Culture Matters: Strong Performance Depends on Getting Risk and Work Cultures Right

Larry Senn, who founded the culture-shaping organization Senn Delaney in 1978 and is considered by some to be the “father of corporate culture,” was once quoted as saying, “All organizations have a culture. The only question is do you shape it or does it shape you?” A robust risk culture at a financial institution is critical to ensuring the organization operates in a safe, sound, and ethical manner. At the same time, it helps an organization stay aligned with its objectives, values, and principles— and deliver value to stakeholders including customers, employees, investors, and regulators.

The bottom line? The right culture will drive the right behavior, which is going to drive the right performance for the organization.

According to organizational psychologist Thomas Diamante, speaking at a recent RMA New York webinar on the topic, risk culture “reflects the extent to which your business strategy focuses on preventing bad or unwanted events from occurring, and the extent to which it embraces or encourages desirable actions or healthy risk.”

Diamante added that risk culture reflects a host of other, sometimes unexpected or intangible factors: social norms; unconscious, unproductive bias; unwise risky group decision-making; and incongruities between what management rewards (incentives) and what management conveys (expectations). Not surprisingly, risk culture and work culture are inter-twined— after all, an unhealthy work culture can pose an undeniable risk to the organization.

“Informally, risk culture is what gets you by,” Diamante said. “How do I create a career in this organization? Who do I need to work with to get noticed? What risk is good risk and what is bad? What topics can be discussed? What topics must I avoid at all costs? What metrics truly matter?”

On one hand, he said, an organization is trying to avoid undesirable outcomes. But on the other hand, organizations need to be “adaptive and curious. Employees must ask ‘why and why not’ if they want to remain relevant. ‘Don’t ask’ cultures are a fast track to obsolescence.”

“You want a flexible, learning, creative, open, and healthy organization. That requires people to share, to express opinions, to discuss,” Diamante said. “There has to be expression internally so there’s learning going on all the time.”

The consequences of a nonexistent or ineffective risk culture are real and can erode a company’s capital, reputation, and trust, panelists agreed.

Truly successful risk culture comes from the top down, said Richard Vestuto, managing director of Data Insight and Forensics for Kroll. Vestuto said the board of directors, senior executives, and risk managers all play critical roles in shaping the risk culture of an organization. It’s necessary that they articulate the company’s risk appetite, establish clear risk policies and procedures, promote open communication and feedback, and hold individuals accountable for their risk-related decisions and actions. “CEOs can’t see everything, but they better be driving that down through the organization,” Vestuto said.

That can be especially important regarding newer hires, who, depending on the size and complexity of the organization, can “change the game in terms of what type of personality and behavior they bring into the equation,” said Shahryar Shaghaghi, a technology, risk management, and cybersecurity executive at CyTech Partners, and a faculty member of the Enterprise Risk Management program at Columbia University. The onboarding process is key, he said, because it’s a new employee’s “first impression” of the company.

By encouraging a strong risk culture, leaders can create a sense of purpose, integrity, and excellence to inspire and motivate employees to do the right thing, even in challenging situations. Employees need to feel as though there’s a level of trust that “if they raise a concern and they self-identify something they won’t automatically be tasked with getting it fixed,” said Deborah Hvratin, CRO for CLS Group. You also don’t want them to feel as though “they’ll come under scrutiny for making that judgment,” she said. “At CLS we promote good self-identification as one of our key metrics that we track against risk culture.”

Encouraging the concept of “doing the right thing because you believe in it is another key,” Shaghaghi said.

Hrvatin said she has found that good strategy is what drives good decision making. She described a scenario involving a company considering migrating its platforms to the cloud. It’s imperative to do the proper risk assessment on such strategic decisions, she said.

“You need to understand what your risk appetite is for moving to the cloud and assess it appropriately,” she said. “And that all gets embedded in culture. Risk culture sits across all of the dimensions of how we look at operational risk or compliance or technology, in design and delivery of data. The expectation is that people operate within those behaviors and norms as we deliver strategies.”

Developing and sustaining an effective risk culture is difficult enough when your workforce is engaged in the organization’s future. But the advent of “quiet quitting”—the recent trend of employees doing only the bare minimum to survive—has added another layer of complexity to the effort. How do you instill that necessary sense of accountability and purpose in a worker whose top priority is just making it to the end of the day?

During a recent RMA Risk Readiness webcast, Priya Dixit Vyas, a partner at Heidrick & Struggles with a focus on culture shaping, said research has shown that culture is an important predictor of a company’s trajectory. “Almost 51% of people will tell you that their organization’s culture needs to change, needs to evolve where they feel included, where they feel engaged,” she said.

For starters, culture must be aligned with strategy. “Every employee wants to know what they’re contributing,” Dixit Vyas said. “What’s the big purpose? What is it that you’re trying to deliver as an organization? What’s the impact you make, the greater good? There is a clarity around strategy—people understandit in the simplest way possible.”

Diversity and inclusion are among the keys to developing the right culture because they foster collaboration, which in turn drives better decision making. “The foundation of all of it is, is there psychological safety? Do people feel safe? If they can speak up, they can collaborate, they can innovate. And if you have some of these ingredients in your culture, you’re onto a winning formula,” Dixit Vyas said.

Purposeful leadership is another important factor in developing culture. “Leaders have to have a very clear vision of what their culture is, how that culture will contribute to delivering a strategic ambition, and then, how will they role model it?,” she said. To do that takes more than putting up a nice looking poster that lists out the company values. “How are leaders going to authentically lead, be at their best and help the teams and organization be at their best? That requires a personal change,” she said.

While there is not a single “right” culture, according to Dixit Vyas, there are specific drivers that are foundational to every successful culture: trust, emphasis on ethics and integrity, quality, customer focus, and spirit and vitality.

“But you have to find what’s the culture which works for you,” said Dixit Vyas. “Make the connection with purpose and strategy. Think about, of course, the role from the top, but equally, how do you engage everybody in the organization in this journey?”

Mike Roemer, chief risk officer at Discover, said for more than a year his company has been focusing on changing the dynamics of how it runs performance and talent management. Discover hired more than 3,000 people during the pandemic who never set foot in its Chicago headquarters. Last year, Discover held two large events directed at employees who had been hired over the past two years. Presentations covered company history and, of course, company culture.

“But we also wanted them to watch the behavior of people who have been with us a long time,” Roemer told the webinar audience. “Because I’m a big believer that observable behavior is the biggest driver of culture.”