Managing Cultural Risk
Our business careers have been spent as observers of corporate practice, both good and bad. As internal auditors we have spent, perhaps too many, hours focussed on the bad and wondered why management did not implement the sensible recommendations we made, most of which were designed to improve the way they managed risk.
For some reason pure logic was often thrown out of the window and we were frequently ignored. The results were often devastating; the destruction of whole organisations, massive financial losses and in the world of banking – the Global Financial Crisis.
A number of years ago a serious sense of frustration turned into a “Eureka moment”. There was the sudden realisation that we were dealing with human beings here. Human beings, whose natural behavioural logic is unbalanced because they have emotions. Once this became clear it was obvious that a philosophy was needed to enable us to engage with people at an emotional level, in a way that helps business manage this essential perspective.
It was from this base that we developed our version of The Cultural Risk Management Framework and what follows is our contribution to the debate on how businesses (for profit or otherwise) can engage with employees and other stakeholders in way that ensures corporate objectives and society’s objectives are met.
The first point to make is that we see the world of culture as being intimately linked with a human’s emotional expression. But what exactly what do we mean by culture?
At its simplest, Culture consists of a number of key dimensions:-
- Behaviours;
- Artefacts;
- “Touchy-feely” concepts.
Behaviours are the only aspects of culture that can be objectively measured. Internal auditors and operational risk managers are well-advised to focus their activities on this dimension to avoid ridicule and the accusation that they are expressing subjective opinions.
Ultimately the management of culture is about the management of human behaviour as expressed in terms of actions and conduct.
For example, the financial services industry is currently obsessed with conduct risk, but this fixation is nothing more than an attempt to influence the behaviour of employees in relation to treating clients and market fairly.
Artefacts are tools that are used to influence behaviour.
Examples include:-
- Remuneration arrangements;
- Regulatory fines;
- Working spaces (e.g. buildings)
- Dress policies
- Team-bonding days
Clearly we are very interested in the inter-action between behaviours (conduct) and artefacts.
The touchy-feely elements are just that. They are expressions that are incapable of substantiation and if not supported by artefacts will never lead to meaningful behavioural change.
They include:-
- Vision statements
- Ethical declarations
- Tone at the top.
The UK financial services sector recently saw the publication by the Chartered Institute of Internal Auditors of a new code for internal auditors. This document, amongst many other things, urges us to examine the risk & control culture of our organisations, it does not focus on any other element. The Prudential Regulation Authority has gone on to insist that internal auditors should report situations where they believe this form of culture is not given enough emphasis in their organisation.
Can the culture of an organisation be looked at in a single dimension like this? We think not!
As we see it, cultural risk management revolves around the management of dilemmas. One such dilemma is the need to invest sufficiently in controls which encourage appropriate risk and control related behaviours, but what about the others?
Regulators seem to believe that a suitable approach to risk and control will lead to a sustainable firm. History tells us that this cannot be true. Firms need to create and sell their products and this surely requires a different approach.
In our view, what really matters is taking a balanced approach to the way in which we manage the dilemma between the different cultural perspectives.
Based on what we have said you will not be surprised to know that we support a philosophy based around four quite different cultural dimensions, known as the Competing Values Framework.
The four behavioural dimensions are:
- Entrepreneurialism / creativity
- Risk and control (which we have already introduced)
- Market (forces)
- Clan-collaborate.
A few words about each element.
Entrepreneurialism / creativity is based around the degree to which an organisation uses artefacts to encourage behaviours that promote innovative outcomes in terms of new products, new ideas and the formation of new business relationships with sales. Apple nurtured this type of culture in abundance in its early days. The replacement of Steve Jobs with a functional CEO almost led to bankruptcy of the company.
Risk and control refers to the extent to which an organisation is willing to build internal controls to mitigate the business risks to which it is exposed. It is not only about the building of logical controls, but is very much about the artefacts used to ensure employees comply with the resulting control requirements.
Market refers to the degree to which an organisation feels the need to model and benchmark itself against the wider market and to seek guidance and direction from the external environment. HBOS was an example of an organisation that chose to use differential market pricing to win market share. Unfortunately this decision probably destroyed the bank.
Some companies choose to deliberately ignore the crowd and think in isolation. Henry Ford famously quipped that if he had researched the market he would have invented the most wonderful modern horse-drawn carriage as opposed to the motor car. In recent days, the chairman of HSBC has bemoaned the lack of innovation in the world of wealth management.
Clan-collaborate refers to the philosophy an organisation adopts in the management of its employees, either as members of a team or allowing a more individualistic approach.
We would suggest that there is no right or wrong approach in respect of any single one of these dimensions and as with leadership style, what is appropriate today may not always work in the future. What matters is the balance between these four elements of culture, depending on where an organisation is in its development cycle or the image it wants to portray.
We firmly believe The Competing Values Framework provides a framework within which firms can consciously manage their cultural risk.
That said, most firms we collaborate with take an unconscious approach to managing culture and that brings with it a number of challenges.
As with any framework, the first challenge is to establish what the optimal cultural profile for the firm (or sub-segment of the firm) should be. Clearly in the financial services sector today, the dominant cultural profile involves an extensive focus on risk and control, possibly to the detriment of almost everything else. Whether that is an appropriate approach to managing a sustainable business is a matter for debate, one we will address elsewhere.
So, how does one articulate the optimal cultural balance?
We believe this is best answered by deciding on how to measure culture.
The framework we have adopted uses a set of measurement tools to establish the cultural balance that exists today in the company. The tools include:-
- Employee and management surveys
- Analysis of the root causes behind positive or negative behaviour.
Based on the results of this research, numerical values are allocated to a number of sub-categorisations that allow a firm to map its cultural mix.
Whilst this work can initially be undertaken by corporate psychologists, the aim has to be to transfer the “know how” on such measurement tools to an appropriate function in the business.
Once an initial review has been carried out it allows us to compare the culture that we have against the culture that we want. Further, over time it also allows us to measure the change in an organisation’s culture.
Most of the organisations that we work with are engaged in some form of cultural transformation programme. Our fervent hope is that these firms are clear as to the direction they want to go and have somehow worked out how to measure whether they are getting there!
Barclays Bank is an example of an institution currently investing vast amounts of money and time in changing the cultural outlook of its employees. As recent events show, getting this right is a long term process.
Such a transformation process usually involves the use of artefacts to influence human behaviour.
Examples of key transformational artefacts include:-
- Remuneration
- Training with consequences;
- Recruitment processes
- Using role models and case studies
- Performance appraisal.
The emphasis in the financial services sector is currently to use these artefacts to force a greater emphasis on risk and control, but we suggest that they can also be used to promote other dimensions of culture.
Ultimately, given that we are dealing with emotional beings, some people may refuse to engage in the right behaviours. If these individuals are powerful role models in the organisation there will be no choice but to replace them with individuals that do fit the bill. Cultural transformation requires courage.
There is one final challenge. If we have convinced you that managing cultural risk really does require a framework then you really do need find a champion, sponsor and owner for that framework.
In summary, we are suggesting that organisations consider the adoption of a methodicial approach to culture consisting of the following key elements:-
- The articulation of the optimal cultural profile given the organisation’s status and challenges;
- The introduction of processes to measure the reality of where the organisation stands in terms of the culture it actually has;
- The initiation of cultural transformation initiatives designed to move the organisation from the culture it has to the culture it wants.