Magazine article The RMA Journal

Risk Culture: From Theory to Evolving Practice: A Survey by RMA and Protiviti Indicates That While Risk Culture Continues to Challenge Organizations, Its Benefits Are Beginning to Emerge

Magazine article The RMA Journal

Risk Culture: From Theory to Evolving Practice: A Survey by RMA and Protiviti Indicates That While Risk Culture Continues to Challenge Organizations, Its Benefits Are Beginning to Emerge

Article excerpt

IN JUNE 2013, RMA and Protiviti conducted a joint survey of 65 financial institutions that yielded interesting results in terms of how organizations perceive risk culture.

Although there isn't a single, uniformly used definition of risk culture, for purposes of the survey RMA and Protiviti defined it as "the set of encouraged and acceptable behaviors, discussions, decisions, and attitudes toward taking and managing risk within an institution."

Risk culture reflects the shared values, goals, practices, reinforcement mechanisms, and attitudes that embed risk into an institution's decision-making processes and risk management into its operations. The majority of the respondents (74%) believed their organizations' definitions of risk culture generally or substantially matched the one above.

But although risk culture is widely recognized as critical to effective corporate governance and risk management, the financial services industry continues to struggle in its attempts to translate the concept into tangible results. The survey found a definite lack of clarity around risk culture that continues to challenge organizations. A quarter of the respondents did not even have definitions of what risk culture means to their organizations. This factor alone likely contributed to the participants' top five challenges in integrating risk culture within their organizations:

Item                                                           Rank

Lock of clear understanding of what needs to be implemented    1
Lack of clarity over embedding strategies                      2
Insufficient tools to establish or drive risk culture change   3
Insufficient resources                                         4
Lack of clear understanding of current culture                 5

Other key challenges noted by participants were 1) consistency of messaging throughout the entire organization in all locations, 2) integration with growth and strategy, 3) the need for board and management support, 4) employee resistance to change, and 5) developing an understanding of risk culture that can grow and change with the organization.

The study also found low adoption of the practice of evaluating risk culture, as only 37% of respondents said they do so. Questions also remain around risk culture's tangible results. Of the respondents that do evaluate risk culture, only 24% said their assessment systems over the past 12 months had prevented significant and/or material events from negatively affecting their businesses. Another 32% of that group said a negative event had probably been prevented, and an additional 32% had no idea if their assessment system had prevented anything.

While tangible results and evaluation of risk culture are still lacking, companies are starting to see some of risk culture's benefits:

* Risk appetite can be pointed to as evidence of risk culture, and the vast majority of respondents have risk appetite statements. Of those that do, a large majority believe their risk appetite statements either help or substantially help communicate and reinforce risk culture expectations.

* "Tone at the top" is one element of a strong risk culture. The majority of respondents believe their organizations' boards and executive management are effective or very effective in promoting the risk culture of their organizations. Most respondents believe that the tone at the top coming from executives and senior management offers clear and consistent communications and actions that set expectations for employee behavior.

As for integration, less than one-third of respondents believe risk culture is fully integrated into their organizations. The majority believe it is only a component of the risk management work stream. In addition, even though the majority of organizations have risk appetites, a third believe their organizational complexity allows certain units to operate outside of established boundaries. …

Search by... Author
Show... All Results Primary Sources Peer-reviewed


An unknown error has occurred. Please click the button below to reload the page. If the problem persists, please try again in a little while.