In this series of five articles, we are exploring the importance of risk culture, distinguishing the risk culture from the organisational culture, looking at the drivers for good and bad cultures, discussing the measurement of culture, looking at the symptoms of a sickly risk culture and drawing some conclusions. Links to the other articles in the series can be found at the foot of this page.
In Long Term versus Short Term I suggested that there were major drivers pushing organisations towards a short-termist view but that those who embrace the idea that the organisation should be sustainable into the long term future might need to take a different view of risk management.
But this begs an important question: do you know what your culture is? Are you a “here-today-gone-tomorrow” short-termist or are you a long-termist? If you are the former you may well know something about your culture, but it is unlikely that you are either focused on your risk culture, and you probably are not so good at executing change in the organisation. If you are a long-termist, it is essential that you build in a risk culture as a part of your overall organisational culture.
The implications of this statement are that there are two recognisable but distinct elements to you culture: the part that focuses on the “here-and-now” and the part that focuses on the future. The organisational culture, your behaviours, beliefs, attitudes and approaches to work tend to be focused on what needs to be done today. This is the dominant culture for most established businesses and is an accretion of all of the activities of your people, at all levels, over a large number of years. It tends to reveal itself in a need for security, high levels of internal control (which are sometimes confusingly described as “risk controls”) and a comparatively poor ability to take risk. In the words of a former FTSE 100 CRO: “our managers have forgotten how to take risk.”
Most attempts at measuring culture of any sort start with a three-pronged assessment. Firstly, what do corporate documents say about the culture, for example HR policies, corporate values, mission and so on. Secondly, there may well be interviews of individuals at all levels, but principally at senior levels. And thirdly there will inevitably be surveys deployed around the organisation. Sometimes this is all done explicitly by someone charged with “understanding” the risk culture, sometimes it is done by triangulation: taking the data from other surveys and seeing what can be learned from those other exercise. But there are problems with this approach: as soon as you start to try and measure your organisational and your risk culture, you begin to change it. Typically, the surveys deployed will be subjective and opinion based. And of course, those who are interviewed know what the “correct” (for which read “politically acceptable”) answers are before they are asked the questions.
In a sense this approach is doomed to failure, because you never achieve any certainty about the culture that you are seeking to measure. An alternative is to look at the cultural artefacts of an organisation: the conversations and interactions that happen between people, both inside the organisation and with key outsiders such as principal suppliers, customers, investors and regulators. Who is talking to whom? About what? How often? And how good is the conversation? By using this approach you can swiftly build a rich picture which will tell you just how vibrant your risk culture is. By systematising this approach it can be likened to a CT Scan: it can identify the soft tissues of the organisation, but more importantly it can tell you where there are cancerous growths which need to be treated.
In the fourth part of this series, I will be exploring the typical symptoms of a poorly performing culture. If you would like to know more about these issues, continue reading here:
- Part 1: 300 years of failure
- Part 2: Long term versus short term
- Part 4: Signs of problems
- Part 5: Conclusions
If you would like to discuss this further, please feel free to contact us here.