Risk Culture Flashcards
What is the definition of risk culture?
Reflection of the overall attitude of every component of management within a company. It describes the value, beliefs, knowledge and understanding about risk shared by a group of people with a common purpose.The culture of an organisation determines how individuals will behave in particular circumstances. It will define how an individual feels obliged to behave in all circumstances.
What are the signs of a good risk culture?
- Individual and group values and attitudes and patterns of behaviour lead to a commitment to the risk management objectives of the organisation.
- Communication founded on mutual trust and shared perception of the importance of risk management.
- Sharing confidence in selected control measures and a commitment to adhering to the establish risk control procedures.
How can you achieve a good risk culture?
LILAC - Leadership, Involvement, Learning, Accountability, Communication
How can you measure the risk culture of a firm?
- Audit Committee can ask various departments how seriously they take risk management.
- Audit Committee can seek to evaluate the level of risk assurance that available.
- Risk maturity levels - 4Ns, McKinsey model, RIMS model, FOIL
- Quality of risk management policy and risk guidelines or protocols.
- The internal context/environment
- Balanced scorecard to clarify company vision, strategy and actions.
How can a good risk culture be embedded in a firm?
- Alignment of risk management activities to existing core process in order to achieve efficient and effective core processes.
- Risk management to be aligned to existing management procedures and activities.
- Internal audit activities aligned with the culture and context of the organisation. An organisation that is less mature might see increased internal audit activity.
How can you establish a good corporate culture in FS firms?
- Define values and communication those values.
- Timely reporting of problems and prohibition of corruption and bribery externally and internally.
- Clear policies that reinforce the values set.
Why is a good risk culture important to the PRA?
A good risk culture can help meet the PRA Threshold Conditions and PRA Fundamental Rules.
What are the PRA’s expectation for a firm and how it approaches risk culture?
- All individuals in the firm has responsibility for acting in a manner consistent with the safety and soundness of the firm.
- Remuneration and incentive schemes reward careful and prudent management.
- Firms and individuals should deal with the PRA in an open and cooperative manner as set out in the Fundamental Rules.
- Board to take responsibility for establishing, embedding and maintaining a firm’s culture.
How does the PRA detect serious failings in risk culture?
- Supervision and contact with firms.
- Reviewing the prudence of valuation methods.
- Regular assessment of the independence and professionalism of control functions.
- Reviewing the effectiveness of the board.
- Reviewing incentive and remuneration policies and arrangements.
What are the indicators of a poor risk culture?
- Multiple failings of business to conduct their business in a safe and sound manner.
- Evidence of poorly functioning boards that fail to challenge executives on decision and incentives; set up suitable policies and embedding a sound risk culture.
- Weak control areas that are poorly resourced and with little representation at the board level.
- Weaknesses in board or senior management behaviour and influence on firm culture, incentives and adherence to the firm’s culture.
What tools does the PRA have at its disposal to address a poor risk culture?
- Increased firm supervision.
- Message each board member outlining key concerns and what the firm should do to improve the risk culture.
- Vary Part 4A permissions.
- Impose restrictions on the firm.
- S166 Skilled Persons Review
- Section 55J - own initiative variation of permission with the voluntary agreement of the firm.
How can you evaluate organisational behaviour and risk culture?
- Does leadership set the tone and walk the talk?
- How does the organisation respond to bad new - is there a culture of blame?
- Is risk governance well articulated?
- Is risk transparency evident?
