You have been asked to define and develop your company’s risk culture.
You know what you want your end point to be: an intelligent risk-taking culture.
The question is, how do you do this effectively?
In my first blog as an advisory board member for the Risk Leadership Network, I outline my top tips and give you two shortcuts to take.
But first, let’s review the challenge on our hands.
The challenge is not building a ‘risk culture’ – it’s creating an effective risk approach
All organisations will have a culture – including a risk culture – whether it is well defined or not.
It may be:
- Vague or inconsistent, where every person acts and addresses risks as they see fit; or
- Strong and consistent, where the approach and decisions are aligned.
Your challenge is not to establish a risk culture. Instead, it is to ensure that your risk approach is strong and delivers your business objectives effectively.
Short cut 1: rename ‘risk culture’
Be practical about this. Rename ‘risk culture’ to ‘risk approach’ and drive efforts into making it strong and effective.
The term ‘approach’ is more tangible than the words ‘risk culture’. This is an easy and free shortcut.
But this does not make the task any smaller. In fact, changing people’s behaviour is the hardest thing to do.
Yet it is vital because any actions or decisions taken within the business will be the result of the company’s culture rather than its strategy.
Your challenge is not to establish a risk culture. Instead, it is to ensure that your risk approach is strong and delivers your business objectives effectively.
Have a read of this earlier blog, 4 alternative approaches to risk culture, which reviews this in more detail.
Risk taking or risk avoidance?
First things first, you must define your culture and the desired behaviours.
There are huge differences between organisations:
- On one end of the spectrum, risk management is all about safety first. Behaviours akin to ‘taking chances’ are deemed negative – even if or when results are good.
- On the other end, risks are taken willingly and deliberately and valued as the only way to prosper. Virgin owner, Sir Richard Branson’s statement “Screw it, just do it” is probably one of the strongest statements to that end.
Once the ‘approach’ [i.e the culture] is defined, making it real life is a long-haul journey. It can only be delivered through consistency and tenacity.
Three practical steps to intelligent risk-taking culture
Let’s work on the assumption that many risk managers wish to drive a culture of “intelligent risk taking” instead of a risk avoidance and minimisation culture.
Here are the three steps you should take:
1. Embed tools and processes that elicit the right behaviour
In the ideal case, these are designed to make the right behaviour simpler, easier, faster and/or more fun than the wrong behaviour. Creating tools and processes may be simple.
But ‘nudging’ people to think that the proper approach is easier to take than the wrong approach is trickier. This behaviour can be developed over time and is extremely powerful and behavioural driver.
2. Link to current decision and project management processes
Push, persuade and support people to execute projects and make decisions according to your desired approach.
In the case of “intelligent risk taking” – ensure risks and opportunities are identified, quantitatively analysed and addressed and prioritised.
3. Reward, praise, commend and talk
- Place the spotlight on anyone who executes according to your desired approach.
- Flag the great results and forgive anyone who has stood still.
- Refrain from rewarding those who do not align with the desired culture, even if they succeed.
- Punish those who do not align and fail. This goes for all levels of management.
You may face a challenge in persuading an executive to refrain from rewarding a success that did not follow desired approach (but delivered through luck). But be persistent!
Be prepared to repeat steps 2 and 3 – over and over again. Do them until the stories and legends of the company are aligned with intelligent risk taking.
Be aware, this may take years – all real cultural development does. But this is the key to success.
Short cut 2: change the behaviours of middle managers first
You may wish to drive this your risk approach from the top-down but start by changing the behaviours of middle managers and project leaders first.
This is because middle managers make the largest number of decisions. Executive decisions, on the other hand, are often political in nature. And the executive committee do not execute projects – they ask the management to do so.
That said, if executives keep rewarding and punishing behaviours that contradict your risk approach, you have a lost cause.
You cannot state as “tone from the top” that “we are an innovative company” and then punish each and every miss of a KPI they see.
If you remember just a snippet of this blog, remember these things:
- Define your risk approach and get it approved by the leadership team
- Ensure adequate tools and processes are in place
- Train, help, support, and push managers to apply these tools and processes by showing them the value of your approach. And celebrate every success – in front of the whole organisation
- Be very persistent
Be aware, this may take years – all real cultural development does. But this is the key to success.
This is a long-haul journey. But eventually you will have aligned the risk-taking culture of your company to an effective approach that you believe will – optimally – serve your company in a volatile world.
Even the longest journey starts with a single step.
We will be taking a detailed look at risk culture with the launch of our Intelligence platform in April. Read 5 ways to become a better leader in risk culture for an outline of the Intelligence content to come.
To find out more about the benefits of becoming a Member of the Risk Leadership Network, click here.
