News & Insights
By Peter Murphy
- Leaders are always responsible for managing their organization’s risks
- An organization’s risk culture is defined by its risk practices
- Measuring an organization’s risk culture is best done through a ‘maturity model’
I recently had the pleasure to present to the International Financial Institutions (IFI) Risk Forum here in Washington DC on risk, leadership, and culture. The IFI includes the World Bank Group, the regional development banks, and the International Monetary Fund. These financial institutions undertake an essential role in stimulating economic development around the world.
Managing risk is essential for successful outcomes in the challenging work these institutions do. As with all organizations, risk sits with the leader responsible for it – it is not something that can be delegated or left to risk professionals to manage. Leaders must ensure that they understand the hazards and risks they face. Most importantly, they have to know what the controls for these risks are, and ensure that they monitor the effectiveness of these controls. This includes personally, and regularly, checking critical controls.
We had a good discussion around what culture is, and that when discussing risk culture, what we are really talking about are the organization’s risk practices. Risk practices are what people actually do – not what they believe, or talk about. This means that an organization’s culture can be developed and changed by introducing practices that embed effective risk management. Organizational culture is neither ephemeral nor immobile – it is tangible and changeable. Leaders play a key part in establishing and promoting a risk culture by setting an example, and though what they pay attention to.
Noetic’s experience in this field is that there are a suite of factors that indicate the effectiveness of an organization’s risk culture. These factors include: leadership; organizational strategy; communication; and practices including systems and procedures. Some of these factors are not readily quantified and leaders need to use their judgement in making their assessment. As a consequence, our advice is that a ‘maturity model’ is the best tool to measure risk culture. A maturity model provides both an assessment of the current risk culture, and it can be used to develop a plan to enhance, and assess the improvements, in an organization’s risk culture. A maturity model provides an effective tool to determine the need for organizational change, a plan to follow, and a means to monitor progress.
Contact me for more information about Noetic Group’s maturity model for organizational risk culture email@example.com
Peter Murphy is a Director and co-founder of Noetic Group.