discover risk culture

Mohammad Fheili – [email protected]

The Collective Will & Ability to Manage Risk.

The CollectiveWill & Abilityto ManageRisk.

How To Build A Healthy Yet Contagious

May 18th & 19th 2016Movenpick Hotel


Mohammad Fheili “Over 30 years of Experience in Banking. [email protected] (961) 3 337175

Risk & Capacity Building Specialist. Trainer in Risk & Compliance University Lecturer: Economics, Risk, and Banking

Operations Currently serves in the capacity of an Executive (AGM) at

JTB Bank in Lebanon. Served as:

• An Economist at ABL,• Senior Manager at BankMed• Senior Manager & Chief Risk Officer at Group

Fransabank Mohammad received his college education

(undergraduate & graduate) at Louisiana State University(LSU), and has been teaching Economics and Finance forover 25 continuous years at reputable universities in theUSA (LSU) and Lebanon (LAU).

Finally, Mohammad published over 25 articles, of thosemany are in refereed Journals (e.g., Journal of MoneyLaundering & Control; Journal of Operational Risk;Journal of Law & Economics; etc.) and Bulletins.”


All Organizations need to take Risks toachieve their Goals.

The Prevailing Risk Culture within anOrganization can make it significantlyBetter or Worse at Managing these Risks.

Risk Culture significantly affects theorganizational capability to take strategicrisk decisions and deliver onPerformance Promises.

It’s never been about the presence of a Risk Culture

nor the absence of!

Risk is there; like it or not!

How Do You Do Things (& Think) Around Here?

There are MANY Risks but ONE Risk Culture!


Where Should We Go To Look For Risk Culture?

Board of Directors? Staff: Every Day Fire Fighters?


Then We Should Go Look For Risk Culture In

Every individual comes to anorganization with his/er ownpersonal Perception of Risk.

Every individual comes withhis/er own Inventory of MoralValues and these have a greatinfluence over the decisionsthey make on day‐to‐day basis.

The Man In The Mirror . . . The Man In The Mirror . . .


Risk Culture

It’s About the Way we do things (& Think) around here. . . !

Do we anticipate problems, and guard against them preemptively?

Cushion


Risk Culture


Do we make the efforts to identify Key Risk Areas and Introduce the necessary Internal Controls to prevent potential problems?


Risk Culture


Do we anticipate a Fall and lend a helping hand if need be?


So What Do We Mean By Risk Culture?

Risk Culture is a Termdescribing:• The Values,• Beliefs,• Knowledge and• UnderstandingAbout risk shared by Employeeswith a common purpose(Organizational Performance).Culture is more than astatement of Values – it relatesto how these translate intoconcrete actions.

How Culture works in Practice:• The Culture of an Organization arisesfrom the repeated Behavior of itsmembers.

• The Behavior of the Organization and itsConstituent Individuals is shaped bytheir underlying Attitudes.

• Both Behavior and Attitudes areInfluenced by the Prevailing Culture ofthe Organization.

Culture is subject to cycles which can self‐reinforce in either virtuous, or vicious,circles.


Risk Culture

Personal Predisposition

of Risk

Personal Ethics

Behavior

Organizational Culture

Every individual comes to an organization with their own personalperception of Risk.People vary in all sorts of ways and this includes their predisposition towardRisk. Two specific Traits:1. The extent to which people are either:

spontaneous and challenge convention or organized, systematic and compliant.

2. The extent to which people may be: cautious, pessimistic and anxious, or optimistic, resilient and fearless.

Organizations need to pay attention to the ethical profile ofthose working in their business.Every individual comes with their own inventory of moralvalues and these have a great influence over the decisionsthey make on day‐to‐day basis.Three ethical consciences, significantly influencing individuals’Decision Making:

1. Ethic of Obedience (Rule Compliance, Spirit ofthe Law, etc.)

2. Ethic of Care (Empathy, Concern, Respect, etc.)3. Ethic of Reason (Wisdom, Experience,

Prudence, etc.)


