Intentionally shaping your organization’s risk culture starts with three simple steps

Please fill in the contact form. In return, we will notify you of updates, provide poll results analysis and new, high-quality risk culture resources.

Notify me

There are two ways to approach risk culture, either through a laissez-faire “wait and see” approach, or through a purposeful approach with a chosen direction and speed. 

For example, if you want to:

  • help people think about what we do and why we do it, and orient the risk culture towards managing for success (because we all have goals to achieve)
  • inform and motivate staff to do the right thing by integrating risk management into business processes and daily activities
  • educate people about their roles and responsibilities in risk management

In this case, a purposeful approach is probably more effective…

How do you address risk culture? 

Risk culture is very important for organizations under increased scrutiny from external stakeholders such as regulators and shareholders, but it is also not an easy aspect of risk management to master. Creating or shaping a more risk-aware culture, however, is potentially the greatest value a CRO can bring to the organization to prepare it to meet the challenges of an uncertain and rapidly changing environment.  

Because not everyone in the organization has the same risk management concerns, it is important to tailor the topic to specific groups. Influencing risk culture occurs at several levels (board of directors, executive committee, senior management, operational supervisors, workforce) and each level requires a specific approach for best results. We can help you with different approaches for different people:

  • one to one coaching/consultation session
  • workshops
  • training sessions (face-to-face or remote/online)
  • briefing sessions
  • eLearning & micro-learning

Every framework designer knows it: you cannot fix a problem you don’t fully understand.

Improving risk culture is no exception. Moreover, it is about understanding the current situation and making progress so that the situation evolves in the next 12 to 24 months with significant improvements. All good framework or roadmap design starts with a thorough analysis. The results of these analyses form the starting point for understanding what specific problems exist and defining solutions that will carry people towards acceptable baselines of behaviour in future. 

Intentionally shaping an organization’s risk culture is a time- and resource-intensive undertaking. And, it is probably a multi-year effort. It does not happen overnight and requires persistence, repetition and encouragement. 

When purposefully influencing your organization’s risk culture, there are three important factors to consider

The first thing to understand is that risk culture is a complex issue. Risk culture is intangible and we can only approach it through different aspects which taken together form the risk culture. Although risk culture is complex to understand and difficult, if not impossible, to measure, it is possible to diagnose and understand certain aspects of it. By considering these components of risk culture, it is possible to design a series of interventions to initiate culture change. 

Second, influencing risk culture is an important change management initiative. Any risk culture work we might want to do will become a change management program, applied in a complex social system. It seems strange to say it, but people are not robots and we diverse in our wants, needs, expectations and willingness to do things differently.

As such, risk professionals must be humble enough to recognize that they are not always equipped with sufficient psychological and sociological understanding to tackle this issue alone, and that they must use expert resources wisely.  

The most important thing about risk culture programmes – as with any journey – is to be able to determine where you are starting from and where you want to go. This is our third important factor for consideration. Without this, you’re aimless. Regulations, risk frameworks and procedures are of little use if the prevailing risk culture works against them.

People can make bad systems work and good systems fail 

Effective risk management goes beyond risk policies and rules, it is also driven by values, beliefs and attitudes of individuals and their organizations. Yes, it is possible for an organization to effect change in its risk culture. For organizations that want to meaningfully shape their risk culture, these are three simple steps that can be foreseen, in order to make realistic progress to strengthen your ERM value. Interested to find out more? Please visit or watch the last in the series of our related video segments (3 minutes) here: