable variation in outcomes linked to key objectives the company seeks to achieve.
Don’t be fearful of risks. Understand them, and manage and minimise them to an acceptable level.
Naved Abdali
Key Takeaways
- Risk Culture is Shared Behaviour: It is not just a set of written rules, but the actual everyday values, beliefs, and behaviours regarding risk-taking shared by everyone in an organisation
- Align Appetite with Objectives: A healthy risk culture ensures that the company’s “risk appetite” (the amount of risk it is willing to take) directly aligns with its strategic goals and long-term success
- The “Tone at the Top” is Critical: A strong risk culture fails if senior management says one thing but middle management rewards another. Consistent communication and active leadership involvement are essential
- Accountability Needs Resources: To make risk management practical, individuals must have both the clear authority and the proper resources to manage and escalate risks when they arise
- Avoid One-Off Fixes: You can’t build risk culture through intermittent training or surface-level campaigns. It must be integrated into daily operations, performance reviews, and company governance
What Do We Mean by a Great Risk Culture?
Risk culture refers to the encouraged and acceptable behaviours, discussions, decisions, and attitudes toward taking and managing risk within a business.
A great risk culture binds stakeholders, risk management frameworks, and processes together to reflect values, strategic goals, and practices and embed them into a business’ decision-making processes.
What Is a Great Risk Culture for a Business?
A great risk culture aligns a business with its key objectives.
What Are the Key Elements of a Risk Culture Framework?
The IRM has developed a risk culture framework to help influence an effective risk culture within any organisation.
The diagram simplifies a complex and interrelated set of relationships into a high-level approach to the various influences on risk culture.
How Do Individual Behaviours and Risk Predispositions Affect Culture?
The business may employ people who view risk differently from the Board. For example, these individuals may be more willing to take risks and break the rules. There may also be a concern that the corporate culture attracts and encourages individuals with an ethical stance different from the Board.
People differ and bring varying perceptions of bias and risk predisposition to companies.
Personality research identified two traits that contribute to bias – the extent to which people are:
- spontaneous and care less about tradition, or they are organised, systematic and compliant
- cautious, pessimistic and anxious, or optimistic, resilient and fearless
What Role Do Personal Ethics Play in Managing Business Risk?
Businesses should pay attention to their employees’ ethical profiles. Each individual brings a mix of moral values across different issues. These significantly influence the decisions they make day to day. Ethical principles include:
- Obedience – rule compliance, the spirit of the law, etc
- Care – empathy, concern, respect, etc
- Reason – wisdom, experience, prudence, etc
How Does Overall Organisational Culture Impact Risk Management?
Overall organisational culture shapes an individual’s values, beliefs, and attitudes toward risk. It’s helpful to employ the sociability vs solidarity model (Goffee and Jones, 1998), also called the “Double S” model, which considers culture with two dimensions:
- sociability (people focus – based on how well people get on socially)
- solidarity (task focus – based on goal orientation and team performance)
The model identifies four distinct organisational cultures described:
- Networked (high people focus, low task focus)
- Communal (high people, high task)
- Mercenary (low people, high task)
- Fragmented (low people, low task)
Risk Culture
Risk culture can be hard to understand because it covers an organisation’s ability to manage risk.
It may seem like a background concept, but business culture influences risk culture. Risk culture is a broad topic because it covers an organisation’s collective ability to manage risk. Still, the more general case of a business’s culture is also influenced by its risk culture, including:
- Attitude – the way an individual or group perceives and deals with risk, influenced by perception, predisposition, and mindset
- Behaviour – observable, risk-related actions, including risk-based decision-making, processes, communications, etc
- Culture – values, beliefs, knowledge and understanding of the risk a group shares with a common goal. In particular, it is the values, beliefs, knowledge, and understanding shared among leadership and employees
One cultural issue is that people naturally gravitate toward others who share their culture. An organisation’s culture can self-propagate if recruitment processes and the environment remain unchallenged.
Every organisation has a risk culture, or indeed a culture. The question is whether the desired culture effectively supports or undermines the organisation’s long-term success.
What Primary Factors Impact an Organisation’s Risk Culture?
Why Is Hiring the Right People Essential for Risk Culture?
Hiring the right people is essential to a robust risk culture because individual mindsets and behaviours heavily shape an organisation’s collective ability to manage risk.
Every employee brings a unique mix of moral values, personal ethics, and perceptions of risk, which significantly influence day-to-day decision-making. Without careful alignment in the recruitment process, a business risks hiring people whose ethical stances or rule-breaking behaviours conflict with the standards the board sets.
Because people tend to gravitate toward others who share their cultural outlook, hiring practices can inadvertently perpetuate a flawed culture if left unchallenged.
