When culture eats your risk strategy for breakfast

In many financial services firms, risk management is often viewed as the sole responsibility of the chief risk officer (CRO) and their team. However, the true battleground for managing risk lies in the daily decisions made by employees across the organisation. For instance, on a trading floor, where KPIs often prioritise speed and profit, traders face intense pressure to deliver results. A trader anticipating a price increase in a particular asset might feel compelled to take on greater risks, such as taking a large, highly leveraged position. This can expose the organisation to significant financial losses if the market moves in an unexpected direction.

If risk management training is limited to brief onboarding sessions or occasional e-learning modules, employees may not develop a deep, practical understanding of risk and how they influence this in their daily decisions. This weakens the overall risk culture, undermining the effectiveness of risk management frameworks. Poor risk culture can lead to negative outcomes for investors, damage trust in the industry and erode societal confidence.  

To build a risk-aware culture, we must first define it. Contrary to the belief that ‘culture’ is intangible and hard to grasp, we argue that risk culture is concrete and perfectly measurable. 

We define risk culture as the behaviours within an organisation that impact its ability to identify, understand, discuss, escalate and act on risks. It is the crucial link between existing operational and methodological risk management procedures and their actual effectiveness and sustainability.

We evaluate and measure risk culture through four areas: 

PwC’s evidence-based methodology uses a mix of qualitative and quantitative techniques, including surveys, focus groups and data analysis, to understand and measure an organisation’s risk culture. Our approach helps you to identify strengths, barriers and key behavioural drivers to understand and enhance your risk culture. From there, we set practical KPIs to track progress. Examples of this include ‘number of reported incidents by employees’, ‘Risk perception survey scores’ and ‘number of risk escalations and actions taken’.  

By measuring the current risk awareness culture, we can see the cultural strengths to build on (e.g. openness to discussing dilemmas) and identify the areas needing improvement (e.g. leadership role modelling).

The challenge now is to enhance your risk culture effectively. This is done by offering the right interventions to employees at the right time. But how can we be sure of this? To do so, employees are categorised into different target groups based on the specific risks they face, and unique needs in being ready, willing and able to do what’s right at all times. For each target group, we pinpoint and prioritise critical behaviours that will help to strengthen the risk culture.

Examples of this are ‘Speak up’, ‘Walk the talk’ and ‘Report it when you see it’. By focusing on these ‘critical few’ behaviours, we can inspire a ripple effect throughout the organisation, encouraging everyone to adopt risk awareness practices. Based on the critical few behaviours and our deep understanding of the target group’s needs, each group is invited on their own behavioural change journey.

A behavioural change journey roughly follows these steps:

By following these steps, we ensure that risk awareness becomes an integral part of your organizational culture.  

To align the current and target risk cultures, targeted interventions are required. We assist organisations in identifying, designing and prioritising the right interventions to address risk culture gaps, and provide best practice insights from industry and the broader market. 

Where are you in your journey to a strong risk culture? What is your vision and ambition? Get in contact with us to start building your sustainable risk culture and learn more about good practice and market insights.