Risk Culture

Personal Predisposition

of Risk

Personal Ethics

Behavior

Organizational Culture

Individual values and beliefs andattitudes toward risk contribute toand are affected by the wider overallculture of the organization.It is useful to consider Organizationalculture in relation to two keydimensions:1. Sociability: People Focus (based on

how well staff get on socially)2. Solidarity: Task Focus (based on

goal oriented and teamperformance)


Risk Management Is Everybody’s Business

Staff Business Unit Senior Management

Assessment & Follow Up

Acceptance or Mitigation of Identified Risks

Follow Up on Decided Actions

Oversight & Control

Reports to Enable Senior Management Appraisal

IdentificationReporting

Registration of Incidents and Monitoring of the

Internal Control Environment

Problems with Risk Cultureare frequently found at theroot of organizationalscandals and collapses.

Every individual comes to an

organization with his/er own personal

perception of Risk

It Starts Here

Risks


Risk Management & Associated Culture

The Chief Risk Officer

Your Risk Culture Can Be Characterized as: Participative Risk Management Autocratic Risk Management


Participative Risk

Management

Full and Consistent

Communication & Coordination with all Business

Units

Involve EveryoneCulture is subject to cycles whichcan self‐reinforce in eithervirtuous, or vicious, circles.


Autocratic Risk

Management

I Know what to do, and I will do it all alone. My way or

the highway!

Involve EveryoneCulture is subject to cycles whichcan self‐reinforce in eithervirtuous, or vicious, circles.


An effective Risk Culture is one that enables and rewardsindividuals and groups for taking the right risks in aninformed manner.

Risk Culture (It is there!)Effective (Result Oriented)

Enables (Risk is not Crippling; Wrong Culture is!)

Rewards (Individuals & Groups) For Taking (Mostly Intentional risk‐taking behavior)

The Right Risk (Calculated Risks)

Informed Manner (Data is required: Facts not Perception).


Non‐Identifiable Risk

Non‐Identifiable Risk

Financial Institution’s Risk Population

What is Normally Used in Risk Identification: • CIP• KYC• DD• EDD• Complete Credit File,

EAD, LGD, PD, UL, EL, etc. and Proper Follow Up

• Comprehensive & Consistent Data about the Market

• Etc.

Identified & Identifiable

Risks

Many Tools For Data Collection


Increasing Our Understanding of Potential Outcomes

Increa

sing

Evide

nce on

Proba

bility of

occurren

ce

Ambiguity

Unc

erta

inty

Ignorance

A Bank is expected tocollect ALL needed datato move closer to RiskManagement and Awayfrom: Ambiguity, Ignorance, and Uncertainty.

The Fallacy . . .


Near misses, loss = 0

0 < Losses < Threshold

Losses > Threshold

After The Problem Has Been Generated

Before The Problem Has Been Generated

Look for Early Warning Flags

Identify Problems in Progress

Research Historical Events

FocusFocus

Data Must Be Made Useful . . .


Fire FightingFire Fighting

ProactiveProactive

ServiceService

ReactiveReactive

ValueValue

Risk in DIFFERENTIATOR role

Risk in ENABLER role

Risk in SUPPORT roleWrong Risk Culture

Right Risk Culture

The Question is NOT:• Do Organizations Need Risk

Culture?But it is:• What Kind of Risk Culture do we

Need?

Relatively Mature Organization

Primitive Organization

The question is whether thatculture is effectively Supportingor Undermining the longer‐termsuccess of the Organization. . . .Culture Eats Strategy if … !

The question is whether thatculture is effectively Supportingor Undermining the longer‐termsuccess of the Organization. . . .Culture Eats Strategy if … !

If The Job Is Done Right, Risk Management Create Value . . .


Many Organization have been concentratingmost, if not all their energies on surviving in thechanged environment by stemming losses,cutting costs and stabilizing their revenue base.

Where attention is paid to risk, the focus is moreoften than not on improving existing riskmanagement systems and models rather thantackling the underlying culture.

Failures (e.g., Fraud, etc.) have their origin in flawsin unique organizational cultures that allowedparticular risks to take root and grow. Culture EatsStrategy!

Otherwise, Culture Eats Strategy . . .


TheCollective

Will &Ability toManage

Risk

Risk Culture IllustratedHow We Do Things Around Here . . .


