In my last blog, I talked about Enterprise Risk Management and the importance of building of risk-aware Culture. I wanted to touch more on this as this is the most important element of ERM and deserves a more in-depth discussion.

The risk-aware culture I’m referring to is a set of values, beliefs, knowledge and understanding surrounding risks that are shared by a group of corporate citizens with a common objective of furthering a corporate mission. It embodies both a company’s attitude and behaviour and the danger is that a culture which does not manage risk properly may then lead to inappropriate actions by individuals and or teams.

I am sure you will agree that the “sub-prime” related financial crisis that triggered in the US in 2008 was largely driven by the lack of risk-aware culture in these financial institutions. Appetite for gains at both corporate and personals level led to neglect, or worse still, acceptance of the bad behavior that triggered the crisis.

So what makes a good risk-aware culture?

The answer, though it may sound simple, has a deeper meaning. Depending on the culture of an organisation, interpretations may differ and sometimes raise eyebrows Here are some of my thoughts on the matter:

• There should be a distinct and consistent tone from the top, including senior management and the board, which sets the policies and guidance around both risk-taking and avoidance.
• A company should have a sound commitment to ethical principles, which starts with the value system of individual employees.
• There should be transparency in sharing across the organisation, and employees should be encouraged to report risks.
• There should be appropriate risk-taking behavior and sufficient knowledge ensured at all levels.

You may wish your employees to behave a certain way, but it is important to understand what their current disposition is and how would they behave individually and or collectively given different environments. This is not only a behavioral science question but also the parameters you have set with both incentives and  possibly negative repercussions. It can be challenging to measure but it can be understood through simple survey at different levels of organisation. The survey can cover employee behaviour in different parts of an organisation from senior management to entry level employees across different functions.

Once the gap between your business goals and the current achievement or capabilities of your employees is understood, you will then be able to employ the basic principles laid out above. As this is a long and continuous journey, it is important that managers at all levels demonstrate consistent ethical and responsible behaviour, in accordance with a sustainable risk-aware culture.

I know it may sound like a daunting task and will require handholding but it is necessary for every organisation. I am sure you have your own experiences on this. How have you been addressing risk in your organization and what is the level of risk-aware culture in your organisation?