SlideShare ist ein Scribd-Unternehmen logo
1 von 12
Downloaden Sie, um offline zu lesen
While references to the concept of risk culture are relatively new, shortcomings in risk awareness and management
have become identified as fundamental causal factors in recent world events, such as the global economic crisis
and major industrial accidents.
Perspectives
Risk culture starts
to come of age
2 willistowerswatson.com
The attention focused on the
determinants of, and influences on,
risk culture has become progressively
greater in recent years, thanks
substantially to continuing autopsies
of the 2008 global financial crisis. Yet,
for all the discussion, there remains no
universally agreed definition. Perhaps
the most frequently cited example is
the Institute of Risk Management’s1
:
“Risk culture is a term describing the
values, beliefs, knowledge, attitudes
and understanding about risk shared
by a group of people with a common
purpose, in particular the employees
of an organisation.”
As those working within the field
would readily acknowledge, the
difficulty with any definition is that
risk culture will vary widely from one
context to another, depending on
factors such as broader organisational
objectives and behaviour, sector of
operation, and the nature of risk. The
challenge for firms looking to improve
how they evaluate and react to risk is
to identify what works for them.
Risk culture and
organisational culture
The nature of the relationship
between organisational culture and
risk culture is a matter of debate and
perspective. Some people view risk
culture as a sub-set of organisational
culture; for others it overlaps with, but
also extends beyond, the traditional
boundaries of organisational culture.
For yet others, risk culture is simply
organisational culture viewed through
a risk lens.
But there are several principles from
organisational culture more generally
that have an important bearing on risk
culture, including:
ƒƒ Culture matters: Organisational
culture really does make a difference.
Although culture is sometimes
regarded as ‘soft’, it plays a powerful
role in determining behaviour and
organisational effectiveness. To
emphasise this point, among the
more colourful opinions expressed
along these lines are:
“Culture eats strategy for breakfast”
often attributed to the management
writer Peter Drucker2
and:
“Culture, more than rule books,
determines how an organisation
behaves”
from business leader, Warren Buffett
in a Financial Times interview3
.
ƒƒ Much of culture lies beneath the
surface: Some aspects of culture,
such as the management reporting
line, are quite visible and readily
apparent. Others, such as the
unwritten lore, informal relationships
and people’s personal attitudes are
more hidden beneath the surface.
ƒƒ There is no ‘best’ culture:
Cultures vary between (and within)
organisations – and they should.
A company competing on the
basis of its creativity will need
Risk culture starts to come of age
a different culture to succeed than
another competing on the basis
of operational efficiency.
ƒƒ Culture can be articulated,
measured and managed: To some,
the very notion of organisational
culture seems ethereal and difficult
to describe, let alone quantify or
manage. However, there are well
developed approaches that provide
effective ways to do just this.
Practical application:
Financial services
Moving from theory to practice,
the financial services industry is
perhaps understandably the most
obvious sector where risk culture has
come under the closest scrutiny in
recent times.
There is little doubt that an important
contributor to the financial crisis of
2008 was the prevalence of a culture
that promoted the pursuit of short-
term profits at the expense of long-
term value generation, which was
exacerbated by being entrenched into
individuals’ rewards. This view was
supported by a survey4
which found
that most risk professionals believed
the banking crisis was caused not
so much by technical failures as by
failures in organisational culture and
ethics, with 85% citing remuneration
practices as important or very
important. Although the role of reward
may sometimes be overstated, it
can clearly play an important part in
shaping culture and behaviour.
While references to the concept of risk culture are relatively new,
shortcomings in risk awareness and management have become identified
as fundamental causal factors in recent world events, such as the global
economic crisis and major industrial accidents.
3 Risk culture startst to come of age
In recent years, firms have launched
reviews of their operational and
governance models to address
weaknesses that were considered
to have contributed to the increased
and often unrecognised risks. These
reviews have addressed a wide range
of areas, including product complexity,
incentive schemes and oversight.
More, however, remains to be done.
Embedding a consistent risk culture
beyond the boardroom and into
business units can prove particularly
challenging. While the Board and
the Chief Risk Officer (CRO) have
overall responsibility for ensuring this
happens, the direct responsibility for
risk management and the risk culture
lies with operational management.
There may be a tendency to assume
that because someone has ‘Risk’ in
their title they must take on all risk
responsibility. In reality, it is the role
of senior management to set the
tone and encourage and empower
employees to behave in line with the
desired risk culture.
But in many cases new governance
and processes are driven by recent
events and external pressures, rather
than a longer-term view of a culture
of risk awareness that balances the
downside risk with well-managed
opportunities that could result in
significant competitive advantages.
What marks out the latter is the
leadership of Boards and CROs,
as well as other risk specialists, to
clearly articulate a balanced, business
orientated view of risk as a basis for
educating and advising the rest of
the business. Talent management,
communication and education
programmes are critical to a successful
risk culture, typically requiring a long-
term commitment from operational
management as much as the risk team.
It should not be forgotten that
much of risk culture resides in
people’s attitudes, beliefs, habits and
relationships and is hidden ‘beneath
the surface’, which affects the
manner in which policies, systems
and processes are approached in
practice, and therefore their success.
As an example, following a significant
risk event, Towers Watson was asked
to review a financial services company’s
governance procedures, to evaluate
whether appropriate decision making
processes and levels of authority
were in place. The conclusion reached
could also apply to many incidents
in the sector over the last few years:
‘There was nothing wrong with their
governance procedures – apart from
the fact that they didn’t use them.’
Although the system of internal
committees and decision-making
processes was well defined, in practice
decisions had been influenced by
conversations in the corridors and by
the strength of relationships between
individuals. A clear lesson from this
is that an organisation’s formal risk
governance processes and its risk
culture need to be in tune with each
other to be effective and the design
and implementation of the risk
management system should take
full account of the culture.
4 willistowerswatson.com
Measuring risk culture
For all the mounting evidence of the
value of culture in how organisations
behave, some managers, and some
risk managers in particular, have shied
away from the concept of risk culture,
not knowing quite how to approach
it. For those from an engineering or
actuarial background, for example,
the notion of trying to measure such
an apparently ethereal concept can
be troubling. But, in keeping with the
mantra ‘what gets measured gets
managed’, if risk culture is to be
effectively managed, it surely needs
to be measured. Fortunately, there are
well developed approaches that can
do just this.
At the less formalised/ad hoc end
of the spectrum, organisations have
tended to rely on existing data sources,
such as drawing on information from
generic staff surveys, policies and
values statements, as well as relying
on subjective personal impressions.
A more structured qualitative
approach offers a great deal more
insight. This typically takes the form
of a series of senior level interviews,
combined with focus groups from
across the organisation. Such an
approach can be applied widely
across a large organisation but also
lends itself to smaller business units.
Safety culture
In other sectors such as energy,
oil and gas, construction,
transportation and logistics,
mining, and manufacturing, safety
is frequently cited as the number
one business priority. Where safety
incidents have occurred, large or
small, investigations have often
identified organisational culture as an
underlying cause. But what aspects
of culture are most important in
developing a strong safety culture?
In research conducted by Willis
Towers Watson, employees of
businesses recognised for their
safety records reported positive,
open relationships with their line
managers, who were seen as
technically knowledgeable, receptive
and responsive to input and were
forthcoming with recognition for
good work. Good line management
was found to create a sense of
empowerment. Individual employees
were able to take responsibility
through delegated authority and
access to relevant information.
They were encouraged to develop
innovative solutions to problems.
Positive safety environments were
also found to have a stronger
emphasis on collaboration and
teamwork – which were found to be
especially important in exceptionally
busy environments.
Notably, it is important to capture
both the senior, strategic perspective
and those from the middle- and
front-line roles as each has access
to a different set of information and
experiences that are very relevant to
the risk culture.
Much as the insights from a qualitative
approach such as this are very helpful
in identifying issues to be addressed,
it does not lend itself to quantification,
and so it is difficult to determine
the extent of an issue, to compare
within or between organisations
or to track progress accurately. A
complementary survey approach is
able to meet these needs, and many
organisations are now using risk
culture surveys to monitor this critical
aspect of their business. These range
from simple generic questionnaires to
those that are tailor-designed to meet
the specific needs of the organisation.
Surveys provide a readily scalable
approach, so can be applied across
organisations of all sizes.
5 Risk culture startst to come of age
Organisations naturally differ
from one another in terms of their
strategies, products/services,
markets, heritage, structures and
processes – so it is only sensible that
their cultures would and should differ
too. Where possible, it is therefore
preferable to design a measurement
approach to fit the specific needs of
the organisation. If using a survey,
this means designing a set of
questions that reflect the particular
