BOHR International Journal of Finance and Market Research

2022, Vol. 1, No. 1, pp. 66–68

DOI: 10.54646/bijfmr.2022.10
www.bohrpub.com

METHODS

Rethinking risk culture in a post-pandemic era

Nii Ardey Tagoe *
Risk Management, Ghana Export-Import Bank, Accra, Ghana

*Correspondence:
Nii Ardey Tagoe,
[email protected]

Received: 14 May 2022; Accepted: 22 May 2022; Published: 02 June 2022

The COVID-19 pandemic has taught us the need to rethink toward future risk and possibly how to mitigate or deal
with such risk. To do this, the right risk culture needs to be embedded into the organization’s setting. In recent
times, there has been an increase in regulatory pressure for effective risk management governance and strategy.
An inspiring risk governance and strategy will never be realized without the backing of a strong risk culture. This
paper discusses risk culture within an organization and rethinks risk culture in a post-pandemic era.
Keywords: risk culture, risk management, regulator, strategy, banks

1. Introduction can be described as a system of values, norms, mindsets,

and actions that exist within the organization to shape
Risk until the banking sector crisis of 2016/17 in Ghana daily risk decisions.
was perhaps not considered a critical and proactive role but
rather a compliance role. Poor risk management practice
was a fundamental issue associated with banks whose 2. Background
licenses were revoked by the Bank of Ghana during the
financial sector clean-up. After banking sector clean-up, risk Organizational culture can be described as a form of shared
management has thus become an emerging area within the values and beliefs that offer individuals with the norms
financial sector. The recent COVID-19 pandemic has again for behaviors in the organization (1, 2). Risk culture is an
highlighted the important role of risk management. This was element of the whole organizational culture. Risk culture
evident in the absence of Business Continuity Plans and even is an indispensable underpinning of the risk management
where they existed, they were mere documents prepared for framework (3). Wong et al. (2) concluded that the risk
compliance purposes. culture, specifically risk policy and risk appetite; key risk
Generally, it is the Board of Directors that exercises indicators; accountability; incentives; risk language; and
oversight of the risk, governance, and culture. The Board internal relationships are estimated to have substantial and
defines the desired culture, but it is up to the management undeviating effects on enterprise risk management (ERM).
and other individuals within the organization to carry out Uncertainties are inherent in the day-to-day activities of all
the desired culture. Culture is inherent, thus introduction organizations. Risk management is a strategic activity and is
of new norms and ideas may require re-engineering and re- not limited to algorithms, checklists, and programs (4). The
enforcement. Peter Drucker simply put it as “culture eats cultural dimension of risk management has been consistently
strategy for breakfast.” This is to say that an inspiring vision emphasized by a number of researchers (5, 6). In recent
and excellent strategy can never be achieved without the right times, risk management has been progressively highlighted
culture to support them. as a spectacle of good corporate governance (6, 7). Almost all
Risk culture is defined by the Institute of Risk Management boards of organizations within the financial services industry
(IRM) as “the values, beliefs, knowledge, attitudes and have a subcommittee on risk. Risk management can be
understanding about risk shared by a group of people portrayed by some overt or covert management tactics that
with a common purpose.” Put differently, risk culture do not refer to risk, but tackle it in an efficient manner.

66
10.54646/bijfmr.2022.10 67

Regular interactions, formal and informal, among risk

and business functions are commonly established to be
critical in the financial services industry (8). Regulators
and stakeholders have unquestionably been the drivers
of risk culture change programs. Individual behavior is
a function of the risk culture within an organization.
Ashby et al. (8) posited that their observations indicate
that risk culture is not just an industrywide challenge
or one restricted to the global financial crisis, but also
emphasize a variety of microlevel cultural “weaknesses”
within particular financial organizations. It is paramount
to recognize that a strong risk culture does not necessarily
beget the achievement of corporate goals (9); moreover under
certain situations, a strong risk culture can result in strategic
myopia within the organization, making it less susceptible to
environmental modifications.
Culture cannot be measured, weighed, or touched (10),
although not quantifiable but play a pivotal role in achieving
the organizational strategy. There are about four risk culture
models; these are the Cultural Theory of Risk (11), Double
FIGURE 1 | IRM risk culture framework [Institute of Risk Management
S Model (Sociability or Solidarity) (12), IRM Risk Culture (14), p 16].
Model (10), and Organizational Culture Profiling (13). The
Cultural Theory of Risk looks at the conduct of people
within the organization, and the Double S model evaluates There is no particular technique for evaluating risk culture;
the culture of the organization as a group. The IRM Culture however, there are few tools that can be adopted to infer
Model recommends eight “aspects,” categorized into four and track the level of awareness toward risk within an
“themes,” that need to exist to guarantee the right risk organization. These may include surveys, interviews within
culture is aligned to the organization’s vision, while the the organization, group discussions, feedback, reviews of
Organizational Culture Profiling supports individuals and operational processes, and training. It is exigent to measure
organizations to control preferences for varying attitudes an organization’s risk culture in order to know the current
grounded on the understanding of “work-values.” level, manage it, and improve upon it to achieve the
desired culture.
The risk culture framework identifies the following
(Figure 1):
3. Discussion
(i) Personal predisposition to risk–the level to which
Forming and maintaining a strong risk culture is imperative people are sensitive toward risk may be resilient,
for all financial institutions. Risk culture awareness is an cautious, pessimistic, or optimistic.
essential component of the ERM program. The principal (ii) Personal ethics–the set of personal moral values
cause of poor risk management practice within the financial individuals bring into the organization.
sector is a weak risk culture. Stakeholders and regulators (iii) Behaviors–the result of personal predisposition and
expect organizations to have a strong risk culture at least to personal ethics as depicted in a person’s actions.
ensure financial soundness and going concern.
(iv) Organizational culture–the way of life proscribed
by the core values and desired attitudes of
the organization.
3.1. Assessing risk culture

