Constructive Behaviours Enable Effective Risk Management

Organisational cultures can either enable or inhibit effective risk management through either constructive or defensive behavioural norms respectively.

When there is constructive organisational culture, people want to, rather than have to, manage risks and do good risk management. And when there is a defensive organisational culture, people avoid doing good risk management and only do risk management when they have to or are being forced, either by management or regulators, merely as a tick-the-box compliance exercise.

An organisational culture that enables effective risk management is built on some of these constructive behavioural norms:

Being clear about what’s expected and have clear examples of what they should be aiming for.
Being clear realistic and challenging goals and objectives.
Communication is comprehensive and regular.
Communication is transparent, clear and an environment of honesty.
Solving problems effectively.
Strive for performance and customer excellence.
Enjoyment from work.
Produce high-quality products and services.
Continuously learn, grow, and take on new and interesting work.
Supportive of each other.
Encourage others to learn, grow and perform their best at work.
Help others think and decide for themselves.
Being constructive and open to influence in dealing with others.
Build strong relationships.
Being friendly, approachable, trustworthy, and collaborative.
Planning and thinking ahead are emphasised as are exploring options and opportunities.
Encouraged to take moderate or calculated risks where it is well researched and thought out and serves the outcomes sought.
Problem-solving involves all stakeholders so that issues can be anticipated, and contingencies provided.
Calling out potential problems and barriers is encouraged so that mistakes are not covered up.
Proactive prevention is a core strategy.
Focus on continuous improvement. Forward-thinking, planning, exploring alternatives.
Always challenging existing assumptions and forecasts – internally and externally.
Aware of the cognitive bias to accept information that confirms.
Communicates all aspects of risk-balanced and ethical decision-making regularly and relentlessly.
Continually refines all risk management processes.
Avoids leadership ‘kow-tow’ and sloppy group think.
Encourages risk-taking, knowing that sometimes it will go wrong and may cost money.
Has a continuous learning attitude.

Organisations with constructive behavioural norms can experience a situation where risk is being managed more proactively, especially through informal risk management mechanisms.

Collaborative ‘risk culture’

Constructive behavioural norms tend to lead to the creation of a collaborative ‘risk culture’. It focuses on participation, interaction, social networks, and teamwork in identifying and managing risks. This type of ‘risk culture’ values the sharing of risk information and collaborating on tasks, especially risk management activities.

Risks, issues and near misses are openly discussed among members of the organisation. Meetings about risk and performance are participative, supportive, and interactive.

A collaborative ‘risk culture’ that is built on constructive behavioural norms can only propel the organisation to take calculated or controlled risk-taking or make changes that have a lower risk of failure.

Defensive behaviours inhibit effective risk management

An organisational culture that can inhibit effective risk management is built on some of these defensive behavioural norms:

Accountabilities and ownership are blurred, ambiguous or applied inconsistently.
Communication is filtered and sketchy.
Ad-hoc information is provided.
Avoid conflict and keep relationships superficially pleasant.
Be liked by others.
Gain approval and support before deciding and acting.
Follow rules, conform and don’t ‘rock the boat’.
Make a good impression.
Lack of initiative and slow action on issues that are identified.
Covering up mistakes so as not to experience negative consequences through being blamed.
Follow policies and procedures.
Make popular rather than necessary decisions.
Please those in positions of authority.
Ask everyone what they think before acting.
Avoid blame and shift responsibilities to others.
Push decisions upwards.
Take fewer chances.
Lay low when things get tough.
Gain influence by being critical and opposing the ideas of others.
Find fault and focus on why ideas won’t work.
Take charge and be controlling.
Act forceful and tough.
Play politics to gain influence.
Compete rather than cooperate.
Turn the job into a contest and out-perform peers.
Avoid all mistakes.
Work long hard hours.
Do things perfectly, potentially missing deadlines.
Making snap decisions without considering alternative solutions or all the facts before thinking through.
Being set in thinking and not open to others’ influence.
Being critical and wanting to maintain superiority (point scoring).
Over-working a problem rather than dealing with it.
Reactive damage control is a core strategy.
Focus on short-term results.
Trading off longer-term needs in favour of being seen to comply in the moment.
“Getting through” the moment.

Organisations with defensive behavioural norms can experience a situation where risk is being managed more reactively from a compliance perspective, especially through formal risk management mechanisms.

Controlling ‘risk culture’

Defensive behavioural norms tend to lead to the creation of a controlling ‘risk culture’. It encompasses the attributes of formality, conformity, and dependability. This type of ‘risk culture’ may encourage members to make decisions that support safe courses of action. Information may not be shared quickly or easily.

