Glossary term
Risk Culture
Subject: Risk Management, Risk Fundamentals and Frameworks
Risk culture is the shared set of values, attitudes and habits that shape how people in an organisation think about risk, raise concerns and make decisions when risk is involved.
Explanation
Policies say what should happen. Culture shows in what staff actually do under pressure. A healthy one shows in small things: staff report errors early, challenge is welcomed and bad news travels upward. A weak one rewards sales over caution, treats risk teams as obstacles or punishes those who speak up. Boards and supervisors judge it through indicators such as the tone set by senior leaders, how pay and promotion treat risk-taking, staff survey results, how incidents are handled and how often limits are breached or waived. The risk function does not own it; every manager shapes it. The idea is wider than compliance culture, which concerns following rules, because it also covers taking sensible, informed risks. After a failure, inquiries often find that the policies were in place and people did not follow or enforce them.
Example
A telecom retailer's internal review finds that store managers who beat sales targets are promoted regardless of complaints. Staff say raising a concern “slows the team down”. The board changes the scorecard so a quarter of the bonus depends on conduct and control results, and the chief executive shares the first quarter's near-miss figures openly with all staff.
Not to be confused with
- Compliance Culture
- Compliance culture is about following rules and ethics; risk culture also covers how people weigh and accept risk in decisions.