issue most important to the effective
operation of that organisation.
More sophisticated statistical analysis
of a well-designed survey can even
provide insights into the underlying
dynamics of the prevailing risk culture,
for example, identifying high impact
topics that are the biggest influence
on people’s attitudes, and so inform
effective change plans. An example is
illustrated in Figure 1.
As well as providing the insights
described above, in our experience,
a systematic approach to measuring
risk culture often also has several
less direct but equally beneficial
consequences.
Firstly, to the extent that it is visible
across the organisation, it raises the
profile of an important, but sometimes
overlooked topic. Leader sponsorship
of a risk culture initiative demonstrates
that it is taken seriously and helps
convey a positive tone from the top.
We have also found that introducing
a risk culture measurement process
makes the topic much more
accessible and tangible to both
internal and external stakeholders.
It provides a common language and
set of constructs that managers can
use to discuss the topic in a clear and
constructive way, and helps investors
or regulators, for example, understand
the value of the existing risk culture.
In essence, measuring risk culture
begins to give leaders, managers and
employees the concepts and insights
they need to begin managing risk
culture effectively.
Risk information
and reporting
Leadership
Processes,
controls and systems
Governance
Risk strategy
Risk attitudes
Risk awareness
Figure 1. Drivers of risk attitudes
6 willistowerswatson.com
There is no question that rewards –
and variable incentive compensation
in particular – can and do drive
behaviour. In this way, rewards can be
a powerful tool. The problem, however,
is that rewards won’t necessarily
always drive the desired behaviours
or outcomes.
This has led many organisations to
focus on the risks, or potential risks,
created by rewards. Examples of such
risks might include:
ƒƒ A CEO or senior leadership team
that takes actions to maximise the
stock price in the short-term, thus
risking long-term profitability and
growth, because their rewards are
linked to earnings per share
ƒƒ A leadership team that makes
overly generous assumptions in
recognising revenue in order to
produce better results that drive
higher bonuses
ƒƒ A sales team that pushes through
a large volume of orders, generating
high commissions, without
considering whether those sales
are properly aligned with customer
needs, and without care as to
whether those orders are later
cancelled or goods are returned
because their compensation is linked
to gross sales rather than net sales
ƒƒ Call centre staff who are rewarded
based on meeting objectives related
to the average length of each call.
Managing risk culture
With the appropriate insights, support
and resources it is possible to manage
organisational culture – it just can’t
be done overnight. A few key guiding
principles include:
ƒƒ There should be a clear and
compelling vision and strategy that
people can understand and buy into
ƒƒ The desired culture should be
articulated and modelled from the
highest level in the organisation
ƒƒ Companies should pay attention
to the ‘hidden’ side of culture that
lies beneath the surface, listen to
people’s concerns, understand their
personal interests and fears and
respond to these. Some aspects
of culture (such as systems,
procedures and processes) offer
managers the opportunity to address
them directly, whereas others (such
as people’s attitudes and beliefs) can
only be impacted indirectly
ƒƒ Existing systems, processes
and policies tend to support the
status quo, so these should be
reviewed and modified to reflect
required cultural changes, including
approaches to:
ƒƒ Education and communication
ƒƒ Management information
ƒƒ Leadership
ƒƒ Governance
ƒƒ Reward and performance
management
Fresh approaches to these facets
of an organisation give leaders and
managers a greater chance to bring
about sustained change in the less
visible parts of culture, such as
beliefs, attitudes and relationships.
Although experience shows that
leaders and managers can remould
the risk culture of an organisation,
there are also limitations on what
can be achieved, and it is also easy
for some actions to bring about
unintended consequences. Nowhere
is this the case more than in the use
of incentives and rewards to influence
risk culture.
Rewards and performance
management
There are countless examples, and
not just from the 2008 financial crisis,
in a wide range of industries, where
incentives – and the culture that
went with them – were felt to have
contributed at least in part to very
negative outcomes. Among the more
spectacular examples are the failures
of Barings Bank, the ‘double suicide’ of
Enron and Arthur Andersen, the failure
of Lehman Brothers, and for BP both
the Texas City oil refinery accident
and more recently the Deepwater
Horizon spill. The most damaging
of these cases often involved not
just one or two ‘bad apples’ but
rather stemmed from practices that
were tolerated – if not encouraged
– as part of the cultural fabric of
the organisation.
7 Risk culture startst to come of age
Risk identification
This involves identifying the sources of
incentive risk, which requires creating
an inventory of all the incentive plans
that are currently being used in the
organisation. While this may sound like
a simple task, in large multinational
organisations there can be tens or
even hundreds of different ‘local’ plans
(either local to a geography, a business
unit, or a function).
Risk analysis
This is focused on understanding the
causes and sources of incentive risk.
There are a variety of methods and
tools that organisations use to analyse
the risk of their incentive plans – some
involve very quantitative, formulaic
scoring algorithms, while others take
a more qualitative approach. However,
the most important factors tend to
revolve around two categories:
Importantly, the real risk of these
situations is faced by the company,
not the individuals taking these
actions. For the company, the potential
outcomes of the employee’s actions
(and the related uncertainty) can be
much more far-ranging – unsatisfied
customers, additional costs to resolve
complaints, reputational damage,
a potential loss of customers and
revenue, and potential legal action
along with related fines, settlements,
and legal costs. In the most extreme
situations, as noted above, it has led to
the failure of the company.
The current focus on incentives, we
would argue, is both prudent but also
dangerous. It is prudent because we
know that poorly designed incentives
can create bad outcomes. But it is
also dangerous for two reasons:
ƒƒ It leads to a false notion that
incentives can be used to
‘control’ risk
ƒƒ It places an unreasonable burden on
incentives and rewards in general to
serve as the primary (or exclusive)
tool to manage behaviour – ignoring
the role played more broadly by the
organisation’s risk culture.
Incentives create rather than
control risk
No incentive or reward programme
design can be used to control risk.
Rather, incentives – any incentive
– create risk. Changing the design
of the incentive plan can reduce or
eliminate certain risks, but at the same
time it creates other new risks.
This is not to suggest, however,
that firms should not worry about
their reward design and just get
on with things. Conducting a
comprehensive risk assessment of
incentive programmes is a process
that companies will find beneficial
periodically, as outlined below.
ƒƒ Technical plan design details (for
example, the use of thresholds
and caps, the degree of upside
opportunity and acceleration in
pay-outs, the existence of
clawbacks and deferrals, and the
types of measures rewarded).
ƒƒ The materiality of the plans in
question (for example, the relative
amount any one person can earn,
as well as the size of the population
impacted and the total costs
involved).
Risk prioritisation
Having completed the risk analysis, it
is then possible to identify the incentive
plans that require further attention.
The matrix in Figure 2 provides a
simple means of prioritising incentive
plan risk for many organisations. It
looks at two dimensions.
Figure 2. Incentive risk probabilty
CATEGORY 3
Low risk:
No governance
or design
changes required
CATEGORY 2
Moderate risk:
Plans may require
governance or
design change
CATEGORY 1
High risk:
Plans may require
governance or
design change
Planlikelihood
Business Consequences
HighModerateLow
HighModerateLow
Plan A
Plan B
8 willistowerswatson.com
Incentive plan risk – while specific
criteria will vary from one organisation
and one industry to another, these
would generally align with the two
categories identified above under risk
analysis (technical incentive design
and materiality).
Business impact risk – This is a
function of the degree of risk the
business itself faces in the course
of its operations. For example, in
a financial services firm, one key
consideration is the extent to which
the firm is committing capital and
underwriting risks (where the potential
returns could be quite volatile and
unknown), or if it is operating in more
of a fee-based mode (where it is
quite clear at the time of the sale
exactly how much money the firm will
make). In an industrial environment, it
might relate to the degree of danger
involved in the firm’s production
facilities and operations. In both
cases, it is important to understand
the extent to which the jobs in
question can impact potential risk
outcomes based on decisions they
are making, where such decisions
are likely to be influenced at least in
part by the behaviours driven by their
incentive plans. The business itself
may have high risks (for example, a
potentially dangerous manufacturing
environment), but the impact that
plant employees have on this risk is
substantially different than the impact
that salespeople will have on it.
Actions to treat incentive risk
Changing the design of the incentive
plan is one potential course of action.
For instance, a business may decide
that using an uncapped incentive plan
for certain jobs creates too great of a
risk of windfalls that are not reflective
of the effort required to drive the
result. Or it may find that a plan
contains a ‘cliff’ mechanism, whereby
earnings increase dramatically upon
reaching a key milestone – which, in
the case of a sales plan, may increase
the risk of mis-selling in order to get
over this hurdle. But in other cases,
it may be felt that such features
are important and the risks can be
managed through other means. This is
where two other important elements
come into play – incentive governance,
and performance management.
Incentive governance
Incentive governance refers to the
oversight and control processes
in place to monitor and manage
the incentive plan. We think of it
as all of the things that need to
happen throughout the lifecycle
of an incentive plan – starting with
the establishment of principles and
objectives that should underpin the
plan design, moving through the
plan design process, goal setting,
