Let's begin with outlining what this article is not about. Primarily because there are numerous articles on risk culture that are aspirational, high level and invariably loaded with the buzzwords of the day. There is no doubt that risk culture is important. Many professionals acknowledge that this is an area that our banks and corporates pay much-needed heed. As such, it makes little sense re-treading the 'whys'. What leaders in a bank or corporate do need to get into is how, in practical terms, they can upgrade the risk cultural arrangements. This is precisely the aspect the article focuses here.
Firstly, a response to naysayers: is it possible to "change" the risk culture? If it's approached correctly- absolutely! There are a number of paths that can be taken to get there, though the more successful approaches share common elements.
A culture cannot be rewritten simply by mandating that the values or ideology of an organisation have changed. The organisation must approach the risk culture change as a distinct (but highly embedded) aspect of how it runs itself, with a set of objectives, a design for intervention and with regular review of both progress and outcomes. Change can be implemented by pulling on certain 'levers' to make noticeable change in important areas.
Successful change ultimately requires awareness that the board itself, and the executive management, are an integral part of the existing risk culture. Sustained change in the risk culture needs to start at the top and may require a reappraisal of approaches consistent with bringing greater diversity of thinking into the board room.
To change a risk culture, we have to be able to describe the vital aspects of that culture. Risk culture remains challenging to measure but, as sometimes attributed to the late Professor Peter Drucker, 'If it can't be measured it can't be managed'.
A clear understanding of the current culture and the desired 'target' culture is a must. It requires recognition that this is a major change programme and requires discipline and "sponsorship at the highest levels" to see it through.
The above statement is normally summarised as "tone at the top". So, if I were advising a board, what would I ask them to give shape not only to what the current risk culture is, but also, what it needs to be?
1. What tone do we set from the top? Are we providing consistent, coherent, sustained and visible leadership in terms of how we expect our people to behave and respond when dealing with risk?
2. How do we establish sufficiently clear accountabilities for those managing risks and hold them to their accountabilities? Does our incentivisation model support that?
3. What risks does our current corporate culture create for the organisation, and what risk culture is needed to ensure achievement of our corporate goals? Can people talk openly without fear of consequences or being ignored?
4. How do we acknowledge our stated corporate values when addressing and resolving risk dilemmas? Do we regularly discuss issues in these terms and has it influenced our decisions?
5. How do the organisation's structure, processes and reward systems support or detract from the development of our desired risk culture?
6. How do we actively seek out information on risk events- both ours and those of others - and ensure key lessons are learnt? Do we have sufficient organisational humility to look at ourselves from the perspective of stakeholders and not just assume we're getting it right?
7. How do we respond to whistle-blowers and others raising genuine concerns? When did this happen?
8. How do we encourage appropriate risk-taking behaviours and challenge unbalanced risk behaviours (either overly risk averse or risk seeking)?
9. How do we satisfy ourselves that new entrants will quickly absorb our desired cultural values and that established staff continue to demonstrate attitudes and behaviours consistent with our expectations?
10. How do we support learning and development associated with raising awareness and competence in managing risk at all levels? What training have we as a board had in risk?
Next, there needs to be a well-designed approach to implementing this cultural change.
As mentioned earlier, "measurement", although tricky remains key. The following aspects should be when trying to "measure" risk culture, namely: (1) Risk Architecture, (2) Organisational Culture and (3) Behaviours/ Skills.
The space afforded here will not allow for a comprehensive detailing of all these aspects. However, to share a sense of what sound/ sensible practices resemble, let's take a couple of components (out of many) for each of the above.
Of the indicators outline above, "performance measurement" is an area that gets most focus yet achieves least development. Rather than rehash those old arguments, let us instead look at what an emerging market bank should do.
Building value for a bank requires effective risk taking, whether it is taking prudent risks to gain a competitive advantage or mitigating risks to avoid potential losses. The global financial crisis brought to the forefront the important role incentives play in shaping senior management and employees' actions.
As such, a bank should match incentives paid or promised to senior executives and employees with the risk being taken and the effective management of it to promote the achievement of its long-term objectives. The risks considered here should encompass not only the conscious risk taking such as credit risk for banks as well as the consequential risk profile such as operational risk.
Banks in emerging markets have another unique aspect to consider - as they tend to have increasing number of products, growing operations and thus increasing complexity. More than banks in the developed markets, they have the opportunity to sensibly apply lessons learned from the global financial crisis and incorporate risk performance into their incentive programmes.
Effective incentive programmes within a bank must strike a balance between the bank's practices, banking laws and regulations, fluctuating market conditions, and public perceptions. The board has the responsibility of ensuring that the bank's incentive compensation programmes will support the pursuit of the bank's long-term objectives as well as short term tactical strategy. Furthermore, the board should have an active role in the determination of the incentive compensation programmes, and the potential impact on behaviour, for the board members, senior management, and all other employees.
So, in sum, organisational leaders need to do a lot more to upgrade the risk culture in our organisations. Evidence shows us that it is indeed possible to do so, and we need not tolerate a risk culture that we sleep-walked into. Given that we consider "tone at the top" as the starting point in any of the initiative, the above 10 key questions need honest answers from the board. Once those answers allow us to identify "where we need to be", we can resort to the simple framework above for execution. And finally, I have shared some examples of leading arrangements and behaviours.
This article should provide the start of risk culture upgrading discussions in institutions. For bankers, the opportunity to "deep dive" into this topic will be at the next quarterly Chief Risk Officer Forum, to be held in December at BIBM. This discussion can be taken forward with the non-bankers as well; as effective approaches to risk culture, more than any other aspect of the governance/ risk framework, tend to be highly consistent cross-sector and industry. There cannot be a "one size fits all" solution to risk management right across the board. However, the practices in more resilient organisations tend to be common.
A question for the readers, if you could inject resilience into the very DNA of your organisation in a rapidly changing world, why would you not?
Sajib S Azad is a risk advisor at BIBM for Bangladesh Bank.
© 2024 - All Rights with The Financial Express