R.I.S.K.

A Boat in the Harbor is Safe, But That is Not What Boats Were Made For

A Truthful Statement of Risk Culture


Consequences: Losses

Risk Event: Loan

Default

Dried up Cash Flow Sources: Client’s businessreceived a bad hit.

Collaboration between the Bank Employee andthe Client in the provision of inflated figures(Sales, Revenues, Cash Flows, …) leading to afalse‐favorable credit decision.

Over‐worked, and Under‐Staffed Business Unitleading to overlooking some critical changes inbusiness circumstances of the Client.

Incompetent Credit Analysts Gave FalseRecommendation which led to a False‐favorableCredit Decision.

Poor/Inadequate Follow‐up and Reviews by theBranch/Relationship Manager rendering theprocess handicapped in capturing “WarningSignals”

Causes

• Kick off Loan Workout andRecovery ‐ Beware of shortcuts:Accepting Cash in settlement of anagging Bad Debt

• Recovery is a Function of theQuality of the Credit File and theLegality of AccompanyingDocuments

• Losses (Total or Partial)

• Etc.

?

Probe Carefully about the Root‐Causes of this . . .

Culture is subject to cycles whichcan self‐reinforce in eithervirtuous, or vicious, circles.


Acquisition/ Credit Specific Customer Service

Collect And Review Data

CreditReview

Assess Collateral And Risk

DocumentApproval

& Pricing

Sales: Bank-Client Interface Financial & Risk Analysis: Understanding Risks Processing

Establishing Contact

Evaluate first customer info

Customer Meetings

Debriefing

Request documents

Obtain data & information

Completeness/ plausibility review

Follow up

Review document

Follow up with Loan Officer / Account Manager

Standardized Credit Rating

Document on other credit related factors

Inspect Object

Determine Loan-to-value

Evaluate Exposure

Data is Sufficient

Complete Loan Application

Prepare Credit rate

Handover Credit File

Follow Up

Data is Complete

Approval by Decision Makers

Check Compliance with Authority Structure

Prepare Contracts

Get Signatures

Provide Security

Disbursement Review

Disbursement

Monitor & Report

ResolutionLoan/Asset Life Cycle

Credit Approval Process

Implement On the Credit

Decision

In the Process of Producing a Credit Decision; Do Analysts focus only on Credit Risks, or theylook into other risks (Market, Operational, Interest‐Rate, Liquidity, AML Risks?

Culture is subject to cycles which can self‐reinforce in either virtuous, or vicious, circles.


Flying From “Beirut” To “Paris” Is a ‘Service’; Just Like Opening a Saving/CheckingAccount. Descent Below Safe Altitude is an Incident (With Zero Losses this time);overlooking a step in Due Diligence …. BUT . . .

Minimum Safe Altitude (MSA)

IncidentAccident

Culture is subject to cycles whichcan self‐reinforce in eithervirtuous, or vicious, circles.


Brilliant Surgery!

Well Done!Shame the

patient died.

Outcomes

Fear of AML Violation Penalty (i.e., Outcome), the FIdecides not to serve the client (i.e., Decision) sparing itselfthe pain of Enhanced Due Diligence.


The Culture of Compliance


Client is Engaged

Compliance Cycle

Service Cycle

st1Client Interface

Interface

End

CIP, KYC, DD, EDD, …

AML Compliance (Regulator Decides)Client Engagement is Constrained by AML‐Compliance. The Bank is Responsible & Accountable

Customer Satisfaction (Customer Decides)Client Engagement is Driven by: The Potential for Revenue:Interest Income, Commissions & Charges; and a Word‐of‐Mouth Free Marketing

Both Cycles Are Ongoing Processes; None is a Destination

by itself

Branch

From Here on it’s Relationship Management

A Serious Risk Culture Failure: IF “Satisfaction” Ends Up Competing with

“Compliance” ….Which means “Service Cycle” can’t be

compatible with the “Compliance Cycle”!


