Risk leaders have discussed and shared the metrics they find most useful when monitoring and assessing organisational culture, as part of our wider risk culture series of member meetings and better practice guidance.
It’s hard to define, but permeates the entire organisation, for better or for worse.
For risk leaders hoping to get to grips with a nebulous concept like “culture”, it can help to start by defining what good risk culture should look like according to your board and senior leaders, as well as what their expectations are for people to operate within it.
If you don’t set and communicate clear expectations, how can you survey risk culture or monitor it? For example – what are you trying to find out? What are you measuring your findings against?
Members in the network, from a range of industries, have discussed their current and aspirational practices when it comes to measuring and enhancing risk culture.
This comes as part of our series of member meetings and peer-contributed content on risk culture, which has also explored effective risk culture training sessions, the use of gamification methods and second line-facilitated risk culture reviews, among other subtopics.
Through peer-collaboration, we’ve produced a comprehensive library of culture metrics that members can access on the Intelligence platform. These metrics include, amongst others:
- Success of incentive structures
- Risk and control owner turnover
- Automation considerations
The culture metric library also provides information on:
- The value each metric has brought to organisations that use them
- Their limitations
- Details of their use in practice – tips & tricks from risk leaders who use them
- Type of metric – quantitative and qualitative
Below, we’ve distilled some other metrics that appear in this library as well as some of the main considerations members have debated over when it comes to enhancing risk culture.
Scanning for problems
When it comes to risk culture frameworks, many risk managers conduct horizon scanning at a dashboard level based on information from a number of data points from across the organisation, comparing and contrasting data from different subcultures.
Any sign that something might be amiss can be investigated by expert capabilities on the risk team such as a cognitive psychologist or data scientists. They can pull together quantitative measurements and qualitative information to analyse and report back as part of the governance framework.
Qualitative and quantitative metrics can be used in isolation, but are more useful when combined to analyse risk culture across an organisation, as numbers alone won’t give the full picture.
As one member explained: “We can’t trust the numbers in the same way we would trust them to measure process efficiency, for example, because culture relates to people and behaviour.”
So, what metrics are risk leaders using to measure risk culture?
Quantitative: Risk culture by the numbers
Survey data is probably the easiest - and therefore most common - quantitative metric used by risk leaders to measure risk culture. In addition to creating culture-specific surveys for employees, risk managers also often use data from other company surveys to guide their approach. For example, employee perception polls used by HR can provide valuable insights.
It can also be useful to survey different parts of the business in variable ways, such as conducting a separate survey of risk champions, which could be more in-depth (as they ought to have a better understanding of risk).
Qualitative: Understanding the context
Deep dive techniques such as one-on-one interviews are one of the most popular qualitative metrics for gauging risk culture. While resource-intensive, particularly for larger companies, being able to speak to colleagues individually or in very small groups can help to add colour to the quantitative information gleaned from organisation-wide surveys.
Qualitative measures are particularly useful for identifying subcultural differences, for example how the nuances of culture differ among the various teams or business units of one company. In order to access more qualitative information, many firms are starting to use deep dive techniques and interviews versus only using quantitative sources such as HR training statistics, to gauge risk culture.
You can read more about our risk culture content here.
Interested in accessing our list of risk culture metrics? Find out more about Risk Leadership Network membership here.
