• First Reference
  • About us
  • Contact us
  • Blog Signup 📨

First Reference Talks

Discussions on Human Resources, Employment Law, Payroll and Internal Controls

  • Home
  • About
  • Archives
  • Conference
  • Resources
  • Buy Policies
You are here: Home / Finance and Accounting / Is there an effective risk culture?

By Norman D. Marks, CPA, CRMA | 3 Minutes Read April 20, 2022

Is there an effective risk culture?

risk culture

Horst Simon describes himself on LinkedIn in a challenging way:

Transformational Nonconformist – It is time to Think Differently about Risk; Transformative change requires Disruption!!

I like that!

His primary description is as a “Risk Culture Builder”.

A while ago, he wrote an interesting piece, Calling all Risk Culture Experts. In it he says, and I agree, “we suddenly find a whole bunch of Risk Culture ‘Experts’ talking absolute garbage”.

The trouble is that while I agree a great deal with Horst, I am not 100% with him on this.

He says:

Let us get the basics right:

Basics No 1: Governance structure: Firstly, the reporting line for the Head of Risk/ Chief Risk Officer is directly to the Board. If you run your business by Committees, that would be the Chairperson of the Board Risk Committee; if not, it should be a Non-executive Director who knows something about the management of risk.

If you want to ensure that there is tension and more, even conflict, between the Chief Risk Officer (CRO) and management, emphasize the independence of the CRO. Make it clear that the CRO is the sheriff appointed to ensure the cowboys in management don’t take too much risk.

But if you want to promote effective management, de-emphasize independence and have the CRO report to the CEO with access to the board. Then hold the CEO (not the CRO) accountable for the effective management of risk and opportunity.

I like Horst’s two definitions of risk culture:

  • “Risk culture is the system of values and behaviours present in an organization that shapes risk decisions of management and employees. One element of risk culture is a common understanding of an organization and its business purpose” NC State ERM Initiative
  • “Risk culture is a term describing the values, beliefs, knowledge, attitudes and understanding about risk shared by a group of people with a common purpose” Institute of Risk Management[1]

Comments:

  1. What is a “risk decision”? Every decision should be a business decision. What might happen (risk, or harm, and opportunity, or benefit) needs to be considered as an integral and necessary part of decision-making.
  2. The culture of an organization is not consistent across the organization (just think of Sales vs. Finance) and can and probably should change as business conditions change.
  3. Organizational culture, as I have explained many times in this blog and my books, has many dimensions. Attitudes towards taking risk can conflict, for example, with attitudes towards compliance, entrepreneurship, customers, teamwork, innovation, and more.

Basically, considering attitudes towards risk without also considering other dimensions of culture is considering it in a silo.

Horst shares a definition of “Risk Culture Building”:

Risk Culture Building is the training of mind, of heart and of personal character to respond effectively to any situation of risk and take the right decision to mitigate, control or optimise risk to the advantage of the organisation.

We all need to take risk if we are to survive and thrive.

Horst’s blog, and I am sure the training and services he provides, makes some excellent points. But aren’t we better off thinking about whether the culture of the organization as a whole promotes the behaviors necessary for success?

Let’s first examine the demonstrated behaviors towards:

  • Shared objectives
  • Teamwork and collaboration
  • Information sharing
  • Concern for employees
  • Customer-focus
  • Compliance
  • Innovation
  • Challenging ingrained beliefs
  • Involving others and obtaining appropriate information when making decisions
  • Employee empowerment
  • Taking the right level of the right risks
  • Escalating to more senior management when appropriate, but making decisions when it is not
  • … and more

If it is clear that desired behaviors are demonstrated every day, we can be satisfied with the culture.

If not, then let’s find out why not.

As for risk culture, we are talking about the ability to make (risk and opportunity) informed and intelligent decisions.

You can’t have effective risk management without assurance that decision-makers know and then take the right risks for success.

I welcome your comments.


[1] Full disclosure: I was one of the reviewers of the IRM’s publication on risk culture, although I did not endorse the final product for the reasons I discuss in this blog post.

  • About
  • Latest Posts
Norman D. Marks, CPA, CRMA
Norman has led large and small internal audit departments, been the Chief Risk Officer and Chief Compliance Officer, and managed IT security and governance functions.

He retired in early 2013. However,he still blogs, writes, trains, and speaks – and mentors individuals and organizations when he can.
Latest posts by Norman D. Marks, CPA, CRMA (see all)
  • Auditing at the speed of risk with an agile, continuous audit plan  - June 22, 2022
  • Do smaller companies manage risk better than larger ones? - May 18, 2022
  • Is there an effective risk culture? - April 20, 2022

Article by Norman D. Marks, CPA, CRMA / Business, Finance and Accounting / compliance, employee empowerment, organizational culture, risk, risk and opportunity, risk culture, risk management Leave a Comment

Share with a friend or colleague

Get the Latest Posts in your Inbox for Free!

About Norman D. Marks, CPA, CRMA

Norman has led large and small internal audit departments, been the Chief Risk Officer and Chief Compliance Officer, and managed IT security and governance functions.

He retired in early 2013. However, he still blogs, writes, trains, and speaks – and mentors individuals and organizations when he can.

Reader Interactions

Leave a Reply

Your email address will not be published. Required fields are marked *

Footer

About us

Established in 1995, First Reference is the leading publisher of up to date, practical and authoritative HR compliance and policy databases that are essential to ensure organizations meet their due diligence and duty of care requirements.

First Reference Talks

  • Home
  • About
  • Archives
  • Conference
  • Resources
  • Buy Policies

Main Menu

  • About First Reference
  • Resources
  • Contact us
  • 1 800 750 8175

Stay Connected

  • Facebook
  • LinkedIn
  • Twitter
  • YouTube

We welcome your comments on our blog articles. However, we do not respond to specific legal questions in this space.
We do not provide any form of legal advice or legal opinion. Please consult a lawyer in your jurisdiction or try one of our products.


Copyright © 2009 - 2022 · First Reference Inc. · All Rights Reserved
Legal and Copyright Notices · Publisher's Disclaimer · Privacy Policy · Accessibility Policy