What's Your Company's Risk Culture?

(page 3 of 3)

Organizations with a strong risk culture have a consistent and repeatable approach to risk when making key business decisions, including a discussion of risk and a review of risk scenarios that can help management, and ultimately Board members, understand the inter-relationship and impacts of risks. A discussion of risk in the formal decision-making process can help executives feel comfortable with the decisions they make, allowing them to pursue the interests of the company more assertively.

When considering decision-making, there should also be an examination of the sphere of control that managers and employees have with their decisions. Sometimes unknowingly to leadership, mid-level managers may have decision-making authority that potentially puts millions or billions of the company's money at risk.

• How does your risk culture extend beyond your organization?

While it may not be reasonable to expect outside service providers to have the same risk culture as your organization, a company may set service levels and metrics to ensure that providers manage risks within your company's guidelines.

Companies need to put in place oversight of strategic partners, vendors and service providers to ensure that those support organizations are meeting their own risk standards. A company should share its risk management guiding principles with third-party suppliers or partners to influence their decision-making process. Risks and controls should be a consideration when choosing new partners, and they should be re-evaluated on a regular basis to help avoid the potential of vicarious liability by the poor decisions of an alliance partner.

• Does the organization consider risk in the hiring process?

In some ways, creating the right risk culture starts during the interview process. Organizations that have thorough hiring processes can sense whether prospective employees will fit into the company's risk culture during the interview stage. It can be challenging to change a conflicting risk mindset, rather than starting with employees who share similar values and ethics.

Risk Culture Taking Shape
The questions above only scratch the surface of risk culture. As management and Boards sharpen their focus on this emerging area of enterprise risk management, more answers—and more questions—will arise as to how companies can most effectively change behavior and influence risk behavior enterprise-wide.

Having a strong risk culture means that employees know what the company stands for, the boundaries within which they can operate, and that they can discuss and debate openly which risks should be taken in order to achieve the company's long-term strategic goals.

A strong risk culture can be built over time, but it also has to be inspired. Management's actions as well as consistent, ongoing communication around ethics and risk management become the first steps to instilling such a culture because it will demonstrate that inappropriate behavior will not be tolerated. Board members can help instill such a culture by asking the right questions and providing an outside perspective on what is/is not working. Once leadership starts on the right path—and stays on it—the organization will slowly but surely follow.

This article represents the views of the authors only, and does not necessarily represent the views or professional advice of KPMG LLP.

Provided by Directorship—The Leading Publication for Boardroom Intelligence

Business Exchange

Track and share business topics across the Web.