Enterprise-wide risk management requires a shift in the behavior and mindset of employees across an organization. To realize the full benefits of improved systems, tools, and analytical skills, people need to learn new ways of perceiving situations, interpreting data, making decisions, influencing, and negotiating. This article explains ways in which targeted learning and development interventions can help banks evolve their culture to support their overall risk management strategy.
Banks want to better understand their current culture and engage in surveys that typically assess tangible products of the culture (e.g., risk appetite statements, mission statements, values, etc.). More than 85% of North American banks have engaged in this type of survey, and a similar number in Latin America have as well. In Europe and Asia-Pacific, 60% or more of banks have programs to assess internal risk culture.1 Assessing culture at this level, however, does not address the beliefs and behaviors that constitute the culture, which are harder to change. Banks need to go beyond the level of artifacts of the culture and assess motivation, skills, and attitudes.
When adopting a broad-based risk management transformation, banks also need a practical framework for evolving the culture. One of the most prominent writers on organizational culture, Edgar Schein, defines it as:
“A pattern of shared basic assumptions learned by a group as it solved its problems of external adaption and internal integration, which has worked well enough to be considered valid, and, therefore, to be taught to new members as the correct way to perceive, think, and feel in relation to those problems.”2
This definition can be applied to the way in which risk management perceptions can entrench themselves in organizations. In moving toward a more comprehensive and integrated risk management framework, organizations must overcome ingrained ways of working, beliefs, and attitudes. A process of “unfreezing” these behaviors must take place before it is possible to effect cultural change.
Individuals within an organization must unlearn existing habits before they can embed new ones. One of the reasons that implementing an integrated approach to risk management is difficult is that it challenges the definition of being a “professional” and the identity of belonging to certain groups within an organization.3 For example, establishing a belief that “risk is everyone’s responsibility” in an organization where there has traditionally been a strong divide between the control and commercial teams requires people to adapt to a new set of objectives that had not previously been a priority.
Without a climate of both real and perceived safety sufficient for people to open up and explore the barriers to change that exist at a personal or emotional level, the desired cultural evolution may not occur. For learning and development (L&D) and organizational development (OD) professionals in the financial services industry, this presents one of the greatest – but also exciting – challenges.
For most financial institutions, the logical place to start building a risk culture is with their policies and procedures. For example, they could review (or create) a risk appetite framework, set approval limits, establish their delegation authority, etc. During this phase, issues of poor quality data or the inability to aggregate and report on it efficiently are recognized, creating an urgent need to quickly upgrade systems.
Building the desired culture, however, requires further work that focuses on the competence and attitude of people and the leadership within an organization. Learning is central to this change. In a recent survey by the Institute of Risk Management, “Risk Competence” was ranked among the weakest aspects of risk culture in organizations.4
Training programs for new systems and policies are more straightforward than the training required for cultural shifts. Many banks recognize the need to upgrade the skills and knowledge of their people to match the sophistication of their new systems. There is a gap, however, between what people know should be done versus their motivation to spend time, energy, and money on it.
In a recent survey, 59% of respondents stated that improving their general knowledge of the industry would be the most helpful way of improving the resilience of their firm. Yet, of these same respondents, 66% stated that their priority learning objective for personal performance improvement was to increase their knowledge of issues directly relevant to their own role.5 There is a way forward if education about the wider industry is linked to career progression – 41% responded that improving their knowledge of issues concerning other functions within the firm, and 37% stated that improving their knowledge of the industry as a whole, is most important for their career development within the financial services industry.
Successful banks begin by understanding their existing culture and what elements of it must shift in order to accommodate the desired transformation. Culture can be examined at three levels: Artifacts, Espoused Values, and Underlying Assumptions (see Figure 1).