…and this may include all types of Risks a Bank may

Face

De‐Risking is Yet Another Form of Risk Culture Failure


Level Of Maturity in AML Compliance

Nature & Extent o

f Efforts Dep

loyed

DD

EDD

RBA

Due Diligence

Enhanced Due Diligence

Risk‐Based Approach to AML Compliance

Enhancing Compliance Capabilities …

AML Cost

Skills Needs

Know‐How

AML Analytics

Those Enhanced AML Compliance Steps: Are clear indication of a desire, on the

part of the FI, to continue on servingthe Client.

Otherwise, the FI would engage inDerisking.

Enhance AML Compliance require: The Use of Technology:

Quantification/Data‐Rich vs.Judgment/Opinion‐Rich

Increase reliance on Technology: LessHuman Intervention;

Increase exposure to TechnologyFailures: Different Sets of Skills arerequired.

Reliance on Technology may ReduceFrequency But Increase Impact.

Being Pragmatic About Compliance?


RiskManagement is a Decision & a Choice.

ComplianceWith Regulatory Guidelines & Rules

Pillar 1 is More Attractive.

Standardized Approach in Credit & Market Risks

Basic Indicator Approach in

Operational Risk. Advanced Approaches

… No Way! ICAAP only if Required

by Regulator; and the bare minimum.

RCSA Marginalized. IFRS 9 ………a

nightmare!

Pillar 2 is at the top of Risk Management

Priorities. Advanced

Approaches are Effectively Explored. ICAAP required by

Management as a Desired Self‐

Assessment Tool. RCSA is Essential.

IFRS 9 is a welcomed wakeup call.

Etc.

Risk Culture Failure: Regulatory Compliance is Competing with Risk Management


Basel I

Basel II

Credit Risk

Credit RiskMarket Risk

Operational Risk

1986 proposed

1999 proposed

1988 effective

2007 effective

Basel III

Credit RiskMarket Risk

Operational RiskCapital Quality

Additional BuffersLiquidity: LCR, NSFR

2009 proposed

Kick Off in 2011

Amendm

ents

Amendm

ents

Basel 2 ½

Basel 1 ½Am

endments

Basel 3 ½

Basel IV

2017 Anticipated Or Not

Kick Off in 20??

• Capital Requirements

• Liquidity Requirements

• Disclosure Requirements

• National Divergences

• Risk Sensitivity

• Use of Internal Models inDecision Making

• Total Risks = Credit PlusMarket Risks

• Internal Models Emerged

• Later on, Tier 3 Capital

• Enhanced Pillar 2, 3

• Complex Securitizationobtained higher Risk Weights.

• Trading Books

Tequila Crisis

Asian Market Crisis

Shadow Banking Crisis

Regulator’s Risk Culture

The Basel Accord with a

history of Incomplete

Implementation

The Signal it Sendshas much to do withRegulatory RiskCulture.


The World of Finance Has Changed.

Nothing Is The Same . . . And The Culture Has Been Dramatically Altered.


People Come First

Data Come First

The Risk of Not taking account of that in the Transformation Process. Interfacing with

Clients Delivery Channels Product Features Customer Needs &

Wants Service Proliferation Staff Skill Level

Requirements Agility Etc…


Your Life Begins At the End OfYour Comfort Zone

Coping With a Rapidly Changing Banking Environment

Your Life Begins At the End OfYour Comfort Zone


Credit Risk

Market Risk

Operational RiskReputational Risk

Business RiskStrategic Risk

. . . Other Risks

Let’s Explore Risk

Stay and Risk

Extinction

Comfort Zon

e

Coping With

Changes


Foundation

Emerging

Established

Dynam

ic

Optim

ized

Fragmented Awareness

Building Consensus

General Awareness

Responsive

Intuitive

Individual/ Silo Focus

Process Focus

End-To-End Monitor and Measure

Responsive

Fully Integrated

‐Ad‐HocImplementation‐Limited Awareness ofRisks & Outcomes‐Relatively Risk Averse.

‐Risk Tools available butnot fully embedded‐Awareness ofOutcome‐FocusedObjectives‐Developing RiskAwareness‐Risk perceived as aProcess.

