JP Morgan, Lehman Brothers, UBS are some examples of large and respected companies whose risk management systems have failed to some extent or completely, resulting in major losses, tarnished reputations, regulatory fines and even business collapse. Analysis after the event points to an inappropriate risk ‘culture’ in the organisation in the period leading up to the catastrophic event.
Regulators recognise that these mismatched risk cultures are ones that inadvertently permit activities in an organisation which evade well thought through risk management processes. APRA have clearly indicated, with the release of the CPS220 draft, that they intend risk culture to become a central part of a risk strategy and as such the responsibility of the board.
Over the next 12 months firms will need to build their capability of establishing and maintaining a sound risk culture so that by January 2015 they are well placed to meet all requirements.
Building and Assessing a Suitable Risk Culture
By placing ultimate responsibility on the board APRA acknowledges that an organisation’s culture is directly influenced by its leaders. Other factors also drive the emergence and maintenance of a risk culture and it is through understanding these that a risk culture can be shaped or changed. Clearly an organisation will have some form of risk culture and a first step is to assess a risk culture in its current form.
Food for Thought
What are the factors most relevant to shaping a risk culture? With just over 12 months to prepare becoming familiar with the dynamics of cultural factors is a key part in the process of developing an appropriate culture.
How can a risk culture be assessed? Is it best for an internal team to develop an approach or should external specialists be brought in to learn from their expertise?
Who will be responsible for developing the most suitable risk culture? Is this an activity that should be driven by the Human Resource team or the Risk Management team?
Let me know your feedback on these questions.
 | Hilary Lewis
Director, Systemic Consult Hilary co-founded Systemic Consult and divides her time between working with managers to develop a deeper understanding of both enterprise creation and enterprise risk management, and researching and developing models in response to the key issues these managers are primarily concerned with. |