Risk and culture pervade all aspects of an organisation’s operations and strategy and the panel of experts on Transpire Global’s Risk Faculty webinar (which I was a member of) explored the key connections and crossovers between risk and culture which are too often kept in silos. The panel considered a range of issues including regulatory developments relating to culture, creating a physiologically safe work environment and the people and culture dimensions to cyber and technological risk.
The regulatory risk backdrop
The Financial Reporting Council (FRC) is a cross-sector organisation which is the custodian for several important governance codes (covering listed companies, private companies & investor stewardship). While it has no specific remit for culture, the FRC recognised the importance of culture in support of ‘purpose’ and stakeholder outcomes, so it created the Culture Coalition (with four workstreams and support repositories) to coordinate a very wide pool of views and assistance.
For financial services, the Financial Conduct Authority (FCA) has a much more focused ‘conduct’ remit, with a current focus on consumer duty and vulnerable customers, with a long-term interest in a firm’s complaint management practices as a practical indicator of culture.
It’s not all about technology
Behaviours, culture and people risk underpin our maturity and capabilities within cyber, data and IT risk management. Cyber, for example, requires a focus on the resilience of delivery of purpose and service, and is usually considered to be a constantly-evolving ‘top 10’ operational risk.
Growth firms typically employ technologists as more than 50% of their resources. The team’s motivation is to use agile techniques with a focus on continuous improvement, being exemplary in usability and testing, all whilst considering users’ vulnerabilities and to ‘care’ about them – employing professionalism through a real interest in the role and not just pay rates. As technology skills are scarce, employers can emphasise these added-value factors to achieve better staff loyalty and motivation.
Creating the right culture
There is an importance to purpose and values – as well as inclusion – in creating a psychologically safe environment to enhance an organisation’s performance. Dr Roger Miles has done some excellent work here; his recent book, Culture Audit in Financial Services (relevant beyond financial services) is compendium of culture tools and case studies – developed with UK Finance (and with the interest of the FCA, of course).
Being authentic
Prof Roger Steare’s research also proves that while individuals and small business owners may be authentic in their personal application of culture and ethics, on arrival at work for a big firm, an employee may ‘change hats’ and be coerced to do bad things by formal processes or scripts. Alison Bond emphasises the need to focus on measuring outcomes (not just processes) and creating an authentic alignment to purpose. In essence, it is necessary to think carefully about how culture builds into outcomes.
Your role as a non-executive
Your role as a non-executive is to own ‘accountability’ and to pro-actively join up oversight and assurance, supporting (but not over-policing) those in the front line carrying the targets and resources. You will need to rely on ‘sources of assurance’ including internal audit and others within or beyond your own organisation (and through the value chain) to be confident in the positive effect of culture on delivering your commitments.
Takeaways
Is there is a two-point takeaway that will keep your culture efforts tight?
Firstly, focus on your purpose and whether you are delivering, and being accountable, for that: too many organisations in both the private and public sectors are failing those that rely on them for an essential service – which effectively is their reason for being.
Secondly, ensure you are ready and resilient, especially if you provide an essential or infrastructure service to your stakeholders. Don’t let them down!
Bryan Foss is an experienced non-executive director, CISI Risk Forum Committee member, Co-Founder of the Risk Coalition, Co-Chair of Transpire Global’s Risk Faculty, Senior Advisor with the FRC and a helper to others on governance matters.
Transpire Global, in conjunction with the Chartered Institute for Securities & Investment and the Risk Coalition, held an online discussion panel on “Effective risk oversight: why culture matters” on 20 June 2022. In addition to Bryan Foss, panelists included Alex Walker and Bob Barclay. The discussion was chaired by Hanif Barma.
The Risk Coalition’s Raising the Bar guidance and GABI self-assessment and benchmarking tool for Board Risk Committee Chairs, CROs and Risk Functions includes guidance and improvement ideas for risk culture-related oversight activities.