How to create a good risk culture
In all sectors – the public, private and third – it has become apparent that culture is an essential force in driving the fortunes of entities.
In July the Financial Reporting Council (FRC) published a report ‘Corporate Culture and the Role of Boards’. The report emphasises the importance of appropriate culture in driving value for commercial companies. This is equally important to charities and not-for-profit organisations, where social value is being created.
What do we mean by culture?
In this context, we mean the combination of attitudes and behaviour that is visible and characterises the “way we do things around here”. One of the challenges for third sector organisations is that people join their organisation because they have a strong belief and commitment. That sounds like that should always be a good thing, and mostly it is, but it can go awry when the individual has a set of firmly-held beliefs that are slightly at odds with the organisation’s values.
What does a good risk culture look like?
An effective risk culture is one that enables and rewards individuals and groups for taking appropriate risk.
It should have:
- Values and ethical principles that support appropriate risk-taking
- A clear and consistent tone from the top. The board and senior managers need to live the values and lead by example
- Plans and budgets that are aligned with the values. For example, you are unlikely to get the right behaviour if you agree an ethical code of fundraising but then communicate messages about the fundraising target being the priority
- A willingness to hear bad news
- Organisations should convey to all staff and volunteers that there is a willingness to learn from mistakes
- Whistleblowing should be easy, with a clear policy and procedures so all staff and volunteers know when it is appropriate to use whistleblowing and how to do it
- Having swift and fair disciplinary procedures to deal with poor behaviour, bad service, theft, breach of the organisation’s rules and abuse will convey a strong message to staff
- The right behaviours will be rewarded, for example, with special mentions in newsletters
- There will be appropriate attitudes among all staff and volunteers as reflected through staff surveys and behaviour to make sure that the values and ethical behaviour is reinforced
- There should be a diversity of views among board members and staff to ensure that inappropriate risk attitudes or behaviour are challenged
Culture in an organisation is both the result of the behaviours and attitudes of the people in the organisation and the influence on those people. It can easily become a self-reinforcing cycle, which may be a virtuous circle or a vicious circle. Much of culture is intangible and therefore has to be handled carefully.
Changing the risk culture of an organisation
First, the board needs to understand the current risk culture of the organisation, then decide what they want it to be. They can then focus on moving from where the organisation is to where they want it to be.
Gerry Johnson wrote about the ‘cultural web’ which is a combination of six components, some of which are visible and come elements are less obvious.
- Stories - the past events and people talked about inside and outside the organisation
- Symbols - the visual representation such as logos, styling of offices and dress code
- Power structures - the pockets of real power. This may be one or two key senior executives, a whole group of
- executives, or even a department
- Organisational structures - this includes both the structure defined by the organisation chart and the
- unwritten lines of power and influence
- Control systems - the ways that the organisation is controlled. These include policies, financial systems, quality
- systems and rewards
- Rituals and routines - the daily behaviour and actions of people that signal what is expected to happen in given
Stories are incredibly important, and you only have to listen to the talk when you first start work in a new organisation to get a feel for who the heroes are, what actually gets rewarded or noticed, who really holds the power and what the appropriate behaviours are.
The board and senior management team can work with some of the tools set out above.
It is particularly important to relate stories to positively position the behaviour you want, create the rituals you want and base them on policies and procedures that form a consistent whole.