Thinking about risk culture

In the wake of the failure of MF Global, I have seen a number of commentators attributing its failure to its culture.  The criticism is also prevalent in post mortems of bank failures in 2007 and 2008 and the ensuing period.

The danger with the ‘culture’ explanation is that you cannot create a culture – it is, almost by definition, a naturally emergent social phenomenon. There is no ‘right’ culture ex ante, only a ‘wrong’ culture ex post. As I discuss in our submission to COSO, there are real dangers in attempting to use culture deterministically. First, it can create terribly overbearing results and secondly, it can create all manner of unintended consequences.

The real problem, though, comes through the alternative solutions that may be proposed. If every alternative is dependent upon the culture in the firm for its success and, after failure, the failure is attributed consistently to the ‘wrong culture’, then the underlying activities or routines in the firm can never fail – the culture ‘fails’. But, if there is no right culture (as any number of anthropologists and sociologists will tell you), we are in position of complete circularity. The underlying system only works if there is the right culture but failure demonstrates the culture was wrong yet, ex ante, it is impossible to define a ‘right culture’ and instrumentally impossible to create it if you could.

Surely, we would be on safer ground avoid such problematic expressions. I am sure many in the risk world would recoil in horror at this suggestion but it is a blind alley, except for well-trained social scientists and logicians.

If you don’t believe me, try Max Weber (‘Objectivity’ in social science, 1897):

“There is no absolutely “objective” scientific analysis of culture . . . All knowledge of cultural reality . . . is always knowledge from particular points of view. [A]n “objective” analysis of cultural events, which proceeds according to the thesis that the ideal of science is the reduction of empirical reality to “laws,” is meaningless . . . [because] . . . the knowledge of social laws is not knowledge of social reality but is rather one of the various aids used by our minds for attaining this end.”

As for the criticism “but that’s just theory,” if it weren’t for Weber, none of this strand of thinking would have emerged (at least not in the form it did) – you cannot have it both ways. Perhaps it’s time for a bit more humility about what we can achieve with ‘culture’.


7 thoughts on “Thinking about risk culture

  1. Culture is a vital part of strong risk management within an organisation. Our research with over 130 companies and almost 600,000 employees shows higher rates of misconduct in businesses where corporate culture is poor or weak and the reverse. In addition entities with weaker culture have much lower levels of reporting – so more incidents occur and less are reported internally. Finally, those companies surveyed with strong culture see a 16% improvement in TSR over a 10 year period. In summary it’s a good lead and lag indicator of misconduct.

    • Ian, thanks for the comment. A simple challenge though: what is a weak culture? What is a strong culture? How do you differentiate the culture in a single organisation between, say, a sales function and an engineering function? Where these differ, as they will, is it meaningful to talk about a single organisational culture or are there multiple cultures with recurring or superordinate behaviours? Not a simple idea, culture.
      Best, PB

  2. Companies strive for a common culture but it may be very different in different parts of the same organisation – whether that’s in different countries or in different levels of seniority. Companies are striving to drive out those differences that can negatively impact performance. The survey I mentioned asks questions across 7 elements – and these are proven to be the best indicators –
    1. Comfort Speaking Up
    2.Trust in Colleagues
    3. Direct Manager Leadership
    4. Openness of Communication
    5. Clarity of Expectations
    6. Tone at the Top
    7. Organisational Justice

    And the online survey also asks about whether individuals have seen incidents of mis conduct (breach of company policy) or illegal acts, and is thus fundamentally different to a staff satisfaction or engagement survey. The proportion of responses in the Yes, No & Don’t Know are always interesting.

    • Ian

      The framework looks like useful stuff – descriptively. Here I have no complaint. I imagine, as ever, you are spot on with the observation that the differing responses analysed by respondents’ differing demographic attributes make very interesting reading.

      The difficulty is what to do next. And this ties back to my strong / weak comment previously. We can describe culture – no doubt about that, and I have no doubt that the instrument you describe does this from one (of potentially many) angle(s) well. We can even define normatively what an idealised culture may look like – the behaviours that we would observe in the ideal environment. [This is where most of the discussion about culture seems to be coming from, by way of casual (as opposed to causal) observation].

      The problem arises in attempting to move the behaviours of a group – usually many groups – of people from that which the instrument (or any other descriptive coda) has described towards the normative or aspirational behaviour set; i.e. using these frameworks to shift behaviour deterministically. Unintended consequences abound. The ‘culture change’ initiatives of the 1990s have, deservedly, withered; they promised much and achieved much less. Yet, in the field of internal control and risk, use of the term ‘culture’ continues as if we could use cultural attributes, norms, routines and behaviours deterministically and with impunity.

      That said, what you have described seems like a responsible place to start. But caution is indicated. We need to exhibit both realism and humility in working with a construct we struggle to get our arms around. And, while you may use the term ‘culture’ both realistically and responsibility, I am sure we have both observed many instances where others have not been similarly cautious. My nervousness relates to those who hang not only their hats, but regulate that others should do so as well, on the peg of ‘culture’. Regulating around this stuff can only end in tears.



  3. I suspect there is a strong correlation between internal control and culture. However, I also suspect that it is not culture which drives behaviours that optimise performance. It is more the internal controls (including hiring processes) that drives behaviour, which has the organisational culture as an outcome. To an extent I therefore agree with both commentators. Ian, because a corporate culture can act as an indicator of the strength of a control environment. And Peter because, projects to change culture are doomed to fail, as improved behaviours do not appear to be driven in this way.

    • Peter

      Correlation versus causation. The question (as you quite correctly frame it – in my opinion, at least) is what you can infer from what you observe. Then, having observed and inferred, what you do about it. Ian is an astute and experienced observer of these things. I’m no psychometrician (and neither is Ian), but don’t believe he would promote something without a suitable level of rigour in its construction.

      I’ve always been a huge fan of Robert Simons’ 1995 levers of control work (see a good review here from Booz). He approaches behaviour operably and relates it directly to what he calls diagnostic and interactive control systems (how you use MIS and for what). This work has not dated at all. Really worth the read, if you haven’t already.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s