Risk culture: turning good ideas into a repeatable discipline

Risk culture is how an organisation’s values, behaviours, incentives and decisions shape the way people identify, discuss and manage risk. It is visible not only in policies, but in what happens when commercial pressure rises, bad news emerges or decisions fall close to risk appetite.

The rationale is both commercial and regulatory. A stronger risk culture can improve the quality and speed of decisions, support appropriate risk-taking and strengthen resilience. It also helps firms demonstrate how risk management operates in practice, rather than existing only on paper. Weak culture, by contrast, can amplify risk, undermine otherwise well-designed controls and damage customer outcomes and stakeholder confidence.

Discussions about risk culture often produce good ideas: a survey, a new indicator, a leadership session or a review of decision-making. These can all be valuable. Yet firms tend to hear less about the process needed to track culture over time, connect evidence and turn insights into action.

Creativity and process are complementary. Good ideas help firms understand culture from different angles. A repeatable process provides continuity, ownership and evidence of whether interventions are working. Without ideas, monitoring can become mechanical. Without process, useful insights can remain isolated observations.

There is no single correct model. The approach should reflect the firm’s size, complexity and maturity of the business model. One organisation may benefit from a structured assessment using interviews and focus groups, followed by clear actions and ownership. Another may already understand its cultural priorities and gain more value from a concise dashboard that draws together selected business indicators, trends and management actions.

The evidence should also be flexible. Surveys can reveal perceptions, while interviews and focus groups provide context. Business information such as control performance, overdue actions, response to incidents and complaints, whistleblowing themes and staff turnover can show what is happening in practice. No single measure proves culture. 

A practical approach to risk culture has four elements: clarify accountabilities; select or tailor a proportionate framework; assess the current and desired culture using multiple sources; and agree targeted actions with owners, milestones and regular executive and board reporting. The framework and governance arrangements may remain relatively stable over time, but the assessment, action planning and monitoring cycle should be recurring. 

The objective is not to produce a single culture score. Instead, the goal should be to create a disciplined conversation about how risk management supports the business, where behaviours or processes are creating friction, and what changes would improve both effectiveness and performance.

Firms are becoming increasingly sophisticated in measuring risk culture. Surveys, dashboards and key indicators can provide valuable insights into trends and outcomes. However, measurement alone is not enough. Measurement should inform decisions, prompt constructive challenge and lead to actions that are embedded in decision-making, governance and day-to-day practices, with progress monitored over time.

This is where the distinction between a good idea and a process becomes important. A firm may introduce a survey. These can all be worthwhile initiatives. But their value ultimately depends on whether they are embedded in a process that enables leaders to understand what the results mean, decide what needs to change and demonstrate progress over time. In practice, risk culture is often strengthened not through a single initiative, but through the consistent application of a repeatable process of plan, do, check and review.  The objective is continuous improvement: understanding current behaviours, identifying opportunities to strengthen culture, taking action and evaluating whether those actions are delivering the intended outcomes over time.

A strong risk culture should therefore be viewed as an enabling capability rather than a compliance exercise. When approached in this way, it can support better decisions, stronger resilience, clearer accountability and more effective risk-taking. Just as importantly, it can help organisations reduce their reliance on increasingly detailed processes and controls by encouraging behaviours and judgement that support the right outcomes in the first place. 

Risk culture will continue to be relevant as organisations respond to changing business models, new technologies, evolving customer expectations and ongoing regulatory scrutiny.  

Increasingly, firms are reviewing operating models, governance arrangements and the roles of the first and second lines of defence. These changes are more likely to succeed when accompanied by a clear understanding of the risk culture being embedded, the risk maturity the organisation is targeting, and how accountability, delegation and challenge should operate within that culture.

But there is no single answer to risk culture. Different organisations require different approaches. The important question is whether the approach provides management and boards with sufficient insight to understand how culture is influencing decision-making and whether it is supporting the objectives of the business. This reinforces the importance of leadership, including the CRO and executive team, in shaping expectations and supporting the consistent application of risk management.

Our Risk Consulting team specialises in risk management, resilience, transformation, sustainability, and data and analytics. We work with insurers, asset managers and other financial services businesses to respond to business challenges and enhance financial and operational resilience.

We help organisations take a practical and proportionate approach to risk culture, from assessing the current state and identifying opportunities for improvement to developing frameworks, reporting and management actions that support better decision-making. Our focus is not simply on measuring risk culture, but on helping firms use those insights to drive sustainable improvements in risk effectiveness and business performance.