In our little risk management fiefdom, there is a seemingly never-ending abyss of buzzwords and jargon used to explain simple concepts. Lately, one of everybody’s favorites is “risk culture.” This, of course, isn’t so much a real thing as it is a wishy-washy word to describe the general mentality that an organization’s employees have towards risk. Do the people in the company care about risk? Do they even know what it is? Those are really the only questions the concept of “risk culture” is trying to answer. It just sounds a lot more official.
Of course, since it is a qualitative term that has its foundations in “processes” and “methodologies” and “tone from the top” and all sorts of other barely-real-things, there is never any actual answer to the question “what is the company’s risk culture?” It’s just kind of a general, nebulous idea that people like to throw around. “We should be more proactive in the optimization of our risk culture,” is something I wouldn’t be shocked to hear an executive say.
This isn’t to marginalize the use of the phrase.
It’s not useless by any means, and what it actually stands for is very valuable to ensuring that the organization is paying attention to risk. If talking about “risk culture” is what you need to do in meetings to get people to listen, then that’s fine. But if you’re the one who is actually trying to better embed risk management into an organization’s decision making, you should just have a good idea of what you actually mean. Because unless you realize what actually drives risk culture, you may as well just being trying to improve “corporate happiness” or “employee satisfaction levels.”
Over at the blog Operational Risk Management, Ed provides a good breakdown of what we’re actually talking about when we talk about risk culture. Namely, it is about honest communication and employing workers who don’t fear reprisal for telling the truth.
A risk culture begins and ends with a human ability to communicate effectively with other humans. The human behaviors associated with communicating risk has all to do with the ability of one person to know the truth and to effectively tell the other accurately and effectively what the risk is and how it could impact the business. The trouble is, most organizations fail to spend enough time doing exactly that and doing it without fear.
What kind of fear? The fear that by telling your supervisor you might offend them. The fear that by questioning the co-worker about their decision that you will alienate them. The fear that by uncovering a fellow workers risky behaviors to the rest of the team that you will jeopardize the overall mission.
Guess what people; the ability or lack of ability by a human to communicate risk factors to each other with the truth and without the fear of judgement or retribution is why you either live or die. This is the reason why your organization continues to flourish or rots from the inside out. You see, the risk management environment in your team, unit, office location or FOB has all to do with communicating the truth in an effective way.
This is a good way to think about your “risk culture.” Do your employees talk truthfully, and often, about risk?
As the concept of risk management increasingly becomes less isolated from the concept of simply running a business, the need for terms like risk culture will diminish. Eventually, we will realize that saying something like “that company has a poor risk culture” is synonymous with saying “that company is dysfunctional.
” And if nobody is talking to one another honestly about potential problems — or missed opportunities — then that’s exactly what the company is.