budgeting, and then administering
and managing the plan throughout
the year.
In the above examples, a company
that decides the value of not having
caps outweighs the risk of putting
them in place could establish an
incentive governance process that
requires formal review and approval
of all incentive earnings before
they are paid. They could establish
a process whereby any individual
payments above £X value, or
above X% of the target payout, are
automatically reviewed. In the case
of an extraordinarily large payout, this
gives the company the opportunity
to confirm the validity of the situation.
And they may also include language
in the incentive plan terms and
conditions stipulating that although
the intent of the plan is to operate in
an uncapped fashion, payments above
X level will be reviewed and must be
approved by management before
they are made.
Performance management
There is a fundamental law of
incentives that all too many
organisations are quick to overlook –
namely, you can’t pay for everything
you need someone to do. If you try
to do so, you end up with an incentive
plan that is overcomplicated and
fails to drive the desired behaviour.
Incentives can be a powerful
motivator and driver of certain results
and outcomes, but not all. And part of
the way that incentive plan risk can
and must be controlled is through
the role that managers play – the
types of goals and objectives they
set, the way they provide feedback,
and how they coach and direct the
team’s performance (as well as when
and how they provide recognition).
Clear guidelines, criteria, and tools
need to be developed to support
9 Risk culture startst to come of age
The impact of risk culture
on incentives
The retail industry provides a
particularly good example of
the link between risk culture
and incentives. Many retail
organisations are placing greater
emphasis on customer service
as a means of differentiating
themselves in an increasingly
commoditised world. In so doing,
they also question whether using
a highly variable commission
plan for their store staff creates
a potential conflict between how
their employees are paid and the
focus they want them to place on
serving customers and creating
a positive customer ‘experience’.
Some retailers have felt very
strongly that they need to place
more emphasis on base salary,
and have a relatively small incentive
which is linked entirely to team
(store) results, with particularly
strong emphasis on customer
satisfaction scores.
However, one leading retailer has
taken a very different approach.
It has traditionally paid a large
portion of compensation in
the form of an individual sales
commission. Top sellers have
been able to earn very handsome
rewards – resulting in significant
differentiation in earnings between
lower and higher performers. At
the same time, this organisation is
also routinely seen as leading the
industry in its customer orientation
and responsiveness. It sets a
standard to which many others
aspire. And yet it pays its staff in
a way that would seemingly create
a high likelihood of misalignment of
interests between employees and
customers.
But somehow, it all works. Why?
Because of the overriding impact
of the organisation’s culture. The
culture of customer service is so
deeply embedded in this company
that store staff would not even
think of taking an action that would
drive their commission if they felt
it was not also helping to serve the
customer and meet the customer’s
needs. This means, at times,
spending time with a customer to
take back an item being returned,
or to manage a very small value
transaction, when instead the
salesperson could potentially be
selling a very high value designer
bag. The culture is such that if
someone was seen to be taking
a ‘pushy’ approach to customers,
failing to listen and serve, not only
would their manager address this
in the performance management
process, but they would be
ostracised and disrespected by
their co-workers.
This is of course not to say that no
one who has ever worked for this
firm has ever ‘pushed’ a sale based
on the commission that could be
earned, while failing to serve the
customer appropriately. But those
who have a pattern of doing so are
dealt with quickly and efficiently –
and they either shape up or ship
out very quickly.
managers in this regard. Individuals
who are behaving in a way that
merely maximises their earnings while
creating inappropriate risk for the
company or its customers need to be
addressed promptly, first via feedback
and coaching, and eventually, if
required (and certainly in more
egregious cases), through the threat
of possible termination. Tolerating
certain behaviour just because the
incentive plan ‘pays’ for it must be
viewed as inexcusable – and is a sure
sign that there is not a healthy risk
culture in the organisation.
Talent management and
risk culture
While the role of reward programmes
in shaping risk culture has taken
on a very high profile, the impact of
other aspects of talent management
has perhaps been underplayed. In
practice, though, there is much that
can be done throughout the talent
management ‘life cycle’ to help shape
and promote a positive risk culture.
From the first contact with potential
recruits, through their induction,
development, progression and
even departure from the business,
employees’ experiences will influence
the risk culture of the business.
In building and maintaining a positive
organisational risk culture it is worth
paying attention to each of these
aspects and the impact they have
on shaping people’s understanding
and attitudes.
10 willistowerswatson.com
Conclusions
Although the term ‘risk culture’ is
used by people in a variety of ways,
we consider the broad concept to be
fundamental to an organisation’s ability
to manage its risks and so to achieve
its strategic objectives. This is best
demonstrated by briefly considering
the contrary – there are simply too
many cases of organisations (and
their stakeholders) suffering from the
consequences of a poor risk culture.
Just as no two organisations are
exactly alike, there is no single ideal
risk culture. Rather, each organisation
should develop its own understanding
of the risk culture that works best
in its own circumstances, for
example, in relation to its long-term
objectives, shorter-term plans and
risk environment.
Much of an organisation’s risk culture
lies ‘beneath the surface’, so important
cultural characteristics may not be
immediately apparent, but they can be
identified, measured and understood
using a range of qualitative and
quantitative approaches.
This is particularly important for
organisations in assessing their risk
profile as the risk assessments will be
based on sets of experience data and
assumptions, including assumptions
on how people will behave in different
scenarios, which will reflect underlying
attitudes and beliefs.
Armed with a better understanding of
the prevailing situation, leaders and
managers have access to a range
of levers that they can use to shape
the culture (including risk culture)
of their organisation to help them to
improve their overall management
of risk. These include things like
training, communication, management
information reporting and governance
as well as the full spectrum of talent
management and rewards approaches.
However, managing culture is not easy
and attempts to shape culture are
prone to unintended consequences.
In particular, attempts to use incentive
/ reward systems as a silver bullet to
control risk culture are ill-founded.
While financial reward can play an
important role in shaping risk culture
it is important to realise that that a
more holistic approach is needed
to bring about a more robust and
appropriate risk culture in most
organisations.
Reliable external pipeline
for volume roles, and
internal progression for
specialist/senior roles
Assess candidates against risk
competencies
Performance definition
includes risk-based
competencies and
outcomes
Reward the right
behaviours not just the
right results; incentives
aligned with risk appetite
Risk competencies play a key
role in career development
programmes
Mitigate human capital
risk by ensuring effective
talent pipeline
Leaders tasked with
demonstrating, promoting
and celebrating sound
judgement, encouraging
open dialogue and
process improvement and
adherence to risk policies
Attract, retain, engage
and reward talented
employees who exercise
sound judgement based
on risk frameworks
and business values
Talent
Acquisition/
Sourcing
Performance
Management
Compensation
and Rewards
Career
Management
Succession
Management
Leadership
and Capability
Development
Workforce
Planning
Figure 3. Talent Management programmes help
accelerate the transition to the desired risk culture…
11 Risk culture startst to come of age
Notes
This paper is a summary of a chapter
on risk culture contributed by the
authors in the recently published
book ‘Enterprise Risk Management:
A common framework for the entire
organization’, published by Elsevier.
1 The Institute of Risk Management,
Risk Culture: https://www.theirm.org/
media/885907/Risk_Culture_A5_
WEB15_Oct_2012.pdf
2 European Business Review (2014).
http://www.europeanbusinessreview.
com/?p=2817
3 Warren Buffet (2006), Memorandum
to Berkshire Hathaway Managers,
in Financial Times (October 6,
2006), Full text of Warren Buffett’s
memorandum.
4 The RiskMinds 2009 Risk
Managers’ Survey: The causes and
implications of the 2008 banking
crisis: http://www.moorecarter.
co.uk/RiskMinds%202009%20
Risk%20Managers’%20Survey%20
Report.19March2010.pdf
Contacts
For further information, please contact:
Ron Burke
Tel: +44 20 7170 3257
ron.burke@willistowerswatson.com
Oliver Davidson
Tel: +44 20 7170 3776
oliver.davidson@willistowerswatson.com
Patricia Mackenzie
Tel: +44 20 7170 3020
patricia.mackenzie@willistowerswatson.com
Mike Wilkinson
Tel: +44 20 7170 2000
mike.wilkinson@willistowerswatson.com
Copyright © 2016 Towers Watson. All rights reserved.
WTW-EU-16-PUB-1735
willistowerswatson.com
About Willis Towers Watson
Willis Towers Watson (NASDAQ: WLTW) is a leading global advisory, broking and
solutions company that helps clients around the world turn risk into a path for
growth. With roots dating to 1828, Willis Towers Watson has 39,000 employees
in more than 120 territories. We design and deliver solutions that manage risk,
optimise benefits, cultivate talent, and expand the power of capital to protect and
strengthen institutions and individuals. Our unique perspective allows us to see
the critical intersections between talent, assets and ideas — the dynamic formula
that drives business performance. Together, we unlock potential. Learn more at
willistowerswatson.com.
Towers Watson is represented in the UK by Towers Watson Limited.
The information in this publication is of general interest and guidance. Action
should not be taken on the basis of any article without seeking specific advice.
To unsubscribe, email eu.unsubscribe@towerswatson.com with the publication
name as the subject and include your name, title and company address.
Willis Towers Watson
71 High Holborn
London
WC1V 6TP

