Most executivestake managing risk quite seriously, the better to avoid the kinds of crises
that can destroy value, ruin reputations, and even bring a company down. Especially in the
wake of the global financial crisis, many have strived to put in place more thorough
risk-related processes and oversight structures in order to detect and correct fraud, safety
breaches, operational errors, and overleveraging long before they become full-blown
disasters.
Yet processes and oversight structures, albeit essential, are only part of the story. Some
organizations have found that crises can continue to emerge when they neglect to manage
the frontline attitudes and behaviours that are their first line of defence against risk. This
so-called risk cultureis the milieu within which the human decisions that govern the
day-to-day activities of every organization are made; even decisions that are small and
seemingly innocuous can be critical. Having a strong risk culture does not necessarily
mean taking less risk. Companies with the most effective risk cultures might, in fact, take a
lot of risk, acquiring new businesses, entering new markets, and investing in organic
growth. Those with an ineffective risk culture might be taking too little.
Traits of strong risk cultures
The most effective risk managers we have observed act quickly to move risk issues up the
chain of command as they emerge, breaking through rigid governance mechanisms to get
the right experts involved whether or not, for example, they sit on a formal
risk-management committee. They can respond to risk adroitly because they have fostered
a culture that acknowledges risks for what they are, for better or for worse; they have
