By Lucy Morley
for the 2024 Risky Women Writing Competition, presented in partnership with Bovill Newgate
This article discusses how a healthy organizational culture influences behavior, decision-making, and compliance in financial institutions. With insights from industry leaders, it highlights the importance of open communication and psychological safety in reducing risks. As culture becomes a focal point in regulatory assessments, learn how integrating cultural metrics can enhance risk management and drive long-term performance.
As Jennifer Geary says in her “How to be a Chief Risk Officer” book, “culture is the most powerful influencer of behaviour in the workplace and therefore must be considered first when it comes to risk.”
This message is increasingly re-iterated, particularly post the 2008 financial crisis, since when regulators and industry leaders have vocalised the importance of a strong healthy culture in financial institutions, highlighting that in order to manage risks we must start by ensuring that the culture of the institution is a healthy one. In a recent speech by the FCA’s COO it was said “Culture remains central to our supervisory model. It is what underpins outcomes” and “Culture underpins conduct and therefore business performance and confidence”. ECB Executive Board member, Frank Elderson, said in a recent speech “Culture encompasses the collective mindset and the shared set of values that shape the everyday behaviour of a bank’s employees. It is not just a trendy buzzword. It is in the DNA of how a bank functions and how it manages risks….. Culture shapes behaviour, and behaviour, in turn, shapes the destiny of financial institutions.” The Financial Stability Board chair also recently said “the absence of a healthy challenge culture hamper effective governance and strategic steering, which can ultimately lead to a bank failure.”
Culture drives conduct and operational behaviours. It shapes decision making processes in terms of what factors are prioritised, and the collective approach to risk management and compliance; it sets behavioural norms and establishes unwritten rules of acceptable conduct and accountability; it defines what success looks like and what behaviours are rewarded; and it influences communication behaviours throughout an organisation.
Open, transparent and respectful communication and a psychological safety to challenge allows for individuals to thrive personally and professionally, which in itself enables institutions to retain quality staff and removes some of the risks around recruitment and retention. Simultaneously transparency and encouragement to question protects the institution from accidental errors in decision making. This way of thinking is also evident across various other industries including Medicine and Aviation, where culture is now recognised as forming the basis of safety management, arguably the most important of risks. As an oncologist friend said to me recently, “I ask all my junior doctors to tell me if they think I’ve done something wrong as it can only lead to a good outcome – either I will be able to explain why I’m right and they will learn something new or they will save me from making a mistake.”
Other principal risks faced by a financial institution, ranging from strategic risks, through to credit, legal and compliance, operational, IT, capital and reputational, can also all be reduced and certainly protected and controlled by cultural drivers influencing internal behaviours. An institution with a strong risk management culture will have a much higher likelihood of policies and risk assessments being more thoroughly adhered to and of staff reporting suspicious behaviour (vs for example a culture prioritising targets or profits where risk-taking may be implicitly encouraged or people may cut corners to reach goals). A culture where there is pride in the business will drive decisions being made and actions being taken that perpetuate this pride and protect the reputation of the institution.
For all of these reasons culture is increasingly recognised as a powerful and critical risk mitigant. Many financial institutions include it in their strategic priorities and many financial regulators now explicitly assess culture in their supervisory processes. Yet implementation still varies, and culture can still be perceived as a “fluffy” topic and a secondary consideration after financial metrics and tangible risk management statistics.
There are a number of reasons for this. Culture is intangible and difficult to measure, and cultural change is a long-term process, particularly for larger institutions, and it may take years to see the full impact of current efforts (its noteworthy that newer financial institutions now often place more emphasis on culture from the outset). It is also impossible to build a universal framework for culture and even when recognised as important, cultural initiatives can be seen as secondary when faced with immediate business pressures. Similarly, there can be varying perspectives within a large organisation, with leadership promoting the importance of culture and others in the organisation struggling to balance it with performance pressures or seeing it as disconnected from day-to-day operations.
Fortunately, an increased focus on Environmental, Social & Governance metrics is bringing culture more into focus and the early development of culture-related KPIs (e.g. employee engagement and retention / attrition) is helping to make cultural factors more concrete. In addition, younger generations of employees and customers often place higher value on cultural factors, which could potentially drive further change.
Consistent messaging and action from leadership, demonstrating clear links between culture and performance plus developing more robust metrics for cultural assessment will drive implementation further, supported by growing evidence linking culture to risk management and long-term performance (plus the identification of poor culture as the root cause of many financial scandals) helping to change perception. Cultural considerations can then be integrated into core business processes, thereby cementing its importance and allowing tangible measurement, and placing it front and centre of risk management practices as it should be in recognition of its significance.