CHAPTER 6
Risk Culture

INTRODUCTION

Think about it: Stepping into a car is probably the riskiest thing most of us do on a daily basis. Because of the inherent risks involved in auto transportation, policymakers have implemented numerous systems and controls to reduce the instance of accidents and mitigate their severity. Rules about what to do at stop signs and intersections permit drivers to cross safely each other's path; tools such as speedometers and fuel gauges facilitate compliance with those rules and promote intelligent decision-making; and safety devices including seatbelts and airbags reduce the severity of accidents. And yet every day, thousands of drivers fail to comply with these rules, often at the cost of their lives and the lives of others. Some run red lights or exceed the speed limit. Others drink and drive or text behind the wheel. Many don't wear seatbelts. Clearly governance structures and policies are of little use if drivers ignore or devalue them. Drivers must internalize the proper values and attitudes to make these policies successful. As a society, we need a sound driving culture.

Just as policymakers cannot maximize motor vehicle safety merely by enacting rules and regulations, corporations cannot optimize risk management simply by establishing oversight committees, audit processes, and risk reports. These processes and systems, which comprise what I call the “hard” side of risk management, become useless without the soft side: all the factors that influence individual decision-making and behavior. Together, these factors form the organization's risk culture. In a sound risk culture, everyone not only knows and understands the policies, but also shares the values behind them. Employees and managers alike are aware of risk and adjust their behavior accordingly. Together, the hard and soft sides of risk management determine the risk profile of a business. While the hard side involves enablers, which establish the capacity for sound risk practice, the soft side includes drivers, which impel the actual execution of sound risk practice. The dynamic nature of risk underscores the importance of developing a good risk culture. Since every risk is unique—and since risks are ever changing—having a policy on the hard side for every risk situation is no more feasible than having a rule for every situation that one encounters while driving.

By “culture,” I am referring to a set of repeated, observable patterns of a group's behavior. It is shaped by a broad spectrum of forces: leadership, shared values and beliefs, habit, and incentives, both positive and negative. Culture in turn drives human behavior, hence its value to risk management. In a typical risk culture, people will do the right thing when told what to do. In a poor one, people may actually do the wrong things even when rules are laid down. But when a powerful risk culture has taken root, people are likely to do the right things even when they are not told what to do. By embedding risk awareness and accountability into a positive corporate culture, managers needn't spend a lot of time brainstorming policies for every last risk situation, but can instead allocate their resources elsewhere.

As you can see, I believe strongly that the soft side of risk management is at least as important as the hard side. Yet it was only following the recent financial crisis that firms have begun seriously addressing issues of culture. I can't say that comes as a surprise. Risk culture has long been a vague concept that practitioners and academics alike have failed to define with sufficient clarity. The chief reason for this failure is that employee sentiment is considered to be all but un-measurable—or at least difficult to measure accurately compared to hard numbers such value at risk or risk-adjusted return on capital.

In addition to policies, an organization must find other ways to foster a strong risk culture. Management should encourage intelligent risk taking, even if it results in failure, while showing zero tolerance for unauthorized and unethical behavior. Leadership is a key driver: The “tone from the top” is crucial to establishing honesty and integrity as paramount values. Trustworthy leaders, ongoing training, and clear communication all reinforce risk culture.1

In this chapter, we will attempt to correct this oversight by establishing a framework for individual decision-making and develop a toolbox for managing a business's risk culture. First, we will identify the key steps that each individual must take when making risk-related decisions. Next, we will see why human nature (as described by psychology and behavioral economics) and conventional business structures present imposing obstacles to each step. We'll also highlight the common deficits that managers wishing to improve a company's risk culture should address. Finally, we will take a look at best practices for measuring and managing these factors and consequently improving a business's risk culture.

RISK CULTURE SUCCESS FACTORS

Trying to repair a problem you don't fully understand is a fool's errand, and improving risk culture is no exception. Before we can develop strategies toward establishing a sound risk culture, we need to understand what goes into creating one in the first place. The circumstances surrounding each risk decision are unique, and erroneous practices can arise at many levels, ranging from a single rogue trader motivated by a higher bonus to a group of individuals using unsound business practices that have been accepted (or even encouraged) by management. Some risks unfold over the course of an hour while others take place over months or years. Despite the many differences, there are several common themes that emerge in the process of neutralizing or mitigating risks at the level of individuals and business units. We can distill these into eight key steps:

  1. Hire the right people.
  2. Set the tone from the top.
  3. Make good risk culture easy and accessible.
  4. Use an appropriate yardstick.
  5. Understand the information.
  6. Communicate the problem.
  7. Act on it.
  8. Assess the risk culture regularly.

We'll look at each of these steps in turn and identify the inherent obstacles that companies face while executing them.

Having discussed the importance of risk culture, we will now turn to how to create a strong risk culture. I noted earlier that the soft side of risk management seems difficult to hone because it resists quantification and objective measurement. Here we would benefit to remember the words of the philosopher Aristotle: “It is the mark of an educated man to look for precision in each class of things just so far as the nature of the subject admits.” Aristotle meant that different fields, and even sub-disciplines within each field, require varying degrees of exactitude; we expect more atomic-level precision from a physicist than a biologist, and more cellular-level precision from a biologist than a psychologist. The same applies to risk management: The hard side deals with policies, systems, and limits—similar to science. The soft side deals with people, their values and principles—similar to art. Therefore, while we should still expect some quantitative measures when shaping risk culture, we can justifiably turn to qualitative measures and success stories from case studies as well.