Weitere ähnliche Inhalte

Was ist angesagt?

Common failures of risk management
Common failures of risk management   Common failures of risk management
Common failures of risk management Surajit Datta
 
The importance of managing reputational risks.
The importance of managing reputational risks.The importance of managing reputational risks.
The importance of managing reputational risks.Albert Vilariño
 
OSACO brocure Overview - Banking
OSACO brocure Overview - BankingOSACO brocure Overview - Banking
OSACO brocure Overview - BankingSean Buckley
 
OSACO brochure - Finance
OSACO brochure - FinanceOSACO brochure - Finance
OSACO brochure - FinanceJaydene Buckley
 
W6 making decisions in risky situations - simon pollard
W6   making decisions in risky situations - simon pollardW6   making decisions in risky situations - simon pollard
W6 making decisions in risky situations - simon pollardlgconf11
 
Exploring risk management disclosure practices in non profit organisations in...
Exploring risk management disclosure practices in non profit organisations in...Exploring risk management disclosure practices in non profit organisations in...
Exploring risk management disclosure practices in non profit organisations in...Alexander Decker
 
7992_RiskWatch_Special Edition_Spring 2016_4-FINAL (2)
7992_RiskWatch_Special Edition_Spring 2016_4-FINAL (2)7992_RiskWatch_Special Edition_Spring 2016_4-FINAL (2)
7992_RiskWatch_Special Edition_Spring 2016_4-FINAL (2)Christine Maligec, CRM-E, CRIS
 
Managing Risk in Perilous Times- Practical Steps to Accelerate Recovery
Managing Risk in Perilous Times- Practical Steps to Accelerate RecoveryManaging Risk in Perilous Times- Practical Steps to Accelerate Recovery
Managing Risk in Perilous Times- Practical Steps to Accelerate RecoveryFindWhitePapers
 
View from the top. A board-level perspective of current business risks
View from the top. A board-level perspective of current business risksView from the top. A board-level perspective of current business risks
View from the top. A board-level perspective of current business risksThe Economist Media Businesses
 
Emergence of the Chief Risk Officer function
Emergence of the Chief Risk Officer functionEmergence of the Chief Risk Officer function
Emergence of the Chief Risk Officer functionMichel Rochette
 
Sap 2009 06 02 Risk Management
Sap 2009 06 02 Risk ManagementSap 2009 06 02 Risk Management
Sap 2009 06 02 Risk ManagementPierre Harboun
 
SUPPLY CHAIN RISK MANAGEMENT
SUPPLY CHAIN RISK MANAGEMENTSUPPLY CHAIN RISK MANAGEMENT
SUPPLY CHAIN RISK MANAGEMENTPaul Authachinda
 
Operational risk: the new frontier
Operational risk: the new frontierOperational risk: the new frontier
Operational risk: the new frontierMichel Rochette
 
Deloitte es grc_sostenibilidad-reputation-survey
Deloitte es grc_sostenibilidad-reputation-surveyDeloitte es grc_sostenibilidad-reputation-survey
Deloitte es grc_sostenibilidad-reputation-surveyBluemap Consulting Group
 
Understanding and Managing Reputation Risk
Understanding and Managing Reputation RiskUnderstanding and Managing Reputation Risk
Understanding and Managing Reputation RiskSteve Leigh
 
speaking-to-board-securiity-whitepaper
speaking-to-board-securiity-whitepaperspeaking-to-board-securiity-whitepaper
speaking-to-board-securiity-whitepaperBilha Diaz
 
Moving from Process to Purpose, Risk Management after COVID19
Moving from Process to Purpose, Risk Management after COVID19 Moving from Process to Purpose, Risk Management after COVID19
Moving from Process to Purpose, Risk Management after COVID19 chungarisk
 
Risk Management ERM Presentation
Risk Management ERM PresentationRisk Management ERM Presentation
Risk Management ERM Presentationalygale
 

Was ist angesagt? (20)

Risk culture - IRM PROTIVITI
Risk culture - IRM PROTIVITIRisk culture - IRM PROTIVITI
Risk culture - IRM PROTIVITI
 
Common failures of risk management
Common failures of risk management   Common failures of risk management
Common failures of risk management
 
The importance of managing reputational risks.
The importance of managing reputational risks.The importance of managing reputational risks.
The importance of managing reputational risks.
 
OSACO brocure Overview - Banking
OSACO brocure Overview - BankingOSACO brocure Overview - Banking
OSACO brocure Overview - Banking
 
OSACO brochure - Finance
OSACO brochure - FinanceOSACO brochure - Finance
OSACO brochure - Finance
 
W6 making decisions in risky situations - simon pollard
W6   making decisions in risky situations - simon pollardW6   making decisions in risky situations - simon pollard
W6 making decisions in risky situations - simon pollard
 
Exploring risk management disclosure practices in non profit organisations in...
Exploring risk management disclosure practices in non profit organisations in...Exploring risk management disclosure practices in non profit organisations in...
Exploring risk management disclosure practices in non profit organisations in...
 
7992_RiskWatch_Special Edition_Spring 2016_4-FINAL (2)
7992_RiskWatch_Special Edition_Spring 2016_4-FINAL (2)7992_RiskWatch_Special Edition_Spring 2016_4-FINAL (2)
7992_RiskWatch_Special Edition_Spring 2016_4-FINAL (2)
 
Managing Risk in Perilous Times- Practical Steps to Accelerate Recovery
Managing Risk in Perilous Times- Practical Steps to Accelerate RecoveryManaging Risk in Perilous Times- Practical Steps to Accelerate Recovery
Managing Risk in Perilous Times- Practical Steps to Accelerate Recovery
 
View from the top. A board-level perspective of current business risks
View from the top. A board-level perspective of current business risksView from the top. A board-level perspective of current business risks
View from the top. A board-level perspective of current business risks
 
7350_RiskWatch-Summer2015-Maligec
7350_RiskWatch-Summer2015-Maligec7350_RiskWatch-Summer2015-Maligec
7350_RiskWatch-Summer2015-Maligec
 
Emergence of the Chief Risk Officer function
Emergence of the Chief Risk Officer functionEmergence of the Chief Risk Officer function
Emergence of the Chief Risk Officer function
 
Sap 2009 06 02 Risk Management
Sap 2009 06 02 Risk ManagementSap 2009 06 02 Risk Management
Sap 2009 06 02 Risk Management
 
SUPPLY CHAIN RISK MANAGEMENT
SUPPLY CHAIN RISK MANAGEMENTSUPPLY CHAIN RISK MANAGEMENT
SUPPLY CHAIN RISK MANAGEMENT
 
Operational risk: the new frontier
Operational risk: the new frontierOperational risk: the new frontier
Operational risk: the new frontier
 
Deloitte es grc_sostenibilidad-reputation-survey
Deloitte es grc_sostenibilidad-reputation-surveyDeloitte es grc_sostenibilidad-reputation-survey
Deloitte es grc_sostenibilidad-reputation-survey
 
