“Culture is the soul of the organisation — the beliefs and values, and how they are manifested. I think of the structure as the skeleton and the process as the flesh and blood. And culture is the soul that holds the thing together and gives it life force." - Henry Mintzberg
“We operate in an extremely competitive environment in a number of countries, but there is one distinctive advantage we have, and that is our culture" Capricorn Group, 2017 Integrated Annual report.
The Prevailing Risk Culture within an Organization can make it significantly Better or Worse at managing these Risks, it also significantly affects the organisational capability to take strategic risk decisions and deliver on Performance Promises. Risk culture arises from the repeated behaviours of the employees of the organisation. These behaviours are shaped by the underlying values, beliefs and attitudes of individuals, which are partly inherent; and by the existing corporate culture in the organisation. The most commonly used definitions are:
“Risk culture is the system of values and behaviours present in an organisation that shapes risk decisions of management and employees. One element of risk culture is a common understanding of an organisation and its business purpose" NC State ERM Initiative
“Risk culture is a term describing the values, beliefs, knowledge, attitudes and understanding about risk shared by a group of people with a common purpose" Institute of Risk Management
You can take a horse to water, but you cannot make it drink. You can take a risk management framework and procedures to your business, but you cannot make your people do it.
Building an effective Risk Culture is much more than changing your organisational culture in line with your vision, mission, corporate values and risk appetite—you must factor in the interests of competing national cultures, sub-cultures, Maslow's theory on individual self- actualisation and the informal groups in the company. The interactions between these are not predictable, and variables cannot accurately be isolated.
An effective risk culture is not a matter of risk assessment or level of compliance; it is a matter of individual ownership of risk and personal “conviction" -- a state of mind where human beings own the risks and the process of managing those risks through making well-informed risk decisions because they want to, not because they have to. Driving value through optimising risk management rather than a culture of compliance where they will do only what is required.
“The legacy you leave behind is the one you live" – Kenneth Blanchard
You can have great policies and fantastic risk dashboards, but at the end of the day; a person will take a decision. You can never remove the human factor from risk management. People, to be successful in anything they do, must have a desire to do it. This attitude breeds passion which drives individuals and groups of people to excel. Getting the right culture to support the management of risk across your business is the key ingredient for success. Risk Culture “lives" in the hearts and minds of employees, it is embedded within their thoughts; which then influence their behaviours and actions.
Getting the right culture to support the management of risk across the business is the key ingredient for success. Having corporate values that are actually lived through behaviours is critical to building an effective risk culture.
The starting point in establishing and maintaining an effective risk culture is to have an appropriate system of values, shared beliefs and clear communications on expected individual and group behaviour. “The Capricorn Way" is this foundation of values in our group as we live with shared goals and objectives and an agreed way of doing things; supplemented by structured initiatives and regular interventions to work out how to do things better.
Organisational values are used to indicate the type of conduct expected by individuals regardless of their position. These values relate to principles of behaviours and transcend specific situations. With values in place, behaviours are identified that support and contradict the values so that all employees are clear about what is expected of them. Behaviours which bring to life risk values are encouraged, whilst those that contradict the risk values need to be challenged and avoided.
Each and every employee in an organisation should know their risk values and the appropriate behaviours that support those values. They must use them on a daily basis in making risk-based decisions and take actions to optimise the management of risk."
Organisational leaders have a crucial role to play in setting risk values and living the behaviours that demonstrate their commitment to the values.
The response to any situation of risk originates from a person's thoughts. Each person has a dominant Worldview, and each person was born into a particular generation, both these aspects are fundamental to their perception of risk.
In essence, it also comes down to whether a person has basic business ethics, the knowledge of what is “right" and “wrong" and the choice he/she will make.
In an organisational context, this should come from corporate values and an appetite for risk communicated by a framework, policies, processes, practices and behaviours through a deep motivation of staff to do the “right thing".
“Clearing your head of distractions in order to notice and understand the people you are with can feel inefficient – there are so many other people and issues to think about. But being present makes you effective" – Margaret Heffernan
Once the mindset is right, behaviours will follow. In an effective risk culture; people care enough to think about the risks associated with their jobs before they make decisions on a daily basis. Strong cross-functional teamwork and employees who apply sound judgement in the management of risk and a small central risk management advisory team that understands the organisation and fully supports the business at all levels.
The following behaviours are evident in an effective Risk Culture:
Demonstrating a positive attitude towards the management of risk.
Always looking right, left and right again; considering risk in every business decision that is made, prior to the decision being made.
A good risk nervous system; strong and open communication channels where bad news travels faster than good news and escalation happens as soon as a problem or issue arises.
Taking responsibility for risks and controls, honesty and clear ownership of risk.
Encouraging and educating others in the management of risk.
“You can look for external sources of motivation, and that can catalyse a change, but it won't sustain one. It has to be from an internal desire." – Jillian Michaels
Failing once, or even several times doesn't make you a failure any more than losing one game makes your team a losing team. Failing can be a great teacher, make you stronger, and keep you grounded. The difference between a stepping-stone and a stumbling block is the way in which you approach it. How should you react to failure?
Be realistic- If you demand perfection of yourself, you're setting yourself up for disappointment.
Don't take failure personally- Making a mistake doesn't make you a failure. It's simply a reminder that you're human.
Accept responsibility- Nothing positive is ever gained by scapegoating. Be courageous and accept responsibility for your failure.
Be nice to yourself - Don't tear yourself down for failing. You don't speak to others that way, so give yourself a break.
Get back on the horse- Don't wallow in self-pity. Obsessing over failure won't make it better. You cannot change the past, but you can affect the future.
Grow from your mistakes- Take the time to reflect on your experience, learn from your mistakes, and adapt accordingly.
Don't quit- Most people fail before achieving success; the difference is that successful people never stop trying.
“Life is not easy for any of us. But what of that? We must have perseverance and above all confidence in ourselves. We must believe that we are gifted for something and that this thing must be attained" – Marie Curie
Some quotes taken from “The Capricorn Way" and some concepts adapted from “How do you react to failure" by Frank Sonnenberg.