‐Functional RiskFrameworkImplemented.‐Shift in Focus – RiskViewed Positively.‐Key Risk Behaviorsembedded.‐General Awareness ofRisks & Outcomes

‐Focus on ContinuousImprovement.‐System facilitates riskversus outcomeanalysis & Response.‐Regulatory delivery isassured.‐Key Risk behaviorsevidenced withinIndustry.

‐Risk & Outcomesdrive all activity.‐All stakeholdersrecognize, understandand support approachincluding firms.‐Organization wideunderstanding of RiskTolerances andtreatment.

Timeline

Maturity


MAXIMIZE PROFIT subject to:RISK , REGULATORY, Compliance, Reporting, Etc. Constraints

RISK . . . Default Liquidity Maturity Others . . . REGULATORY . . . Basel I Basel II Basel III Basel IV (In the making)

Sanctions Rules USA_FATCA Requirements

AML, Etc. . . .

Uses of Funds Sources of Funds

Reserves Loans Securities Other

Investments . . .

All Types of Deposits

Borrowings Other

Sources Equity . . .

Off-Balance Sheet

With every Dollar in Service a Typical Bank

Solicits, it MUST satisfy all these Regulatory

Constraints first!VERY COSTLY!

Legal Issues . . .

Who can best help the Bank recover some of the cost of Compliance?Yes, YOU – Branches. You can Increase Traffic:

• More Clients• More Transactions

which can be achieved Through cross‐selling

Follow up Diligently on the settlements of Loans (and ‘Bien Trouvé’, Updated Financials, Site Visits, etc….)

Reduce Loss‐Events. Promote the Bank

through your Social Networks.

Formulating Effective Responses to Constraints

Risk Culture Matter


Health‐Check Your Risk Culture Yes You Can . . .


Evaluate The Current Risk Culture

• Look for hidden and sub‐cultures• Use several techniques to surface all cultures

What is the Impact of the current Risk Culture?

• What are its strengths and weaknesses?• Is this the right culture for our future?

What would Improve Your Risk Culture?

• Are there Regulatory or other external drivers to consider?• What changes do we have to make?


The High‐Risk End of the Continuum . . . • Poor Communication: A culture where warning signs of both internal or external risks are not shared.

• Unclear Tolerance: A Culture where the Leadership does not communicate a clear risk appetite or failsto present a coherent approach or strategy.

• Lack of Insight: A Culture where the Organization fails to understand the Risks it is running or believesthat such an understanding is the preserve of Risk Specialists.

• Over‐Confidence: A culture where people believe that their organization is insulated or even immunefrom risk because of its superior position or people.

• No Challenge: A Culture where individuals do not challenge each others’ attitudes, ideas and actions.

• Fear of Bad News: A Culture where Management and Employees feel inhibited about passing on badnews or learning from past mistakes..

• Indifference: A culture which discourages responding to situations or fosters apathy about theoutcomes, either due to bad faith or incompetence..

• Slow Response: A Culture where the Organization perceives external changes but reacts too slowly or isin denial about innovation or the likely impact of change.

• Beat The System: A culture where Risk Appetites are misaligned with the organization’s Risk Profile,leaving room for the conception and implementation of inappropriate activities.

• Gaming: A Culture where individual units take risks or embrace projects which could benefit the unit,but are out of line with the Organization’s Risk Appetite.

Transparency of Risk

Acknowledgement of Risk

Responsiveness To Risk

Respect For Risk


Poor

Unclear

Lack of Insight

Over Confidence

No Challenge

Fear of Bad News

Indifference

Slow

Gaming

Beat the System

Communication

Tolerance

Level Of Insight

Openness

Confidence

Challenge

Level of Care

Speed of Response

Cooperation

Adherence to Rules

High RiskBeware of the Weak End of the Continuum!


Evaluate The Current Risk Culture

• Look for hidden and sub‐cultures• Use several techniques to surface all cultures

What is the Impact of the current Risk Culture?

• What are its strengths and weaknesses?• Is this the right culture for our future?

What would Improve Your Risk Culture?

• Are there Regulatory or other external drivers to consider?• What changes do we have to make?

Plan & Implement Your cultural change

Monitor & Adapt to Changes

• Are we achieving the outcomes we expect?• What do we need to change now in light of our progress so far?