Hiring people who respect compliance, accountability, and the spirit of risk governance helps build a proactive, resilient workforce that supports long-term corporate success rather than undermines it.
How Does Employee Behaviour Create or Mitigate Business Risk?
Behavioural risk management refers to controlling and mitigating employee and organisational behaviour risks.
Individual risks are behaviours by employees and leaders that could expose the business to risk.
Organisational behaviour is collective behaviour, and some of these behaviours could pose a high risk to the business.
What Is the Impact of Regulatory Compliance on Risk Culture?
A robust regulatory compliance system within effective risk management will considerably impact a business. It will make it less likely to experience risk-related events and ethics violations.
What Rights and Responsibilities Do Employees Have Regarding Risk?
From a health and safety viewpoint, employees have rights and responsibilities for their and colleagues’ well-being. This extends to the risk culture and includes risks associated with the business, helping maintain a healthy culture.
How Should Senior Management Involve Themselves in Risk Decisions?
The Board must make effective risk decisions about what they expect from the business.
They need to communicate their attitude towards risk-taking and risk tolerance and explain the difference in impact between a successful and unsuccessful risk as measured by target metrics.
What Is Risk Governance and Why Does It Matter?
It’s the rules, methods, processes, and measures we use to make decisions about risk. It’s both negative and positive because it analyses and formulates risk management strategies to avoid (threat) or achieve (opportunity) risks.
Why Is Clear Accountability Critical for Long-Term Risk Success?
Many people know the term “accountability” but do not appreciate its value to an organisation’s long-term success. This includes safeguarding against irreversible damage and reputational risk.
To make risk accountability practical, the business line must know the acceptable limits on risk-taking.
The accountable person must have the resources and authority to manage the risk.
How Should Risk Issues and Escalation Protocols Be Managed?
Escalation is the progressive increase in the intensity or spread of risk.
A risk management system must have a process in which increasingly higher levels of authorisation are required to approve a continuous tolerance of increasingly higher levels of risk.
A contingency (plan) is designed to reduce the impact if a risk materialises. Consider developing contingencies for threats and opportunities against the business risk attitude and risk tolerance.
How Do You Handle the Assessment and Evaluation of Risk Culture?
A strong risk culture will improve risk management performance. Because risk culture often evolves as the organisation grows, it may make sense for organisations to self-assess, survey, and use focus groups and other techniques to understand the current state of risk culture.
How Does the Organisational Tone Distort Risk Communication?
The term tone refers to the combined impact of all stakeholders on risk management. Communication from the Board level will have little effect if business employees and other stakeholders hear a different message from line managers, supervisors, and other contacts daily.
Information often gets distorted as it moves from one management level to another. Contradictions in communication are more likely between team members at the organisation’s top, middle, and bottom. Equally, executive management may be unaware of significant financial, operational and compliance risks that one or more middle managers and employees may know.
Which Physical Mechanisms Drive a Strong Corporate Risk Culture?
It’s essential to consider your organisation’s tone and how tangible physical mechanisms can help control it. These mechanisms include a risk governance structure, corporate values, code of conduct and ethics statements, policies, procedures, risk oversight activities, incentive programs, risk assessment processes, risk indicator reporting, performance management reviews, reinforcement processes, etc. Companies and boards must examine risks, including strategic, operational, financial, and IT risks. They must also consider the organisation’s risk appetite, how different risks can interact, and how they are managed daily.
What Internal Attributes Power Daily Risk Decision-Making?
These internal attributes include the attitudes, belief systems and values that drive the organisation’s behaviour, activities and decision-making.
They demand attention but are not as quickly seen and understood as physical, tangible mechanisms. For example, how a business handles risk management, control, and audit often shows up in how it addresses weaknesses, escalates issues, and resolves problems. The method and timeliness, or lack thereof, in which such activities are carried out provide information regarding a business’s risk culture. So does leadership’s reaction, or lack thereof, to warning signs raised by the risk management process.
How Do External Attributes Shape Business Resilience and Risk?
These external characteristics include regulatory requirements and expectations of customers, investors and others.
How an organisation seeks out these requirements and expectations and aligns business processes through actionable improvements reveals its resilience.
How Do Subcultures Positively or Negatively Impact Risk Management?
A subculture helps a business stay agile in solving problems, sharing knowledge, and serving customers in response to a changing business environment.
However, they can also lead to rogue actors and risk-taking behaviours that harm the organisation.
What Is the Relationship Between Risk Culture and Business Culture?
A positive risk culture does not operate in a vacuum. As mentioned earlier, business culture influences it in many ways. Many argue they are the same thing.
How Can a Business Successfully Improve Its Risk Culture?
Because risk involves future uncertainty, it makes sense that a strong risk culture positions the business as proactive and agile. The business should quickly recognise a threat or opportunity and use that knowledge to evaluate its response.