This outcome may result in organisational members behaving in ways that conform to accountability and consistency while depriving them of decision-making opportunities. They are expected to follow defined processes and rules rather than use their judgement in decision-making. This may hinder responsible risk-taking or trying innovative approaches to managing risk, resulting in a culture of risk aversion, and possibly blaming others if it does not go to plan.

Many organisations use risk management as a box-ticking compliance exercise to develop a controlling ‘risk culture’. Characteristics of the controlling environment may help protect organisations from making reckless, excessively risky decisions, and enable them to develop coordination and stability.

Risk-averse culture

A controlling ‘risk culture’ that is built on defensive behavioural norms can only propel the organisation into risk aversion.

The signs of a risk-averse ‘risk culture’ include:

Employees hear more “No” than “Yes” to their ideas.
Employees make suggestions and receive no feedback.
Employees submit ideas but see no implementation or action.
Employees show signs of disengagement.
Managers do not deliver, or when leadership lags or refuses to implement new strategies or concepts.
Little or no cross-functional collaboration with each team working in silos.

Key differences between controlling and collaborative risk culture

The key differences between collaborative and controlling ‘risk cultures’ are shown in the table below. (Modified from Park, 2019)

	Collaborative	Controlling
Outlook	Holistic/strategic; outward-looking; success-driven	Into the details; inward-looking; compliance-focused
Dominant Characteristics	Sharing risk and performance information. There are participative, interactive risk management practices that avoid blame and focus on improvement opportunities.	Governed by formal rule-oriented risk management practices with limited risk-taking and opportunity-seeking. Emphasises the production of auditable or documentary evidence.
Leadership	Guidance, mentoring, facilitation, and support.	Coordinating, organising, and smooth-running efficiency.
Risk-taking posture	What is the board comfortable with. Risk conversations and open interactions can result in the debate of different views and seeking better risk strategies, risk-taking, and opportunity-seeking. Risk is appropriately identified, assessed, communicated, and managed across all levels of the organisation.	Likely to measure exposure in relation to risk appetite. Risk aversion, avoiding responsible risk-taking and reputation management have led people to believe that risk management meant avoiding or transferring risk to other parties, rather than managing the substance of risk.
Management of Employees	Risk management through teamwork, participation, networking, and interaction.	Risk management through the security of employment, conformity to rules and policies, predictability, and stability in relationships.
Organisational Glue	Risk management by loyalty, mutual trust and respect, openness, and participation.	Risk management by formal rules and policies.
Strategic Emphases	Risk management focuses on organisational members’ skills and knowledge in managing risks. Risk is integrated with a ‘bigger’ discussion.	Risk management focuses on permanence and stability in operations. Risk is informed through a granular bottom-up reporting process.
Risk in Meetings	Less likely that risk is a formal agenda item.	Risk is a formal agenda item.
Criteria of Success	Risk management is considered successful based on the development of human resources, teamwork, employee commitments and concerns for people. The focus is on decision-making and problem-solving, especially in collaborative environments (i.e., risk management for decision-making).	Risk management is considered successful based on efficiency and dependable delivery in performing one’s tasks. Focus on compliance and follow the rules (i.e., risk management for compliance).
Organisational Design	Cross-functional collaboration; communication heavy; mission-driven; responsive/proactive approach; focus on all stakeholders, especially customers; rewards for results; customer and employee experience; human-centred	Focus on spans and layers or sticks and boxes; siloed, functional orientation; rigid job structure; focus on shareholders; reactive approach

Beware of complacency, reactivity and ‘good intent’

Boards may exhibit a high level of trust and confidence based on a collective belief that the organisation is ‘well run’ and ranking well on financial measures. This can also contribute to a level of complacency, reactive behaviours, overconfidence, and a ‘dulling of the senses’ within boards to signals that might have otherwise alerted them to a deterioration in the risk profile, and a movement outside of the risk appetite.

High levels of trust, ‘good intent’, and ‘over consulting’ can create a lack of intellectual curiosity and critical thinking about the ‘bigger picture’ and the full depth of risks.

Trust must be continuously validated through strong metrics together with healthy challenges and oversight. ‘Good intent’ must not be readily used to excuse poor risk outcomes.

References

Park, Y.J. (2019) ‘Risk Culture and Risk Management in the Australian Public Sector’, The Australian National University (Australia), ProQuest Dissertations Publishing 28758924.