Building a risk culture (2013-03-01)

February 20, 2015  3785  3785   

Organisations are made up of human beings working together and every organisation will have its own organisational culture that drives how people behave, the decisions they take and their attitude to risk. A group of members from the Institute of Risk Management has recently been taking an in-depth look at organisational culture and how it affects the management of risk. Its findings on the subject of 'Risk Culture' were published in October 2012 and are summarised in this article. A copy of the executive summary document can be accessed from the IRM website here: http://www.theirm.org/RiskCulture.html

Why does culture matter?

When organisations hit problems, issues with the prevailing culture are often found to be at the root cause of what went wrong. Often there will be a plethora of rules, codes and guidance in place but, for whatever reason, the rules are bent, broken, misunderstood or focused on the wrong things. The Baker report into the 2005 BP Texas City refinery explosion in the US cited deficiencies in leadership, competency, communications and culture as being the key causes of the event: the refinery had been acquired as part of a merger and acquisition and it appears that risk management systems and culture had not been fully implemented in the new subsidiary. In the UK, the Financial Services Authority's investigation into the collapse of the Royal Bank of Scotland in 2008 concluded that there were underlying deficiencies in its culture, particularly its attitude to the balance between risk and growth. An inappropriate culture isn’t always about taking too much risk. Eastman Kodak was a trusted leading brand for over a hundred years. But its strategic failure to reinvent itself and exploit digital technology led to a descent into Chapter 11 bankruptcy in 2012. Its culture meant that Kodak avoided risky decisions, and instead developed procedures and policies to maintain the status quo rather than adapting to the changing external environment.

Organisations with inappropriate cultures will inadvertently find themselves allowing activities that are totally at odds with stated policies and procedures or operating completely outside these policies. An inappropriate culture means not only that certain individuals or teams will undertake these activities but that the rest of the organisation ignores, condones or does not see what is going on. At best this will hamper the achievement of strategic, tactical and operational goals. At worst it will lead to serious reputational and financial damage.

Attached Files

• Risk_Culture_CGF_Research_South_Africa_Feb_2013 114.79 KB