Fundamentals of Risk Management

Risk-aware culture
293
behave in particular circumstances. It will define how an individual feels obliged to 
behave in all circumstances.
A good risk culture will be the product of individual and group values and of
attitudes and patterns of behaviour. This will lead to a commitment to the risk 
management objectives of the organization. Organizations with a risk-aware culture 
are characterized by communication founded on mutual trust and a shared perception 
of the importance of risk management. There also needs to be a sharing of confidence 
in the selected control measures and a commitment to adhering to the established 
risk control procedures.
Table 24.3 sets out the suggested components of a risk-aware culture. These
components are suggested by recent UK Health and Safety Executive (HSE) research 
as leadership, involvement, learning, accountability and communication. This makes 
the acronym LILAC. Creating a culture where effective risk management is an 
integral part of the way people work is a long-term aim for most organizations.
If an organization decides to raise awareness of security issues, it may decide to 
launch a campaign to focus on the risks and the relevant controls. The campaign 
should use more than one means of communication if it is to be successful. The 
awareness campaign could include all of the LILAC components and may extend to:
●
●
risk awareness training;
●
●
awareness poster campaigns;
●
●
site inspections;
●
●
arrangements for reporting defects;
●
●
leaflets and brochures.
a risk-aware culture is achieved by lilaC:
Leadership
Strong leadership within the organization in relation to 
strategy, projects and operations
Involvement
Involvement of all stakeholders in all stages of the risk 
management process
Learning
Emphasis on training in risk management procedures and 
learning from events
Accountability
Absence of an automatic blame culture, but appropriate 
accountability for actions
Communication
Communication and openness on all risk management issues 
and the lessons learnt