Cultural Change requires aSustained efforts as the cultureneeds time to adapt new norms.

How easily can we adapt thisculture change approach tointernational situation?

Continuous Review isEssential.

• What do we need in place to grow & sustain a new risk culture?• What changes do we have to make?


Poor

Unclear

Lack of Insight

Over Confidence

No Challenge

Fear of Bad News

Indifference

Slow

Gaming

Beat the System

Good

Clear

Good Insight

Confident But Careful

Constructive Challenge

Reward Honesty

Diligence

Fast

Coordinating

Play By The Rules

Communication

Tolerance

Level Of Insight

Openness

Confidence

Challenge

Level of Care

Speed of Response

Cooperation

Adherence to Rules

Transparency of Risk

Acknowledgement of Risk

Responsiveness To Risk

Respect For Risk

High Risk Low Risk

Risk Culture Framew

ork

Beware of the Weak End of the Continuum!


Regulating ComplexityIn The Universe Of Finance


Basel III

2009 proposed

2011 effective

Capital

Capital BuffersConservation 2.5% & Countercyclical 2.5%

Risk Managem

ent

Liquidity (LCR ≥ 100%) (NSFR > 100%)

Leverage ≥ 3%

Reporting

Less Reliance on External

Rating Agencies

• Increase in common equity requirements from 2% to 4.5%

• In crease in Tier 1 Capital (Going Concern) from 4% to 6%

• Tier 1 Capital can no longer include Hybrid Capitalinstruments with an incentive to redeem through featuressuch as step‐up clauses. These will be phased out

• Tier 3 Capital will be eliminated (Previously used forMarket Risk)

• Credit Valuation Adjustment (CVA) Capital Charge must becalculated to cover Mark‐to‐Market losses on counterpartyrisk to Over‐The‐Counter (OTC) Derivatives.

• Stressed Parameters must be used to calculate counterpartyCredit Risk

• Effective Expected Positive Exposure (EPE) with stressedparameters to be used to address general wrong‐way risk(WWR) and counterparty credit risk

• Banks must ensure complete trade capture and exposureaggregation across all forms of counterparty credit risk (notjust OTC derivatives) at the counterparty‐specific level in asufficient time frame to conduct regular stress testing.

• A multiplier of 1.25 is applied to the correlation parameterof all exposures to financial institutions (meeting certaincriteria) (Asset Value Correlation – AVC)

• Additional Margining required for illiquid derivativesexposures.

• 100% risk weight for Trade Finance.

• Contractual maturity mismatch

• Concentration of funding

• Available unencumbered assets

• Market‐related monitoring tools; asset prices and liquidity,Credit Default Swap (CDS) spreads and equity prices.

• LCR by currency

• Results of stress tests should be integrated into regularreporting to senior management

Basel II

2007 effective

+= +

++


Basel III Tried But …

Sub‐Prime Lending

Excessive Risk Taking

Housing Prices declineresulting in sub‐primedefaults

Sub‐Prime Defaults,Securitized Assets &Derivatives Tradingresulted in huge losses

Excessive Leverage &Poor capital could notabsorb losses fully,demanding freshequity infusion

Huge losses resulted ina crisis of confidencecausing liquidity toevaporate

Short‐term borrowingdemanded freshborrowing which failedin liquidity crisis

Firms on the verge ofinsolvency; threateningsystem failure

Governments step in toinject capital toprevent systemicfailure

Capital Conservation & Counter‐Cyclical

Buffers

Capital Conservation & Counter‐Cyclical

Buffers

a) Less reliance on external ratingsagencies; b) Credit Valuation Adjustmentcapital charge; c) Stress Testing

a) Higher quality & quantity of capital; b)Leverage Ratio Introduced; c) 100%weight for Trade Finance

Enhanced Supervisory Review and Disclosure Two new Liquidity

Ratios

Correlation to financialinstitutions will carry morerisk weights to preventsystemic risk and an overallcollapse

In stressed market situations,credit rating downgrades offinancial institutions andsecuritized products furtherlowered valuations andincreased losses.

Securitization

BUT not Enough!