Applied to the risk management functions of a bank, the following are typical examples of these levels of culture:
- Risk policy, risk appetite framework, approval limits and processes, organizational structure, systems, templates/forms, physical layout, and geographic diversity
- Observable behavior of employees (e.g., communications, committee membership, meeting attendance, tenure, and attrition)
- Published statements of corporate values, corporate and departmental mission statements, departmental goals, competency frameworks, and performance and selection criteria
Revealed in day-to-day attitudes and choices expressed through situational behavior. For example:
- Overruling decisions according to risk policy
- Challenging business lines and senior decision makers
- Influencing and persuading decision makers outside of the formal approval process
- Promoting or retaining individuals whose behavior flouts corporate values, but whose technical capabilities or revenue-earning record are deemed to be of greater importance
- Standing by while colleagues flout rules (e.g., as reported in the Libor rate submissions investigation)
- Investing in technology to aggregate data, but not the skills to interpret the output
Cultural impediments to training on new policies can be seen even at the design stage of a training program. On one hand, an organization states that they need to improve credit skills. On the other hand, they are reluctant to have senior people take diagnostic tests or put them through training programs that appear too basic. The Underlying Assumption revealed in this type of comment is that it is more important to save face and defer to senior titleholders than to ensure that everyone has the requisite level of credit skills.
To change the culture, financial institutions need to develop meta-cognitive abilities – such as reflection, critical thinking, and conscious awareness of the thought process – which is different from the expert-learner paradigm dominant in technical training. They need to develop people who can recognize and address difficult, uncomfortable, or intangible issues arising during their daily work. Many investigations into bank failures and crises revealed individuals who had a strong sense that something was wrong. Yet, despite their personal efforts to highlight the warning signs and the power of the control functions they represented, they were unable to prevent the unfolding crisis. One of the most common needs expressed by our banking clients is to strengthen the way their people “challenge the business.”
Training that is implemented in support of evolving a risk culture must be integrated and designed to give people the awareness and ability to acknowledge, act, and discuss the “un-discussables.” When a critical mass of people have developed this, new norms emerge.
A secondary objective for many banks is to enable people to communicate and share the desired culture with colleagues. This does not mean being able to reel off a statement or a set of values. Communicating the culture is about everything people do and say that aligns or undermines the culture banks are trying to create.
This is where the assumptions underpinning the culture, versus personal assumptions, come into play. For example, this could include what people pay attention to, what questions they ask, what stories they tell/repeat, and what emotions are attached to those stories (e.g., admiration, disbelief, anger, disappointment, etc.). Storytelling can be a powerful means to reveal these assumptions and challenge them.
L&D and OD play an important role in moving the organization toward integrated risk management. They can help implement new learning methodologies and training designs and align the other parts of the organizational system – such as performance management, reward, selection, and talent management – with the desired culture.
For risk culture transformation to be effective, the following must all be considered when implementing training interventions:
- Understand the bank’s desired culture.
- Diagnose the existing culture and identify issues requiring change, using a tool such as Credit Pulse that measures motivation and ability.
- Develop a transformation plan that takes \account of the values, mindset, and behaviors required, in addition to the Artifacts and Espoused Values.
Design targeted interventions that:
- Break traditional learning silos.
- Combine knowledge of risk taxonomy with an understanding of cognitive and social influences on decision-making.
- Ensure that employees are trained to interpret and use the output from new risk measurement technology, as well as in the system itself.
- Build abilities, such as reflection, critical thinking, and conscious awareness of the thought process.
- Enable credit officers and client relationship managers to attend training together and support managers to reduce the cultural antagonism created by using “them” and “us” language.
- Develop people who recognize and address difficult, uncomfortable, or intangible issues arising during their daily work and foster the willingness and ability to challenge others in the business.
- Enable change by involving people at all levels. For example, senior managers should attend training programs that their staff attends to improve communication and (peer) interaction and show leadership by agreeing to take the same diagnostic tests as their staff to establish existing competencies.
- Evaluate progress – both quantitatively (e.g., through metrics and surveys) and qualitatively (e.g., through focus groups).