How do you assess risk culture in an organization — isn't it too intangible?

Question

AcadiFi · Accepted Answer

Risk culture — the shared values, beliefs, and behaviors shaping how risk is taken, managed, and communicated — is intangible but measurable through a combination of surveys, behavioral indicators, and observed decisions. It's a leading indicator of future risk events, as seen in the failures of Archegos, Credit Suisse, and SVB where cultural breakdowns preceded financial losses.

Assessment approach for Harborpoint Bank: (1) Employee risk culture survey — anonymous survey measuring psychological safety to escalate concerns, tone from the top, accountability, and challenge culture. (2) Behavioral KRIs — whistleblower hotline volume, risk-related disciplinary actions, employee turnover in control functions, frequency of 'override' of limits. (3) Observation of committee dynamics — does the risk committee challenge management? Are dissenting views recorded? How long are risk issues on the agenda? (4) Compensation alignment — do incentive structures reward long-term risk-adjusted performance or short-term volume/revenue? (5) Independent review — internal audit and external reviewers assess cultural indicators.

Deploy the FSB's risk culture indicators: effectiveness of tone from the top, accountability, effective communication and challenge, and incentives. Red flags include: 'don't raise issues without solutions,' fear-based escalation, revolving-door CROs, and revenue generators overriding risk function. Culture change takes years; assessment should be continuous with targeted interventions (leadership modeling, tone refresh, whistleblower protection, realignment of compensation) rather than one-off surveys.

How do you assess risk culture in an organization — isn't it too intangible?

Master Part II with our FRM Course

Related Questions

Practice Questions