Fundamentals of Risk Management

TAbLE 
24.3

Risk-aware culture

---

Risk culture 
294
Many institutions have set up committees to oversee the implementation of risk management 
practices and procedures. Often these are management committees, although they can 
sometimes be supported by members of the governing body.
One institution has established a group to advise on the development of risk management 
processes. Significantly, this group includes academics from the institution’s business school, 
tapping into existing expertise. This practice is evident at another institution, where the group, 
a management sub-committee, includes an academic expert in risk management from the local 
business school.
As risk management processes become embedded within the daily routines and management 
of the institutions, these committees will evolve or be replaced. Institutions with more effective 
risk management processes have increasingly charged their senior management teams with 
this role, rather than establishing separate committees. In such cases, risk management 
processes have become more effectively embedded because the senior management team is 
in a better position to identify and manage risk, and to promote risk management. One institution 
visited was exploring a new role for its risk management committee as a facilitator in sharing 
good practice between departments.
embedding risk management
Accountability is vitally important if the risk-aware culture is to be successful. 
However, it is not the same as a blame culture. The organization should ensure
that it moves from a blame culture to a just culture based on accountability. When 
A risk management initiative cannot be successful unless the culture of the organ-
ization is receptive to it. In order to be receptive, a risk-aware culture is required
in the organization. A high level of maturity in relation to leadership will require 
senior management to actively promote a risk-aware culture. This will include set-
ting risk management performance targets and ensuring that the commitment of 
senior management to the risk-aware culture is clear. This will require verbal and 
written communications.
Involvement and participation of senior management is a necessary component
of achieving a risk-aware culture. Involvement can be achieved by adequate training, 
so that ownership of risks is fully understood. Specialist risk functions should play 
an advisory or consultancy role. There should be feedback mechanisms in place to 
inform staff about any decisions that are likely to affect them.
The existence of a learning culture is vital to the success of a risk-aware culture. 
A learning culture enables organizations to learn, and to identify and change in-
appropriate risk behaviour. In-depth analysis of incidents and good communication of 
feedback enables a learning culture to develop. Workshops on risk issues are another 
key component of a learning culture.

---