Thinking Differently: Building a Risk Culture

“Young and old are dropping themselves from Wall Street at a pace we have not seen before” (sudden spade of suicides in 2014). “High -flying executives end up crash-landing in jail.” or “Your competitive advantage lies in the hearts and minds of your employees.” Deciding on a title for this piece was more difficult than writing it, but in the end it all comes down to thinking differently. We have to change the way we think about risk management and get away from the view that systems, processes and committees are the keys to effective risk management. Business leaders are slowly waking up to the concept of risk culture building, but it might be too late for some, and throwing money at the problem will also not help; time is what you need to invest here. The time has come for you to hospitalize the whole business and cure the disease of greed (and some others). Business success is anyway no longer measured by profits only. Many consultants and executives tried to define risk culture, but it is almost impossible because of all the worldviews, cultures, sub-cultures and generations out there in your business world. It is a lot easier to define risk culture building: the process of growth and continuous improvement in the way each and every person in an organization will respond to a given situation to mitigate, control and optimize that risk to the benefit of the organization. The biggest business failures in recent times were also not related to money; most were as a result of operational risk failures and, in particular, failures of people risk. A quick analysis of the biggest business losses in history highlights the causes as being one of two key people risk elements: “lack of management oversight” or “because of a management override.” Business leaders either did not do their jobs or completely misused their power and authority, often to cover up their personal lack of ethics or misconduct. Business (and other) leaders must fundamentally change the way they think about risk management; you cannot suddenly “bolt on” an effective risk culture. Do not make the same mistake you made when you saw risk management as an implementation project and spent a fortune on systems and processes to get a risk report that is as useful as driving a car without looking through the windshield. You can have the best dashboard and rear-view mirror (last month’s risk report), but if you make business decisions based on those you do not get very far. Organizations spent vast amounts of money to hire consultants to implement risk management as a project, believing that it can be done that way. Risk management cannot be implemented; it is a process of building and continuous improvement in an environment that is constantly changing. Business is no longer life in the fast lane; it is life in the on-coming traffic, and, sadly, some organizations still try to drive while looking in the rear-view mirror. Risk management can also not be a project; building an effective risk culture has only one possible end- date: the day you go out of business. Many organizations are heading toward this day by doing very little about risk management. If you are not good at risk management or not doing anything about building an effective risk culture, you will be exploited by those who are better at it. Many organizations are speeding up the process by working toward getting all risks “green”;  if everything is “green,” you are not taking enough risk to get enough reward and stay in business. As the famous racecar driver Mario Andretti put it:” If everything seems under control, you are just not going fast enough.” The risk profile of any organization must steadily increase over time, move from green to amber and onward to red, for those who run their businesses according to traffic lights. As you get better at risk management, you must take more risk for more reward. If you are not getting better at risk management, don’t try to get more reward. It does not work that way!