Such a risk culture would give leadership and management a time advantage and better decision-making.
Another example of an attractive risk culture is maintaining a healthy tension between the business’s activities to create value and its activities to protect value. Ideally, one activity should not be disproportionately stronger than the other.
Once executive management assesses the current risk culture, it should consider whether organisational changes are needed and define the steps required to implement them.
In transitioning to the desired risk culture, management should try to achieve the following:
How Do You Embed Cultural Risk Changes Into Governance Processes?
Risk culture should be affected through the business’s overall risk governance process.
For example, reinforce risk management accountability through committee charters, policies, job descriptions, limit structures, and escalation protocols. These measures show the importance of responsibility and reinforce risk management accountabilities. Procedures and escalation protocols can also support the desired cultural risk behaviour.
How Can You Make Risk Culture a Priority for All Stakeholders?
All stakeholders must support a positive, desired risk culture by demonstrating the desired behaviours through actions and decisions over time and periodically communicating the value the organisation’s risk culture contributes.
Why Is an Integrated Approach Necessary for Lasting Cultural Change?
If addressed as a stand-alone initiative, change programs with intermittent communication, awareness promotions, and training strategies are mere surface dressing and provide little positive cultural change.
When integrated into a comprehensive program that aligns performance expectations, roles, responsibilities, and operational structures with appropriate risk attitude and tolerance, they reinforce the critical aspects of the desired risk culture.
What Variables Should You Consider to Periodically Evaluate Progress?
Regularly evaluate stakeholders during the change process. Before you begin, assess the business and understand the pitfalls to establish a baseline for the initiative. Here are some things to consider before putting things in place:
- Leadership support – Is leadership driving this initiative?
- Ownership of the business’ risk management process – Who is responsible for risk management, including the controlling and mitigating actions?
- Effectiveness of risk management and governance processes – Have the strategies been proven effective?
- Evidence of crucial business decisions taking risk and solvency into consideration – Consider the consequences of high-impact events and contingency plans
- Quality of leadership discussions on risk issues and escalated matters – Are these discussions honest, open and transparent?
- Is there a risk appetite statement and risk tolerances in decision-making? Do you measure how many risks were taken in the past year? How does this compare with how many were tolerated?
- Is risk aligned with and incorporated into strategic planning and direction? Is this aspect handled with care?
Every organisation is different. It is crucial to evaluate the business risk culture and make necessary adjustments to shape it over time in response to internal and external change.
Conclusion
The article now clarifies that any approach to changing risk culture must be carefully planned within the overall business strategy.
The recipe and mix of tools a business adopts depend on the current situation. There is no perfect answer for how to combine these elements to address the company’s risk culture and maturity. Several techniques can drive risk management adoption and embed a strong risk culture.
Creating a strong risk culture that encourages honest, open, and transparent disclosure of risks is an important starting point. What can be measured can be managed, and in many ways, this is the first step in recognising that risks are real. We need to take this on board. Accountability is critical in ensuring leadership acts upon this information and makes the most of these insights. Effective performance risk management can reinforce these approaches.
It’s not about being risk-averse. Great risk culture also enables individuals to take suitable risks in an informed manner. However, as seen in the run-up to the financial services crisis of the late noughties, inappropriate actions can create immediate and systemic risk.
Finally, communication and training programmes are pivotal to raising general risk awareness across the broader organisation and among stakeholders. These programmes need clearly defined goals to ensure they deliver benefits within the overall culture change programme. Goals imply that performance should be tracked over time; hence the move to developing risk culture dashboards.
Business leaders must recognise that changing to a great risk culture requires strong organisational change and risk management skills.
Source: Risk Culture
Frequently Asked Questions
What is risk culture in a business?
Risk culture is the collective values, beliefs, attitudes, and understanding of risk shared by an organisation’s stakeholders and employees. It shapes how people identify, discuss, and manage risks in day-to-day decision-making.
What is the difference between risk appetite and risk tolerance?
Risk appetite is the broad, high-level amount and type of risk a business is actively willing to accept to achieve its strategic goals. Risk tolerance is the specific, measurable, and acceptable variation around those goals that the company can handle without failing.
What are the key elements of a risk culture framework?
An effective risk culture framework is built on four core pillars: personal predisposition to risk (individual attitudes), personal ethics (moral compliance), organisational culture (the overall work environment), and leadership involvement (governance, accountability, and clear communication).
How do you successfully improve an organisation’s risk culture?
To improve risk culture, leadership must first define clear risk expectations from the top down. Then embed risk accountability into job descriptions, integrate risk assessment into standard performance metrics, and establish open channels for employees to escalate issues without fear of retaliation.
