Risk Culture is the set of shared attitudes, values, goals and practices that are followed within an organization

towards the area of risk management. Embedding Risk culture into the DNA of the Institution is being seen as a priority today, because it can have a potent effect on the Institutions well being and success.

Integrating Risk into enterprise culture

Historically risk management has been seen as a specialized function which is handled by the risk management department of the Institution but recent financial crisis has unearthed several key elements. Risk takers or business units did not have a clue of the risks involved in their activities; they did not know the impact of a bad decision or investment. After the crisis, many institutions including regulators realized the consequences of inadequate risk management practices. They realized theoretical models are far away from the reality or market behavior. They realized that a risk management framework for only compliant purposes is not enough to sustain the shocks and aftershocks of the market. They realized the systemic risk - contagion can affect many other industries which are not involved directly or indirectly in contribution of risks. They realized the need for risk management framework to be ingrained in each activity of the bank through risk management trainings or by creating a risk culture amongst the business units or risk takers. Enterprise Risk Management (ERM) has seen a paradigm shift. Today, everybody in an organization is being seen as a contributor to the risk of the enterprise. Every department / Business line is expected to initiate the discussions about the risks they carry and the measures that the organization should take to mitigate these risks. A successful risk culture in letter and spirit would allow individual business lines to have flexibility and sufficient degree of autonomy in assessing their risks but at the same time they should be able to communicate their ideas and collaborate with the entire organization by using common language of risk.

Interaction and Teamwork

Inspirational Leadership

Environment encouraging everybody to wear a Risk Managers hat

Obstacles in the path of creating a Risk Culture

In a dynamic business environment every organization is under immense pressure to compete, survive and create value for all its stakeholders. These short term economic pressures make the managers forget about the need for creating a strong risk culture within the Organization. The system of values behaviors and risks an Organization is willing to take has to be communicated by the top management and the Board to all the stakeholders. Periodic surveys should be conducted so that the management can gauge the effectiveness of its communication about risk. Lack of formal meaningful training for the leadership and the employees in the area of risk management can become a major obstacle in creating risk culture. The commitment from top management and inspirational leadership is a key for creating the right kind of culture. The top management can only provide oversight. It is the junior and middle level management that has to implement the decisions on the ground. Hence the design of compensation, rewards and benefits should also be in line with the risk appetite of the Bank. In most Organizations the major cause for lack of risk culture is the inappropriate design of risk-reward system for the employees. Weak Risk-communication system, risk procedures and risk Governance can hamper the knowledge sharing and Organizational Learning process. To create an Intelligent and responsive Organization which can survive in a harsh business environment having a strong Risk Communication system is of paramount importance.

Creating a Risk Awareness Atmosphere

Risk atmosphere- creating risk aware culture should start at the individual employee level. The first step starts at the stage when an employee is inducted into the organization. For example Whistleblower policy is one of the key policies used to alert the management about possible frauds and malpractices which can lead to reputational and financial risks to the Institution. The new employees could be told about the occasions when the whistleblower policy had been effective in taking corrective actions. This will create awareness about possible risks and ways of reporting them. It is very important for every Organization to have a culture where it is acceptable to report emerging risks promptly. Such a proactive culture would help the Organization learn about the unexpected issues, threats and opportunities that are happening and take an appropriate response. In financial Institutions lending to various categories of customers is a core activity. These Institutions based on their Risk appetite could communicate that they would have zero tolerance for any preferential treatment/ exceptions to customers who fall below a particular level of creditworthiness. Awareness can be created and sustained among employees by effectively putting policies, conducting organization-wide training programs, communicating the importance through both monetary and nonmonetary awards for the employees. Any aspect of the Risk culture should start from the top hierarchy. The board should set the right tone and express their complete support for compliance to various aspects of risk management. Various levels of management and different parts of Organization can have very different perceptions about

risks. It is important for the Organization to assimilate these various ideas and create a big picture that can be understood by everybody in the Organization irrespective of their hierarchy. This would help the Organization create a common goal, purpose and a vision for the Organization. Appropriate forums and channels should be created for all employees to express their view about risk management without getting involved in the hierarchies of the Organization. It is only through these discussions the Institution can expect to unearth the long-standing cultural weaknesses in the Organization. If these weaknesses are not identified and corrective steps not taken then these risks will take root and grow within the Organization. When an external or internal trigger event happens, then Organizational failure can happen because of these risks. The scandals and fraud that had been committed by traders in prestigious banks is also a result of the weaknesses in the Risk culture of these Institutions.

Formal and Continuous training for all levels of employees Long Term Focus

Strong Risk Communication and Risk Governance

Creating a consistent behavior and attitude towards risk management within organization has become an area of key focus to organizations because they are learning that it is the only way for them to survive, grow and create competitive advantage in the long-term.