Chief risk officer view: how I develop and maintain a strong risk culture

As a Chief Risk Officer, I have witnessed first-hand the negative impact weak risk culture has on the quality of executive decision-making.

In this piece, I wanted to share a few practical ideas that helped me, and the organisations where I’ve worked, create a strong and robust risk culture. A culture where executives talk about risks and demand risk analysis before making decisions even when the risk manager is not in the room. 

Executives need to make informed decisions every day, and most of these involve taking calculated risks.

However, the default approach to decision-making in many organisations is still based on gut instincts, personal biases, power games, inadequate motivation schemes or a desire to maintain the status quo.

This often results in suboptimal decisions that undermine the organisation’s long-term success and resilience. 

Strong risk culture is the missing piece to shift decision-making processes towards a more informed, risk-based approach.

By embedding risk management into the fabric of an organisation’s culture, executives are empowered to make better decisions, optimise resources, and achieve sustainable growth. 

However, it is all too easy for decision-makers to slip back into old habits and default methodologies when confronted with challenging situations or the need for rapid decision-making.

This is where the role of risk managers becomes crucial. They must actively develop and maintain a risk-aware culture within the organisation, ensuring that risk management principles are consistently applied. 

”Strong risk culture is the missing piece to shift decision-making processes towards a more informed, risk-based approach.”

I recently published a free guide on risk culture, which offers some surprising and practical ideas to help risk managers implement this cultural transformation. It is not going to be easy and many executives will actively sabotage the change.

I’ve listed the ideas in terms of their impact, from most powerful to most timid: 

1) Make performance and remuneration risk-based

Changing existing Key Performance Indicators (KPIs) to risk-based metrics makes a huge difference in promoting informed risk-taking.

Make all important performance metrics two-dimensional: something vs risk. Examples include NPV vs risk, cost savings vs additional risk exposure, tons vs lost time or injuries, etc.  

2) Get rid of risk reporting

Including risk information in existing management reports and presentations instead of separate risk reports helps establish a more transparent and open risk culture.

Encouraging business units to report on their own risks as part of regular performance reporting and integrating risk information throughout annual reports and investor presentations can provide stakeholders with a comprehensive view of the organisation’s risk management approach. 

3) Establish risk oversight

Integrating risk discussions into the Board’s agenda and establishing a management-level Risk Management Committee helped me promote a risk-aware culture.

These initiatives ensure that risks are considered, understood, and managed effectively, and communicated properly throughout the organisation. 

4) Collaborate with other 2nd line managers

Risk managers should join forces with managers responsible for performance improvement initiatives such as lean management, quality, safety, environment, security, and IT.

By aligning methodologies and using proper maths across all risk and decision types, risk managers can create a consistent risk culture and language throughout the organisation. 

5) Improve risk awareness through training

Providing risk management training for employees, senior management, and the Board is essential to fostering a risk-aware culture. The tone at the top plays a critical role in promoting risk management, and executive buy-in is crucial for its successful implementation. 

This is just a sneak preview of the many practical ideas outlined in RISK-ACADEMY’s guide which is designed to empower risk managers to drive cultural change within their organisations.

”The journey may be challenging, but the rewards are immense.”

I believe by challenging the status quo and promoting a risk-aware culture, risk managers can help decision-makers break away from default methodologies and embrace risk-based decision-making.

This transformation will not only lead to more informed decisions but also contribute to the long-term resilience and success of the organisation. 

I encourage you to read my guide and take a bold step towards revolutionising your organisation’s risk culture. The journey may be challenging, but the rewards are immense.