Understanding and Managing Reputation Risk
Understanding and Managing Reputation RiskUnderstanding and Managing Reputation Risk
Understanding and Managing Reputation Risk
 
speaking-to-board-securiity-whitepaper
speaking-to-board-securiity-whitepaperspeaking-to-board-securiity-whitepaper
speaking-to-board-securiity-whitepaper
 
Moving from Process to Purpose, Risk Management after COVID19
Moving from Process to Purpose, Risk Management after COVID19 Moving from Process to Purpose, Risk Management after COVID19
Moving from Process to Purpose, Risk Management after COVID19
 
Risk Management ERM Presentation
Risk Management ERM PresentationRisk Management ERM Presentation
Risk Management ERM Presentation
 

Ähnlich wie Perspectives-Risk-culture-starts-to-come-of-age

New Risk Management Paradigm for Not-For-Profits
New Risk Management Paradigm for Not-For-ProfitsNew Risk Management Paradigm for Not-For-Profits
New Risk Management Paradigm for Not-For-ProfitsDavid X Martin
 
STRATEGIC PLANNINGManaging Risks A NewFrameworkby Rob.docx
STRATEGIC PLANNINGManaging Risks A NewFrameworkby Rob.docxSTRATEGIC PLANNINGManaging Risks A NewFrameworkby Rob.docx
STRATEGIC PLANNINGManaging Risks A NewFrameworkby Rob.docxsusanschei
 
Risk culture a5_web15_oct_2012
Risk culture a5_web15_oct_2012Risk culture a5_web15_oct_2012
Risk culture a5_web15_oct_2012Kym Jaeger
 
ASSESSING THE RELATIONSHIP EFFECTIVE RISK ANALYSIS HAVE ON BUSINESS SUCCESS
ASSESSING THE RELATIONSHIP EFFECTIVE RISK ANALYSIS HAVE ON BUSINESS SUCCESSASSESSING THE RELATIONSHIP EFFECTIVE RISK ANALYSIS HAVE ON BUSINESS SUCCESS
ASSESSING THE RELATIONSHIP EFFECTIVE RISK ANALYSIS HAVE ON BUSINESS SUCCESSRobin Beregovska
 
Thoughts on Direction of Ops Risk Management -V4 0
Thoughts on Direction of Ops Risk Management -V4 0Thoughts on Direction of Ops Risk Management -V4 0
Thoughts on Direction of Ops Risk Management -V4 0Amrut Joshi
 
2015 global capital markets risk management study
2015 global capital markets risk management study2015 global capital markets risk management study
2015 global capital markets risk management studyLapman Lee ✔
 
Convergence-based Approach for Managing Operational Risk and Security In Toda...
Convergence-based Approach for Managing Operational Risk and Security In Toda...Convergence-based Approach for Managing Operational Risk and Security In Toda...
Convergence-based Approach for Managing Operational Risk and Security In Toda...Marc S. Sokol
 
Manigent Aligning Risk Appetite And Exposure
Manigent Aligning Risk Appetite And ExposureManigent Aligning Risk Appetite And Exposure
Manigent Aligning Risk Appetite And ExposureAndrew Smart
 
Paradigm Paralysis in ERM & IA EB7_p48-51 Tim Leech v2
Paradigm Paralysis in ERM & IA EB7_p48-51 Tim Leech v2Paradigm Paralysis in ERM & IA EB7_p48-51 Tim Leech v2
Paradigm Paralysis in ERM & IA EB7_p48-51 Tim Leech v2Tim Leech
 
Building an invisible framework for risk management
Building an invisible framework for risk managementBuilding an invisible framework for risk management
Building an invisible framework for risk managementhallowedblasphe76
 
Trusted advisor white paper (final)
Trusted advisor white paper (final)Trusted advisor white paper (final)
Trusted advisor white paper (final)Albert Schot
 
Chaitanya Kosaraju Week 4 discussionCOLLAPSETop of FormHan.docx
Chaitanya Kosaraju Week 4 discussionCOLLAPSETop of FormHan.docxChaitanya Kosaraju Week 4 discussionCOLLAPSETop of FormHan.docx
Chaitanya Kosaraju Week 4 discussionCOLLAPSETop of FormHan.docxketurahhazelhurst
 
I need response to Discussion post in 200 words.docx
I need response to Discussion post in 200 words.docxI need response to Discussion post in 200 words.docx
I need response to Discussion post in 200 words.docxsdfghj21
 
I need response to Discussion post in 200 words.docx
I need response to Discussion post in 200 words.docxI need response to Discussion post in 200 words.docx
I need response to Discussion post in 200 words.docxwrite4
 

Ähnlich wie Perspectives-Risk-culture-starts-to-come-of-age (20)

New Risk Management Paradigm for Not-For-Profits
New Risk Management Paradigm for Not-For-ProfitsNew Risk Management Paradigm for Not-For-Profits
New Risk Management Paradigm for Not-For-Profits
 
STRATEGIC PLANNINGManaging Risks A NewFrameworkby Rob.docx
STRATEGIC PLANNINGManaging Risks A NewFrameworkby Rob.docxSTRATEGIC PLANNINGManaging Risks A NewFrameworkby Rob.docx
STRATEGIC PLANNINGManaging Risks A NewFrameworkby Rob.docx
 
Lean Auditing
Lean AuditingLean Auditing
Lean Auditing
 
Risk culture a5_web15_oct_2012
Risk culture a5_web15_oct_2012Risk culture a5_web15_oct_2012
Risk culture a5_web15_oct_2012
 
ASSESSING THE RELATIONSHIP EFFECTIVE RISK ANALYSIS HAVE ON BUSINESS SUCCESS
ASSESSING THE RELATIONSHIP EFFECTIVE RISK ANALYSIS HAVE ON BUSINESS SUCCESSASSESSING THE RELATIONSHIP EFFECTIVE RISK ANALYSIS HAVE ON BUSINESS SUCCESS
ASSESSING THE RELATIONSHIP EFFECTIVE RISK ANALYSIS HAVE ON BUSINESS SUCCESS
 
Shifting into an ERM Culture
Shifting into an ERM CultureShifting into an ERM Culture
Shifting into an ERM Culture
 
CRO Insight
CRO InsightCRO Insight
CRO Insight
 
Risk Management and Trust
Risk Management and TrustRisk Management and Trust
Risk Management and Trust
 
Thoughts on Direction of Ops Risk Management -V4 0
Thoughts on Direction of Ops Risk Management -V4 0Thoughts on Direction of Ops Risk Management -V4 0
Thoughts on Direction of Ops Risk Management -V4 0
 
2015 global capital markets risk management study
2015 global capital markets risk management study2015 global capital markets risk management study
2015 global capital markets risk management study
 
Convergence-based Approach for Managing Operational Risk and Security In Toda...
Convergence-based Approach for Managing Operational Risk and Security In Toda...Convergence-based Approach for Managing Operational Risk and Security In Toda...
Convergence-based Approach for Managing Operational Risk and Security In Toda...
 
Manigent Aligning Risk Appetite And Exposure
Manigent Aligning Risk Appetite And ExposureManigent Aligning Risk Appetite And Exposure
Manigent Aligning Risk Appetite And Exposure
 
Paradigm Paralysis in ERM & IA EB7_p48-51 Tim Leech v2
Paradigm Paralysis in ERM & IA EB7_p48-51 Tim Leech v2Paradigm Paralysis in ERM & IA EB7_p48-51 Tim Leech v2
Paradigm Paralysis in ERM & IA EB7_p48-51 Tim Leech v2
 
Aligning Corporate Strategy with Risks in order to avoid a Crisis
Aligning Corporate Strategy with Risks in order to avoid a CrisisAligning Corporate Strategy with Risks in order to avoid a Crisis
Aligning Corporate Strategy with Risks in order to avoid a Crisis
 
Building an invisible framework for risk management
Building an invisible framework for risk managementBuilding an invisible framework for risk management
Building an invisible framework for risk management
 
Trusted advisor white paper (final)
Trusted advisor white paper (final)Trusted advisor white paper (final)
Trusted advisor white paper (final)
 
Chaitanya Kosaraju Week 4 discussionCOLLAPSETop of FormHan.docx
Chaitanya Kosaraju Week 4 discussionCOLLAPSETop of FormHan.docxChaitanya Kosaraju Week 4 discussionCOLLAPSETop of FormHan.docx
Chaitanya Kosaraju Week 4 discussionCOLLAPSETop of FormHan.docx
 