LendersSurplus Spending

Units ‐SSUs• Individuals (Current

Income is GREATER than Current Expenditures)

• Firms (Earnings in excess of what the firm needs currently)

• Government (Current Revenues are in excess of planned Expenditures)

• Financial Intermediaries (Funding is currently GREATER than investment)

BorrowersDeficit Spending Units ‐DSUs

• Individuals (Current Income is LESS than Current Expenditures)

• Firms (Earnings falls short of what the firm needs currently)

• Government (Current Revenues fall short of planned Expenditures)

• Financial Intermediaries (Funding is currently LESS than investment)

Regulated but not like

Banks

Heavily

RegulatedNot RegulatedWith Financial intermediation in

Both BUT Complexity of an Unprecedented Nature and

Magnitude in Shadow Banking

With No Intermediation

BCBS has been paying attention to Financial Transactions (NotIntermediation) and Associated Risks But Little To Economic Engines

$

$

$

$

This Loop is what matters to Economics

Where to warehouse the Surplus?

Where to go to finance the Deficit?


Risk Management of Today has been Contaminated by theComplexity of Regulations. … Where in Many Jurisdictions RiskManagement should be as Simplistic as the Environment itOperates in.


A Strong Culture Demonstrates Several Critical and Mutually Reinforcing Elements:

• A clear and well communicated Risk Strategy.• High standards of analytical rigor and information‐sharing across theorganization.

• Rapid escalation of threats or concerns.• Visible and consistent role‐modeling of desired behaviors andstandards by senior managers.

• Incentives which encourage people to “do the right thing” and thinkabout the overall health of the whole organization.

• Continuous and constructive challenging of actions andpreconceptions at all levels of the organization.


Sources of Risk Culture Failures: Whatever their degree of severity, such failures have important common causes & Implications.

• Whether triggered by an internal or external agent, risk culture failures oftenexpose a long‐standing cultural weakness or a linked series of weaknessesthat have been incubating over time and that can be clearly recognized afterthe event.

• Failures and near failures often offer managers and key stakeholders awindow of opportunity to demand changes that strengthen anorganization’s risk culture and make it more robust. Unfortunately, some ofhe most powerful stimuli to change come when bad things happen, or areonly narrowly averted.


A Successful Risk Culture would Include:

• A Distinct and Consistent tone from the top from the Board of Directors andSenior Management in respect of Risk Taking and Avoidance.

• A Commitment to Ethical Principles, reflected in a concern with the ethicalprofile of individuals and the application of ethics and the consideration ofwider stakeholder positions in decision making.

• A common acceptance through the organization of the importance continuousmanagement of risk, including clear accountability for and ownership of specificrisks and risk areas.

• Transparent and timely risk information flowing up and down the organizationwith bad news rapidly communicated without fear of blame.

• Encouragement of risk event reporting and whistle blowing, actively seeking tolearn from mistakes and near misses.

• No Process or activity too large or too complex or too obscure for the risks to bereadily understood.


A Successful Risk Culture Would Include:

• Appropriate Risk taking behaviors rewarded and encouraged and in appropriatebehaviors challenged and sanctioned.

• Risk Management Skills and Knowledge valued, encouraged and developed,with a properly resourced risk management function and widespreadmembership of and support for professional bodies. Professional qualificationssupported as well as technical training.

• Sufficient diversity of perspectives, values and benefits to ensure that thestatus quo is consistently and rigorously challenged.

• Alignment of culture management with employee engagement and peoplestrategy to ensure that people are supportive socially but also strongly focusedon the task in hand.


What Do We Mean By Risk Culture?

• Risk Attitudes is the chosen position adopted by an individual or grouptowards risk, influenced by risk perception and pre‐disposition.

• Risk Behavior comprises external observable risk‐related actions,including risk‐based decision‐making, risk processes, riskcommunications etc.

• Risk Culture is the values, beliefs, knowledge and understanding aboutrisk, shared by a group of people with a common intended purpose, inparticular the leadership and employees of an organization.

One of the many challenges in addressing culture is that people naturallygravitate to others like themselves so the culture of an organization canself‐propagate if recruitment processes and environment remainunchallenged.

discover risk culture

Leadership & Management