Assessing the risk culture within an organization involves 3.2. Benefits of a strong risk culture
subjective and qualitative matrixes within the entire
enterprise risk framework. Risk culture persistently A strong risk culture ensures more effective risk
progresses through the stages of ERM maturity. Assessing management. It helps to mitigate exposures that may
risk culture involves the identification of prevailing have far-reaching consequences. In an organization where
conditions, behaviors, and practices within the organization staff risk awareness culture levels are high, there are low
that may directly or indirectly impact risk-related activities potential operational risk incidents and minimal fraudulent
arising in the future. occurrences, which also enhance productivity.
68 Tagoe

Furthermore, a strong risk culture improves risk-based activities. This raises the level of risk awareness within
decision-making throughout the organization. A critical the organization.
component of any risk governance framework is to ensure
that the information provided to the board and management
to make risk and business decisions is accurate. With 4. Conclusion
the right attitudes and values, management and staff
within the organization have a higher proclivity to make Risk management has evolved and has now become a critical
better decisions. role in the eyes of stakeholders, especially in the post-
Again, confidence levels of stakeholders, investors, and banking crisis and the COVID-19 pandemic. It has moved
regulators are improved when a strong risk culture exists from a regulator-compliance era to a proactive and essential
within the organization. The cultures that enhance the function within the financial services sector. The foundation
value for shareholders, regulators, and customers are those of a robust ERM framework is a strong risk culture to carry
effective for managing risks. Perceptions by stakeholders have out activities in order to achieve the set vision and strategies
an impact on organizational goodwill. Thus, a robust risk of the organization.
management within the organization attracts investments
and, to a larger extent, impacts the credit rating of
the organization. References
Lastly, compliance with regulatory requirements is
1. Rohit D, Webster FE. Organisational culture and marketing:
improved with a strong risk culture. The high levels of Defining the research agenda. J Mark. (1989). 53:3–15. doi:
regulatory scrutiny within the financial services sector 10.1177/002224298905300102
require organizations to have a resilient risk management 2. Wong CC, Rahim FA, Loo SC, Zainon N, Aziz NM. Conceptualising
system. The low tolerance of misconduct can be seen in the risk culture on enterprise risk management (ERM) implementation in
construction companies. Built Environ J. (2020) 17:58–69. doi: 10.24191/
stiffer sanctions meted out to some banks and capital market
bej.v17i1.5988
players in the banking sector and capital market clean-up. 3. Rossiter C. Risk culture–up close and personal. (Vol. 134). Toronto, ON:
Thus, a strong risk culture helps to avert actions that impair CA Magazine (2001). p. 45–46, 50.
corporate goodwill. 4. Anderson. (2006).
5. Douglas M. Risk and blame: Essays in cultural theory. London: Routledge
(1992).
3.3. Practical steps to successful risk 6. Corvellec H. The practice of risk management: Silence is not absence.
Risk Manag. (2009) 11:285–304. doi: 10.1057/rm.2009.12
culture 7. Drew SAW, Kendrick T. Risk management: The five pillars of
corporate governance. J Gen Manag. (2005) 31:19–36. doi: 10.1177/
The essential themes of effective risk culture in the eyes 030630700503100202
of some Chief Risk Officers and staff within the financial 8. Ashby S, Palermo T, Power M. Risk culture in financial organizations: An
services sector are tone from the top and tune from interim report. London: Centre for Analysis of Risk and Regulation and
the University of Plymouth (2012).
the middle; open and effective communication in a safe
9. Sinclair A. Approaches to organisational culture and ethics. J Bus Ethics.
environment; and awareness, understanding, and ownership
(1993) 12:63–73. doi: 10.1007/BF01845788
of risk at all levels (15). 10. Hindson A. Developing a risk culture, risk management professional.
As stated earlier, it is the Board of Directors that has (2010). p. 28–9.
oversight responsibility over the risk governance and culture 11. Douglas M, Wildavsky AB. Risk and Culture: An essay on the selection
of any organization. Thus, it is compelling for them to set the of technical and environmental dangers. Berkeley, CA: University of
desired risk culture tone from their level, and flowing from California Press (1982).
12. Goffee R, Jones G. The character of a corporation: How your company’s
that management also set the tone to be followed by staff culture can make or break your business. New York, NY: Harper Collins
within the organization. Culture curated by the overriding Business (1998).
influence of management is a signal of “managerialism” (16), 13. Spony G. The development of a work-value model assessing the
creating a dictatorship environment. cumulative impact of individual and cultural differences on managers’
It is critical to involve staff in setting and journeying work-value systems. Int J Hum Resour Manag. (2003) 14:658–79.
14. Institute of Risk Management. Risk culture–Resources for practitioners.
to the desired risk culture. An open and fair internal London: Institute of Risk Management (2012).
communication between management and staff is required 15. McGing S, Brown A. “Risk culture leadership, measurement and
to achieve a successful risk culture. These communications management–a comparison across industries,” in Presented to the
must happen in a safe environment devoid of acrimony. actuaries institute financial services forum 5-6 May 2014, Sydney. (2014).
Again, constantly training and educating staff on the desired Available online at: www.actuaries.asn.au (assessed October 9, 2021).
16. Parker RM. Against management: Organization in the age of
risk culture is necessary.
managerialism. Cambridge: Polity Press (2002).
Finally, it is essential for both management and staff 17. Deloitte. The way to risk culture. ZAO Deloitte & Touche CIS (2016).
to be sentient of emerging risks, identify, understand, and 18. Grant Thornton. Risk culture–building great organizations and growing
own those risks within their various day-to-day functional your foundation for success. London: Grant Thornton (2016).