Rethinking Risk Culture in a Post-pandemic Era
Rethinking Risk Culture in a Post-pandemic EraRethinking Risk Culture in a Post-pandemic Era
Rethinking Risk Culture in a Post-pandemic Era
 
I need response to Discussion post in 200 words.docx
I need response to Discussion post in 200 words.docxI need response to Discussion post in 200 words.docx
I need response to Discussion post in 200 words.docx
 
I need response to Discussion post in 200 words.docx
I need response to Discussion post in 200 words.docxI need response to Discussion post in 200 words.docx
I need response to Discussion post in 200 words.docx
 

Perspectives-Risk-culture-starts-to-come-of-age

  • 1. While references to the concept of risk culture are relatively new, shortcomings in risk awareness and management have become identified as fundamental causal factors in recent world events, such as the global economic crisis and major industrial accidents. Perspectives Risk culture starts to come of age
  • 2. 2 willistowerswatson.com The attention focused on the determinants of, and influences on, risk culture has become progressively greater in recent years, thanks substantially to continuing autopsies of the 2008 global financial crisis. Yet, for all the discussion, there remains no universally agreed definition. Perhaps the most frequently cited example is the Institute of Risk Management’s1 : “Risk culture is a term describing the values, beliefs, knowledge, attitudes and understanding about risk shared by a group of people with a common purpose, in particular the employees of an organisation.” As those working within the field would readily acknowledge, the difficulty with any definition is that risk culture will vary widely from one context to another, depending on factors such as broader organisational objectives and behaviour, sector of operation, and the nature of risk. The challenge for firms looking to improve how they evaluate and react to risk is to identify what works for them. Risk culture and organisational culture The nature of the relationship between organisational culture and risk culture is a matter of debate and perspective. Some people view risk culture as a sub-set of organisational culture; for others it overlaps with, but also extends beyond, the traditional boundaries of organisational culture. For yet others, risk culture is simply organisational culture viewed through a risk lens. But there are several principles from organisational culture more generally that have an important bearing on risk culture, including: ƒƒ Culture matters: Organisational culture really does make a difference. Although culture is sometimes regarded as ‘soft’, it plays a powerful role in determining behaviour and organisational effectiveness. To emphasise this point, among the more colourful opinions expressed along these lines are: “Culture eats strategy for breakfast” often attributed to the management writer Peter Drucker2 and: “Culture, more than rule books, determines how an organisation behaves” from business leader, Warren Buffett in a Financial Times interview3 . ƒƒ Much of culture lies beneath the surface: Some aspects of culture, such as the management reporting line, are quite visible and readily apparent. Others, such as the unwritten lore, informal relationships and people’s personal attitudes are more hidden beneath the surface. ƒƒ There is no ‘best’ culture: Cultures vary between (and within) organisations – and they should. A company competing on the basis of its creativity will need Risk culture starts to come of age a different culture to succeed than another competing on the basis of operational efficiency. ƒƒ Culture can be articulated, measured and managed: To some, the very notion of organisational culture seems ethereal and difficult to describe, let alone quantify or manage. However, there are well developed approaches that provide effective ways to do just this. Practical application: Financial services Moving from theory to practice, the financial services industry is perhaps understandably the most obvious sector where risk culture has come under the closest scrutiny in recent times. There is little doubt that an important contributor to the financial crisis of 2008 was the prevalence of a culture that promoted the pursuit of short- term profits at the expense of long- term value generation, which was exacerbated by being entrenched into individuals’ rewards. This view was supported by a survey4 which found that most risk professionals believed the banking crisis was caused not so much by technical failures as by failures in organisational culture and ethics, with 85% citing remuneration practices as important or very important. Although the role of reward may sometimes be overstated, it can clearly play an important part in shaping culture and behaviour. While references to the concept of risk culture are relatively new, shortcomings in risk awareness and management have become identified as fundamental causal factors in recent world events, such as the global economic crisis and major industrial accidents.
  • 3. 3 Risk culture startst to come of age In recent years, firms have launched reviews of their operational and governance models to address weaknesses that were considered to have contributed to the increased and often unrecognised risks. These reviews have addressed a wide range of areas, including product complexity, incentive schemes and oversight. More, however, remains to be done. Embedding a consistent risk culture beyond the boardroom and into business units can prove particularly challenging. While the Board and the Chief Risk Officer (CRO) have overall responsibility for ensuring this happens, the direct responsibility for risk management and the risk culture lies with operational management. There may be a tendency to assume that because someone has ‘Risk’ in their title they must take on all risk responsibility. In reality, it is the role of senior management to set the tone and encourage and empower employees to behave in line with the desired risk culture. But in many cases new governance and processes are driven by recent events and external pressures, rather than a longer-term view of a culture of risk awareness that balances the downside risk with well-managed opportunities that could result in significant competitive advantages. What marks out the latter is the leadership of Boards and CROs, as well as other risk specialists, to clearly articulate a balanced, business orientated view of risk as a basis for educating and advising the rest of the business. Talent management, communication and education programmes are critical to a successful risk culture, typically requiring a long- term commitment from operational management as much as the risk team. It should not be forgotten that much of risk culture resides in people’s attitudes, beliefs, habits and relationships and is hidden ‘beneath the surface’, which affects the manner in which policies, systems and processes are approached in practice, and therefore their success. As an example, following a significant risk event, Towers Watson was asked to review a financial services company’s governance procedures, to evaluate whether appropriate decision making processes and levels of authority were in place. The conclusion reached could also apply to many incidents in the sector over the last few years: ‘There was nothing wrong with their governance procedures – apart from the fact that they didn’t use them.’ Although the system of internal committees and decision-making processes was well defined, in practice decisions had been influenced by conversations in the corridors and by the strength of relationships between individuals. A clear lesson from this is that an organisation’s formal risk governance processes and its risk culture need to be in tune with each other to be effective and the design and implementation of the risk management system should take full account of the culture.
  • 4. 4 willistowerswatson.com Measuring risk culture For all the mounting evidence of the value of culture in how organisations behave, some managers, and some risk managers in particular, have shied away from the concept of risk culture, not knowing quite how to approach it. For those from an engineering or actuarial background, for example, the notion of trying to measure such an apparently ethereal concept can be troubling. But, in keeping with the mantra ‘what gets measured gets managed’, if risk culture is to be effectively managed, it surely needs to be measured. Fortunately, there are well developed approaches that can do just this. At the less formalised/ad hoc end of the spectrum, organisations have tended to rely on existing data sources, such as drawing on information from generic staff surveys, policies and values statements, as well as relying on subjective personal impressions. A more structured qualitative approach offers a great deal more insight. This typically takes the form of a series of senior level interviews, combined with focus groups from across the organisation. Such an approach can be applied widely across a large organisation but also lends itself to smaller business units. Safety culture In other sectors such as energy, oil and gas, construction, transportation and logistics, mining, and manufacturing, safety is frequently cited as the number one business priority. Where safety incidents have occurred, large or small, investigations have often identified organisational culture as an underlying cause. But what aspects of culture are most important in developing a strong safety culture? In research conducted by Willis Towers Watson, employees of businesses recognised for their safety records reported positive, open relationships with their line managers, who were seen as technically knowledgeable, receptive and responsive to input and were forthcoming with recognition for good work. Good line management was found to create a sense of empowerment. Individual employees were able to take responsibility through delegated authority and access to relevant information. They were encouraged to develop innovative solutions to problems. Positive safety environments were also found to have a stronger emphasis on collaboration and teamwork – which were found to be especially important in exceptionally busy environments. Notably, it is important to capture both the senior, strategic perspective and those from the middle- and front-line roles as each has access to a different set of information and experiences that are very relevant to the risk culture. Much as the insights from a qualitative approach such as this are very helpful in identifying issues to be addressed, it does not lend itself to quantification, and so it is difficult to determine the extent of an issue, to compare within or between organisations or to track progress accurately. A complementary survey approach is able to meet these needs, and many organisations are now using risk culture surveys to monitor this critical aspect of their business. These range from simple generic questionnaires to those that are tailor-designed to meet the specific needs of the organisation. Surveys provide a readily scalable approach, so can be applied across organisations of all sizes.
