How are you assessing and measuring the strength of your company’s risk culture?
It can be difficult to establish a holistic overview of an organisation’s risk culture, which encompasses both the structures and processes that are instituted by senior management, and the behaviours that are cultivated throughout the business with regards to risk management.
Creating a risk culture survey, dashboard or scorecard, – or incorporating survey questions into wider workplace surveys, – is a popular method of benchmarking risk culture amongst members, although it could be argued that there are benefits and drawbacks to this approach:
The pros
- They provide a means to quantify the attitudes and behaviours towards risks.
- Results will give a view of gaps and areas for improvement.
- The data will help form the basis for prompting a risk-aware culture and aid in creating opportunities to embed risk-related measures into performance management.
However, there is a flip side. The jury is still out on their effectiveness – with equal measures of pros and cons.
The cons
- It can be difficult to design precise indicators or survey questions that adequately describe the concept and/or measure the right areas. Often, culture is based on more ‘qualitative’ issues – tone from the top, attitudes, feelings and behaviours, for example.
- Cultural aspects can fall through the net unless sufficiently measured in the same way.
- Often, surveys will only provide results on a small sample of cultural aspects or a small sample of respondents – capturing an enterprise-wide view is often more challenging.
That’s not to say surveys, dashboards and scorecards are ineffective. Often, they need to be coupled with other methods – for example, qualitative interviews.
To help members with this process, we have developed our own risk culture maturity model, which provides a set of maturity criteria for the processes and behaviours that prop up an organisation’s risk culture. Using this model, members are benchmarking the maturity of their business in this field.
There are also many success stories from our network of risk leaders, who have developed their own surveys, scorecards and dashboards.
We’ve summarised some of the approaches below.
Scorecards, dashboards and indicators
Identify the most pressing indicators. For example, these may be compliance with code of conduct, workplace behaviour breaches, compliance with compulsory training, breaches of policy or procedures, and overdue internal audit actions.
Create a mechanism by which to define areas of concern. For instance, placing ‘red’, ‘amber’ and ‘green’ flags by each result or indicator will help highlight where more focus is needed. Before doing that, define what red, green and amber means.
Survey questions and execution
Once you’ve identified the indicators you want to use and built your survey questionnaire – start small. That is, seperate recipients into groups; this could be by level of seniority or by department. Then, target their input incrementally.
Building an effective survey is challenging and requires careful and informed design. You may also need to include both quantitative and qualitative questions.
Here are just four examples of survey questions from our network:
- What tone do we currently set from the top? (qualitative)
- What tone do we want to set from the top? (qualitative)
- Do we establish clear accountabilities for those managing risks and hold them to their accountabilities? (quantitative)
- Can people talk openly without fear of consequences or being ignored? (quantitative).
Of course, the topic of measuring and assessing your risk culture is complex. This blog only touches the surface.
But there is more. Risk leaders from various sectors across the globe have contributed their case studies, lessons learnt, tools and templates to Risk Leadership Network's Intelligence platform – providing deeper analysis, practical advice, and tips.
Are you an in-house risk manager who could benefit from access to a global network of senior risk professionals? Want to access our Risk Culture Maturity Model to benchmark your organisation against a set of key maturity criteria? Talk to us about becoming a Member today.
