Risk Culture – Don’t Overcomplicate It

Almost every Risk Leader will agree that if you can get your risk culture right, it will be your biggest return on your investment. Knowing this, most risk leaders then go straight to polices, controls and processes and bypass the people.

In good cultures people care, stakeholders have a positive attitude and there is some type of activation energy that provides motivation to people. It should not surprise any risk leader operating in our traditional top down risk systems why these elements are not present.

Traditional risk systems breed the opposite of a strong culture. Someone from the risk or executive team looks at some data, comes up with an idea, puts it into policy, and introduces it to staff with expectations that will be monitored for compliance.  Of course, this is exactly what everyone loves – being surprised with yet another requirement where your opinion was not asked, does not matter and someone labeled as a compliance officer starts looking over your shoulder. Front-line stakeholders get to be the equivalent of a lab rat where someone either gives you something or takes it away when you comply or don’t.

It is not that complex. People are generally smart and read through superficial processes and the intent. Do not overcomplicate the risk process as it pertains to culture. Simplify it. Put your people back into the equation and do what you say you are going to do.

Put People Back Into the Equation

Companies have front line stakeholders that include process owners (typically supervisors) and front line employees. They live at the front of your organization and see, feel and know the obstacles on a day-to-day basis. You are missing low hanging fruit by not tapping into this knowledge and energy potential.

The question is, how do you get them to care, how do you improve the attitude and create some type of activation energy?  How do you get this low hanging fruit off the tree?

Don’t over complicate it. You don’t have to think hard to find the answer – simply include them. This is not a superficial team building thing. It all starts with making it clear what your intentions are. Build these intentions into your identity statement. Be very clear that you want your employees to drive where the risk resources go in your program. This is a bottom up thing and you need stakeholder engagement, contribution and yes – for them to be part of the decision process.

Do not get nervous and worry about where they will take your program. This is not a process where you are promoting complete independence for them to do whatever they want; it is an “Interdependence Thing”. You need them and they need you and together it becomes a good check and balance.

In the spectrum of human motivation, to the extent you move from top down to bottom up is the extent you will have buy-in and ownership that feeds to caring, positive attitudes and activation energy. All your training in tactical processes have no value if you are not creating motivation that is moving people to action.

Compliance, policies and policing activities are very complex items. You’re basically taking something stakeholders don’t want to do or can’t do because of all the other requirements they have to deal with and introducing what the industry is best at – compliance forcing. Flip this process upside-down. Put structure into transitioning from compliance forcing to stakeholder contribution and engagement.

If you tell employees that this is what you are looking to do, that they are needed and include them in the process of getting there, the culture will begin to take shape. This will not change overnight but if you do what you say you are going to do, progress will be made immediately. 

Do What You Say You’re Going to Do

If you are bold enough to flip standard industry process upside-down and make it less about your policies and compliance efforts and more about their engagement/contribution, you need to do it. You need to make what you so boldly stated in your risk identity statement happen.

Step 1 – Get Roles and Responsibilities Right

Non-standard processes call for non-standard roles and responsibilities. In a risk system, all stakeholders have roles and responsibilities that include the executive team as well as front line employees and everyone in the middle. It includes your role as a risk leader and your team as well. It is your job as a risk leader to define the roles and responsibilities.

A risk identity that supports front line stakeholder engagement is a bottom up platform. A bottom up platform is a powerful risk engine. It is your job as a risk leader to define the roles and responsibilities that will support this non-traditional identity statement. It is also your job to get the stakeholder group’s perspective and feedback on what you have drafted as roles & responsibilities. Roles and responsibilities are of no value if they are on paper only and they are not something someone can practically do within your business environment.

These roles do not have to be complicated and complex and, in fact, should not be. Part of the work is defining the risk leader and the team’s role [your own work] as well. Take the lead and be open to working in a non-traditional risk capacity. For example, traditional environments have you going down the road of a dictator that sets it all in motion and the equivalent of the Soviet KGB of your risk program. 

In a bottom up platform you will start doing things you never learned in textbooks. You are transitioning from oversight to support that empowers.

Step 2 – Use the High Performance Fuel to Get Your Risk Engine Moving

The fuel in a risk engine is your controls and processes. Your octane rating in the risk environment is the quality of your controls & processes. Do the controls you have in place align with your identity? Does your baseline of controls & processes include specific and targeted activity to make sure your identity plays out? Is there structured monitoring in place to make sure what is most important will happen?

It all goes back to your identity. You need fuel (controls & processes) to match your identity. If you have not taken the time to map out an identity, you own a low performance engine and will not get the culture win. In a low performing engine, the quality of your fuel is not relevant. In short, you are chasing your tail with controls that do not connect to a value or vision that stakeholders can relate to.

Over-complication never works. If stakeholders don’t get what you are trying to do, you will never get started. If stakeholders are not included in a structured format the culture will not improve and if you do not find a way to tap into your collective team, your company’s success will be limited to you. Begin simplifying your program today.