  • 5. 5 Risk culture startst to come of age Organisations naturally differ from one another in terms of their strategies, products/services, markets, heritage, structures and processes – so it is only sensible that their cultures would and should differ too. Where possible, it is therefore preferable to design a measurement approach to fit the specific needs of the organisation. If using a survey, this means designing a set of questions that reflect the particular issue most important to the effective operation of that organisation. More sophisticated statistical analysis of a well-designed survey can even provide insights into the underlying dynamics of the prevailing risk culture, for example, identifying high impact topics that are the biggest influence on people’s attitudes, and so inform effective change plans. An example is illustrated in Figure 1. As well as providing the insights described above, in our experience, a systematic approach to measuring risk culture often also has several less direct but equally beneficial consequences. Firstly, to the extent that it is visible across the organisation, it raises the profile of an important, but sometimes overlooked topic. Leader sponsorship of a risk culture initiative demonstrates that it is taken seriously and helps convey a positive tone from the top. We have also found that introducing a risk culture measurement process makes the topic much more accessible and tangible to both internal and external stakeholders. It provides a common language and set of constructs that managers can use to discuss the topic in a clear and constructive way, and helps investors or regulators, for example, understand the value of the existing risk culture. In essence, measuring risk culture begins to give leaders, managers and employees the concepts and insights they need to begin managing risk culture effectively. Risk information and reporting Leadership Processes, controls and systems Governance Risk strategy Risk attitudes Risk awareness Figure 1. Drivers of risk attitudes
  • 6. 6 willistowerswatson.com There is no question that rewards – and variable incentive compensation in particular – can and do drive behaviour. In this way, rewards can be a powerful tool. The problem, however, is that rewards won’t necessarily always drive the desired behaviours or outcomes. This has led many organisations to focus on the risks, or potential risks, created by rewards. Examples of such risks might include: ƒƒ A CEO or senior leadership team that takes actions to maximise the stock price in the short-term, thus risking long-term profitability and growth, because their rewards are linked to earnings per share ƒƒ A leadership team that makes overly generous assumptions in recognising revenue in order to produce better results that drive higher bonuses ƒƒ A sales team that pushes through a large volume of orders, generating high commissions, without considering whether those sales are properly aligned with customer needs, and without care as to whether those orders are later cancelled or goods are returned because their compensation is linked to gross sales rather than net sales ƒƒ Call centre staff who are rewarded based on meeting objectives related to the average length of each call. Managing risk culture With the appropriate insights, support and resources it is possible to manage organisational culture – it just can’t be done overnight. A few key guiding principles include: ƒƒ There should be a clear and compelling vision and strategy that people can understand and buy into ƒƒ The desired culture should be articulated and modelled from the highest level in the organisation ƒƒ Companies should pay attention to the ‘hidden’ side of culture that lies beneath the surface, listen to people’s concerns, understand their personal interests and fears and respond to these. Some aspects of culture (such as systems, procedures and processes) offer managers the opportunity to address them directly, whereas others (such as people’s attitudes and beliefs) can only be impacted indirectly ƒƒ Existing systems, processes and policies tend to support the status quo, so these should be reviewed and modified to reflect required cultural changes, including approaches to: ƒƒ Education and communication ƒƒ Management information ƒƒ Leadership ƒƒ Governance ƒƒ Reward and performance management Fresh approaches to these facets of an organisation give leaders and managers a greater chance to bring about sustained change in the less visible parts of culture, such as beliefs, attitudes and relationships. Although experience shows that leaders and managers can remould the risk culture of an organisation, there are also limitations on what can be achieved, and it is also easy for some actions to bring about unintended consequences. Nowhere is this the case more than in the use of incentives and rewards to influence risk culture. Rewards and performance management There are countless examples, and not just from the 2008 financial crisis, in a wide range of industries, where incentives – and the culture that went with them – were felt to have contributed at least in part to very negative outcomes. Among the more spectacular examples are the failures of Barings Bank, the ‘double suicide’ of Enron and Arthur Andersen, the failure of Lehman Brothers, and for BP both the Texas City oil refinery accident and more recently the Deepwater Horizon spill. The most damaging of these cases often involved not just one or two ‘bad apples’ but rather stemmed from practices that were tolerated – if not encouraged – as part of the cultural fabric of the organisation.
  • 7. 7 Risk culture startst to come of age Risk identification This involves identifying the sources of incentive risk, which requires creating an inventory of all the incentive plans that are currently being used in the organisation. While this may sound like a simple task, in large multinational organisations there can be tens or even hundreds of different ‘local’ plans (either local to a geography, a business unit, or a function). Risk analysis This is focused on understanding the causes and sources of incentive risk. There are a variety of methods and tools that organisations use to analyse the risk of their incentive plans – some involve very quantitative, formulaic scoring algorithms, while others take a more qualitative approach. However, the most important factors tend to revolve around two categories: Importantly, the real risk of these situations is faced by the company, not the individuals taking these actions. For the company, the potential outcomes of the employee’s actions (and the related uncertainty) can be much more far-ranging – unsatisfied customers, additional costs to resolve complaints, reputational damage, a potential loss of customers and revenue, and potential legal action along with related fines, settlements, and legal costs. In the most extreme situations, as noted above, it has led to the failure of the company. The current focus on incentives, we would argue, is both prudent but also dangerous. It is prudent because we know that poorly designed incentives can create bad outcomes. But it is also dangerous for two reasons: ƒƒ It leads to a false notion that incentives can be used to ‘control’ risk ƒƒ It places an unreasonable burden on incentives and rewards in general to serve as the primary (or exclusive) tool to manage behaviour – ignoring the role played more broadly by the organisation’s risk culture. Incentives create rather than control risk No incentive or reward programme design can be used to control risk. Rather, incentives – any incentive – create risk. Changing the design of the incentive plan can reduce or eliminate certain risks, but at the same time it creates other new risks. This is not to suggest, however, that firms should not worry about their reward design and just get on with things. Conducting a comprehensive risk assessment of incentive programmes is a process that companies will find beneficial periodically, as outlined below. ƒƒ Technical plan design details (for example, the use of thresholds and caps, the degree of upside opportunity and acceleration in pay-outs, the existence of clawbacks and deferrals, and the types of measures rewarded). ƒƒ The materiality of the plans in question (for example, the relative amount any one person can earn, as well as the size of the population impacted and the total costs involved). Risk prioritisation Having completed the risk analysis, it is then possible to identify the incentive plans that require further attention. The matrix in Figure 2 provides a simple means of prioritising incentive plan risk for many organisations. It looks at two dimensions. Figure 2. Incentive risk probabilty CATEGORY 3 Low risk: No governance or design changes required CATEGORY 2 Moderate risk: Plans may require governance or design change CATEGORY 1 High risk: Plans may require governance or design change Planlikelihood Business Consequences HighModerateLow HighModerateLow Plan A Plan B
  • 8. 8 willistowerswatson.com Incentive plan risk – while specific criteria will vary from one organisation and one industry to another, these would generally align with the two categories identified above under risk analysis (technical incentive design and materiality). Business impact risk – This is a function of the degree of risk the business itself faces in the course of its operations. For example, in a financial services firm, one key consideration is the extent to which the firm is committing capital and underwriting risks (where the potential returns could be quite volatile and unknown), or if it is operating in more of a fee-based mode (where it is quite clear at the time of the sale exactly how much money the firm will make). In an industrial environment, it might relate to the degree of danger involved in the firm’s production facilities and operations. In both cases, it is important to understand the extent to which the jobs in question can impact potential risk outcomes based on decisions they are making, where such decisions are likely to be influenced at least in part by the behaviours driven by their incentive plans. The business itself may have high risks (for example, a potentially dangerous manufacturing environment), but the impact that plant employees have on this risk is substantially different than the impact that salespeople will have on it. Actions to treat incentive risk Changing the design of the incentive plan is one potential course of action. For instance, a business may decide that using an uncapped incentive plan for certain jobs creates too great of a risk of windfalls that are not reflective of the effort required to drive the result. Or it may find that a plan contains a ‘cliff’ mechanism, whereby earnings increase dramatically upon reaching a key milestone – which, in the case of a sales plan, may increase the risk of mis-selling in order to get over this hurdle. But in other cases, it may be felt that such features are important and the risks can be managed through other means. This is where two other important elements come into play – incentive governance, and performance management. Incentive governance Incentive governance refers to the oversight and control processes in place to monitor and manage the incentive plan. We think of it as all of the things that need to happen throughout the lifecycle of an incentive plan – starting with the establishment of principles and objectives that should underpin the plan design, moving through the plan design process, goal setting, budgeting, and then administering and managing the plan throughout the year. In the above examples, a company that decides the value of not having caps outweighs the risk of putting them in place could establish an incentive governance process that requires formal review and approval of all incentive earnings before they are paid. They could establish a process whereby any individual payments above £X value, or above X% of the target payout, are automatically reviewed. In the case of an extraordinarily large payout, this gives the company the opportunity to confirm the validity of the situation. And they may also include language in the incentive plan terms and conditions stipulating that although the intent of the plan is to operate in an uncapped fashion, payments above X level will be reviewed and must be approved by management before they are made. Performance management There is a fundamental law of incentives that all too many organisations are quick to overlook – namely, you can’t pay for everything you need someone to do. If you try to do so, you end up with an incentive plan that is overcomplicated and fails to drive the desired behaviour. Incentives can be a powerful motivator and driver of certain results and outcomes, but not all. And part of the way that incentive plan risk can and must be controlled is through the role that managers play – the types of goals and objectives they set, the way they provide feedback, and how they coach and direct the team’s performance (as well as when and how they provide recognition). Clear guidelines, criteria, and tools need to be developed to support
  • 9. 9 Risk culture startst to come of age The impact of risk culture on incentives The retail industry provides a particularly good example of the link between risk culture and incentives. Many retail organisations are placing greater emphasis on customer service as a means of differentiating themselves in an increasingly commoditised world. In so doing, they also question whether using a highly variable commission plan for their store staff creates a potential conflict between how their employees are paid and the focus they want them to place on serving customers and creating a positive customer ‘experience’. Some retailers have felt very strongly that they need to place more emphasis on base salary, and have a relatively small incentive which is linked entirely to team (store) results, with particularly strong emphasis on customer satisfaction scores. However, one leading retailer has taken a very different approach. It has traditionally paid a large portion of compensation in the form of an individual sales commission. Top sellers have been able to earn very handsome rewards – resulting in significant differentiation in earnings between lower and higher performers. At the same time, this organisation is also routinely seen as leading the industry in its customer orientation and responsiveness. It sets a standard to which many others aspire. And yet it pays its staff in a way that would seemingly create a high likelihood of misalignment of interests between employees and customers. But somehow, it all works. Why? Because of the overriding impact of the organisation’s culture. The culture of customer service is so deeply embedded in this company that store staff would not even think of taking an action that would drive their commission if they felt it was not also helping to serve the customer and meet the customer’s needs. This means, at times, spending time with a customer to take back an item being returned, or to manage a very small value transaction, when instead the salesperson could potentially be selling a very high value designer bag. The culture is such that if someone was seen to be taking a ‘pushy’ approach to customers, failing to listen and serve, not only would their manager address this in the performance management process, but they would be ostracised and disrespected by their co-workers. This is of course not to say that no one who has ever worked for this firm has ever ‘pushed’ a sale based on the commission that could be earned, while failing to serve the customer appropriately. But those who have a pattern of doing so are dealt with quickly and efficiently – and they either shape up or ship out very quickly. managers in this regard. Individuals who are behaving in a way that merely maximises their earnings while creating inappropriate risk for the company or its customers need to be addressed promptly, first via feedback and coaching, and eventually, if required (and certainly in more egregious cases), through the threat of possible termination. Tolerating certain behaviour just because the incentive plan ‘pays’ for it must be viewed as inexcusable – and is a sure sign that there is not a healthy risk culture in the organisation. Talent management and risk culture While the role of reward programmes in shaping risk culture has taken on a very high profile, the impact of other aspects of talent management has perhaps been underplayed. In practice, though, there is much that can be done throughout the talent management ‘life cycle’ to help shape and promote a positive risk culture. From the first contact with potential recruits, through their induction, development, progression and even departure from the business, employees’ experiences will influence the risk culture of the business. In building and maintaining a positive organisational risk culture it is worth paying attention to each of these aspects and the impact they have on shaping people’s understanding and attitudes.
  • 10. 10 willistowerswatson.com Conclusions Although the term ‘risk culture’ is used by people in a variety of ways, we consider the broad concept to be fundamental to an organisation’s ability to manage its risks and so to achieve its strategic objectives. This is best demonstrated by briefly considering the contrary – there are simply too many cases of organisations (and their stakeholders) suffering from the consequences of a poor risk culture. Just as no two organisations are exactly alike, there is no single ideal risk culture. Rather, each organisation should develop its own understanding of the risk culture that works best in its own circumstances, for example, in relation to its long-term objectives, shorter-term plans and risk environment. Much of an organisation’s risk culture lies ‘beneath the surface’, so important cultural characteristics may not be immediately apparent, but they can be identified, measured and understood using a range of qualitative and quantitative approaches. This is particularly important for organisations in assessing their risk profile as the risk assessments will be based on sets of experience data and assumptions, including assumptions on how people will behave in different scenarios, which will reflect underlying attitudes and beliefs. Armed with a better understanding of the prevailing situation, leaders and managers have access to a range of levers that they can use to shape the culture (including risk culture) of their organisation to help them to improve their overall management of risk. These include things like training, communication, management information reporting and governance as well as the full spectrum of talent management and rewards approaches. However, managing culture is not easy and attempts to shape culture are prone to unintended consequences. In particular, attempts to use incentive / reward systems as a silver bullet to control risk culture are ill-founded. While financial reward can play an important role in shaping risk culture it is important to realise that that a more holistic approach is needed to bring about a more robust and appropriate risk culture in most organisations. Reliable external pipeline for volume roles, and internal progression for specialist/senior roles Assess candidates against risk competencies Performance definition includes risk-based competencies and outcomes Reward the right behaviours not just the right results; incentives aligned with risk appetite Risk competencies play a key role in career development programmes Mitigate human capital risk by ensuring effective talent pipeline Leaders tasked with demonstrating, promoting and celebrating sound judgement, encouraging open dialogue and process improvement and adherence to risk policies Attract, retain, engage and reward talented employees who exercise sound judgement based on risk frameworks and business values Talent Acquisition/ Sourcing Performance Management Compensation and Rewards Career Management Succession Management Leadership and Capability Development Workforce Planning Figure 3. Talent Management programmes help accelerate the transition to the desired risk culture…
  • 11. 11 Risk culture startst to come of age Notes This paper is a summary of a chapter on risk culture contributed by the authors in the recently published book ‘Enterprise Risk Management: A common framework for the entire organization’, published by Elsevier. 1 The Institute of Risk Management, Risk Culture: https://www.theirm.org/ media/885907/Risk_Culture_A5_ WEB15_Oct_2012.pdf 2 European Business Review (2014). http://www.europeanbusinessreview. com/?p=2817 3 Warren Buffet (2006), Memorandum to Berkshire Hathaway Managers, in Financial Times (October 6, 2006), Full text of Warren Buffett’s memorandum. 4 The RiskMinds 2009 Risk Managers’ Survey: The causes and implications of the 2008 banking crisis: http://www.moorecarter. co.uk/RiskMinds%202009%20 Risk%20Managers’%20Survey%20 Report.19March2010.pdf Contacts For further information, please contact: Ron Burke Tel: +44 20 7170 3257 ron.burke@willistowerswatson.com Oliver Davidson Tel: +44 20 7170 3776 oliver.davidson@willistowerswatson.com Patricia Mackenzie Tel: +44 20 7170 3020 patricia.mackenzie@willistowerswatson.com Mike Wilkinson Tel: +44 20 7170 2000 mike.wilkinson@willistowerswatson.com
  • 12. Copyright © 2016 Towers Watson. All rights reserved. WTW-EU-16-PUB-1735 willistowerswatson.com About Willis Towers Watson Willis Towers Watson (NASDAQ: WLTW) is a leading global advisory, broking and solutions company that helps clients around the world turn risk into a path for growth. With roots dating to 1828, Willis Towers Watson has 39,000 employees in more than 120 territories. We design and deliver solutions that manage risk, optimise benefits, cultivate talent, and expand the power of capital to protect and strengthen institutions and individuals. Our unique perspective allows us to see the critical intersections between talent, assets and ideas — the dynamic formula that drives business performance. Together, we unlock potential. Learn more at willistowerswatson.com. Towers Watson is represented in the UK by Towers Watson Limited. The information in this publication is of general interest and guidance. Action should not be taken on the basis of any article without seeking specific advice. To unsubscribe, email eu.unsubscribe@towerswatson.com with the publication name as the subject and include your name, title and company address. Willis Towers Watson 71 High Holborn London WC1V 6TP