Risk Culture – A “Post-Pandemic” View

Most would agree with the view that “risk culture” is an important factor to consider when assessing the strength of your organization. Few people would say that an entity’s values and attitudes towards risk-taking, risk management, and risk mitigation are not critical to the economic and social standing of a company, irrespective of size, scale, and industry. However, has the recent global pandemic changed how you now think about your organization’s risk culture?

Before describing three factors that have influenced the assessment of risk culture, here are a few baseline pre-pandemic thoughts:

• Tone at the top – “Organizational culture is more broadly adopted and adhered to when desired behaviours are demonstrated top-down, rewarded and reinforced.”
• Collective accountability – “Risk management is everyone’s responsibility – working as risk-aware individuals and operating as a risk-informed team.”
• Individual perception – “Employee viewpoints gathered through observation, focus groups and surveys can be an indicator of organizational risk culture.”

These statements remain true as we emerge from the pandemic but how your organization thinks about these topics has likely shifted and may never be restored to the pre-pandemic points of view.

Here are a few questions for you to consider in terms of how certain aspects of the pandemic have impacted the risk culture fundamentals of tone at the top, collective accountability, and individual perception:

Impact of the remote or hybrid workforce

Through the pandemic, organizations were generally operating remotely, with some now starting to operate on a hybrid model. The full organization being in a physical office, five days a week, plus the occasional weekend, is no longer the norm.

• Governance and internal oversight committees are still largely virtual – can the desired organizational culture and behaviours be effectively modeled top-down and, would it be evident that the messages are being received?
• Can teams that have come together through a remote working model - with some team members being “pandemic hires”, who have never met their colleagues and do not have the pre-pandemic rapport to leverage - learn to trust their colleagues as well as be fully trusted by their teammates to operate in a risk-aware manner?
• Has the impact of the remote workforce model on an individual (either positive or negative) changed the employee’s answers to opinion and satisfaction survey questions that were previously used as an indicator of risk culture? Has risk culture truly changed or are other unrelated factors now influencing the responses?

Elevation of individual accountability

It would be incorrect to suggest that individuals were not always responsible for governing themselves and operating in a manner that aligned with organizational, team, and personal expectations.

• Nevertheless, has the sense of individual accountability increased because there is a need to differentiate in a new way?
• Management is providing oversight differently, colleagues are working as individuals within teams – so how does an individual now demonstrate talent, drive, and ambition?
• Do decisions on ways to stand out change the risk culture balance?

Role of second and third line of defence

Functional teams like Risk Management, Compliance, Finance, Human Resources, and Internal Audit all have a role to play, in not only embedding the desired culture within an organization but also in contributing to monitoring or assessing risk culture.

• Effective challenge is viewed as a critical aspect of governance and oversight activity. Is open dialogue now stifled by our meeting technologies and tools or user comfort levels?
• Is “groupthink” a bigger issue now because teams are less familiar with each other or meetings are scheduled one after the other, with less reflection time available during the day?
• Is exercising professional skepticism to corroborate results, by looking people in the eyes when making inquiries to observe actions and physical cues, a thing of the past?

In conclusion, the pandemic has opened the risk culture dialogue as certain principles that were considered fundamental to a strong risk culture are now adjusting to post-pandemic norms. How organizations now think about, monitor, and assess risk culture need to keep pace by adding dimensions that are likely here to stay and may challenge the baseline views.