IRM ERM M1U5.1 Risk Culture

Question 1

IRM Risk Culture definition

Answer 1

The IRM (2012) , in their thought leadership paper ‘Risk Culture: Under the microscope guidance for boards,’ has defined risk culture

as the ‘values, beliefs, knowledge and understanding about risk share by a group of people with a common purpose, in particular the employees of an organisation or of teams or groups within an organisation.’

Question 2

Actions to improve risk culture

Answer 2

Good communication of the organisation’s expectations of all staff – this could be through policies, presentations, staff newsletters, induction processes, written documents, posters and job descriptions.

Convincing employees that they will personally benefit from good risk management practices.

Involvement in the risk identification process to achieve greater buy in.

Training programmes that instil the right practices and knowledge.

Investment in the use of effective IT security tools and active and transparent monitoring of IT usage that is made clear to all employees.

Question 3

Characteristics of Strong Risk Culture Deloitte (2021)

Answer 3

Deloitte (2021), in their paper on ‘Enabling risk intelligent cultures’ note that a

strong risk culture is where people are enabled to, and consistently do, the right thing, the right way

in a rapidly changing, complex and interconnected world. This type of culture supports management in deciding what can be done, while making tough trade-off decisions and balancing the positive and negative impacts of those choices.

Question 4

Examples of Strong Risk Culture / Risk Doctor

Answer 4

Recognition of value of risk

Training people to be risk aware and risk competent

Positive risk culture allows individuals and teams to appropriately embed risk management within an organisation, to encourage people to see the value in risk management with an understanding and appreciation of the positive effect it can have.

Question 5

Different risk culture perspectives

Answer 5

Retail banks emphasize customer care and service training to retain business.

Compliance with regulations is vital for banks and other organizations.

Maintaining a ‘compliant culture’ is as crucial as risk management.

Healthcare services focus on stress-free patient experiences to enhance treatment success and foster loyalty.

In industries like airlines, manufacturing, mining, and hotels, safety culture is paramount.

Leadership support and staff training are crucial for ensuring safe working practices.

Question 6

Negative culture example The Barclays Bank LIBOR scandal

Answer 6

The Barclays Bank LIBOR scandal

Question 7

Control of risk cultures

Answer 7

For example, is risk management discussed as a value adding process that can help an organisation achieve and / or improve on its objectives, or is it seen as a tick box exercise that is compliance led.

Question 8

Reason for updating COSO ERM Framework in 2017

Answer 8

The COSO ERM Framework was updated in 2017 in part to recognise that having a best-in-class ERM approach does not add value where a positive risk culture does not support it

Question 9

What does a good risk
culture look like? IRM Study

Answer 9

Clear leadership commitment:

Ethical principles at the core:

Continuous risk management:

Transparent communication:

Encouragement of reporting and learning:

Understanding of risks:

Encouragement of appropriate risk-taking: Positive risk-taking behaviors should be recognized and promoted, while inappropriate behaviors should be addressed.

Valuing risk management skills: Risk management expertise should be valued and supported, with adequate resources and professional development opportunities provided.

Diversity of perspectives:

Alignment with employee engagement:

Question 10

IRM Culture A-B-C
approach

Answer 10

• The Culture of a group arises from the
  repeated Behaviour of its members
• The Behaviour of the group and its
  constituent individuals is shaped by
  their underlying Attitudes
• Both Behaviour and Attitudes are influenced
  by the prevailing Culture of the group

Question 11

Risk attitude vs Risk behaviour vs Risk culture

Answer 11

• Risk attitude is the chosen position
  adopted by an individual or group towards
  risk, influenced by risk perception and
  pre-disposition
• Risk behaviour comprises external
  observable risk-related actions, including
  risk-based decision-making, risk processes,
  risk communications etc.
• Risk culture is the values, beliefs,
  knowledge and understanding about
  risk, shared by a group of people with a
  common intended purpose, in particular
  the leadership and employees of an
  organisation.