There are useful parallels between sound corporate risk culture and sound driving culture in our society. In fact, we can learn a great deal about the art of molding a good risk culture by examining the process of creating a good driving culture.

Step 1: Hire the Right People

No one can legally sit behind the wheel of a car for the first time and jump onto the highway. The first measure toward establishing a good driving culture consists of setting up numerous barriers to entry: Age restrictions control for maturity and experiential aptitude, driver's education and paper examinations control for theoretical knowledge, and the road test controls for practical competency. The first way to prevent unsound driving is screening out unprepared drivers from ever getting behind the wheel in the first place. This will succeed only if the “hiring process” for approving new drivers aligns with the values and qualities that comprise a good driving culture.

Businesses can learn from this example. The employees of a company are fundamental to its risk culture being effective. The first step to establishing good risk culture is to limit whom the company hires. Studies have shown over 50% resumes contain inaccuracies.2 Basic controls include employment and background checks. As a recent example, a simple background check would have saved Yahoo's board the trouble of ousting Scott Thompson, the company's fourth CEO in five years, because he falsely claimed a computer science degree.3 But this is not enough—a growing number of companies also conduct behavioral and honesty testing to screen employees.4

A basic strategy for minimizing risky behavior is to prevent questionable job candidates from ever becoming employees. Since the specific values, attitudes, and beliefs of a company's business units define its risk culture, it would do well to screen potential hires for desirable attitudes, such as honesty and integrity. I've found that emphasizing the importance of references (and even asking candidates what they believe their references will say about them) strongly incentivizes the candidate to be honest about their work history.

Questions evaluating competency in core areas have become the standard in hiring practices. For a company aiming to open the door only to sound risk practitioners, why not include risk awareness as a target competency? Interview questions might include:

  • In your last job, did you ever face a tradeoff between profitability and risk? How did you handle the issue?
  • Describe the last time one of your superiors put forth an idea that you strongly believed was incompatible with the company's strategic objectives. How did you respond?
  • In your previous job, were you ever aware of a risk that wasn't being adequately addressed? How did you deal with it?

When a company refuses to hire a top performer who does not mesh with its risk appetite, it has succeeded in the first step toward developing a sound risk culture. As a bonus, screening for risk-culture fit will likely reduce employee turnover, meaning that the lengthy and costly process of hiring will consume fewer resources.

Step 2: Set the Tone from the Top

If you are a parent, I'm sure you try especially hard to display good driving behavior when your kids are in the car. You probably also become particularly frustrated when you see a police officer park illegally or make an illegal turn. What merits these actions and reactions? They come from our realization that the actions of senior figures and those in authority become the standard for acceptable behavior. Since the attitudes and values of these higher-ups often trickle down and influence others, they set precedents and therefore ought to be considered carefully.

In risk management, even more than other corporate initiatives, the involvement of senior management (and of the CEO in particular) is critical to success. Why is this? As we reviewed earlier, many aspects of risk management run counter to human nature. While people are eager to talk about their successes, they are generally much less enthusiastic about discussing actual or potential losses, particularly those related to their businesses. Overcoming this reluctance requires applied authority and power. The CEO must therefore be fully supportive of the risk-management process, and set the tone not only through words, but through actions as well. He or she must first communicate that risk management is a top priority for the company in presentations, meetings, town halls, and other settings. More importantly, the CEO must demonstrate commitment through actions, by exemplifying and embodying the values they espouse. Does the CEO actively participate in risk management meetings? Has the company allocated an appropriate budget to support the program? Are senior risk executives involved in major corporate decisions? What happens when a top producer violates risk-management policies? How the CEO and senior management respond to these questions will speak volumes about their true commitment to the risk management process.

Those at the top of the corporate ladder have a responsibility to embrace an open culture that gives people the freedom to voice concerns when they arise. If authority figures welcome critical opinions from those in lower positions and give them the proper consideration, they send a message that ideas will be judged on their own merit, no matter the source.

An effective practice to set the tone from the top is to articulate the key principles for strong risk management. As an example, when I was the Chief Risk Officer for Fidelity Investments, I established the following principles:

  1. Business Units Drive the Car

    Business units are fully responsible and accountable for managing risk, with support from risk professionals providing tools and strategies for effective risk management.

  2. Equip the Car with Instruments

    We must strive to increase the transparency of risk through measurement and reporting, and communicate exposures through escalation procedures.

  3. Fast Cars Need Good Brakes

    We should set boundaries to avoid undesirable risk or behavior, as well as limits to manage our risk concentration.

  4. Get to the Finish Line without Crashing

    We need to balance our business and control requirements, because risk management is a necessary but insufficient requirement for success. In order to be successful, businesses must strive for growth and profitability.

  5. We Win or Lose as a Team

    Given that we must manage risks on an integrated basis—across different risks, processes, business units, and countries—risk management is everyone's job.

As another example, JP Morgan Chase, which is widely regarded as a best-practice organization in risk management, has set forth the following principles:

  1. Defined risk governance
  2. Independent oversight
  3. Continual evaluation of risk appetite, managed through risk limits
  4. Portfolio diversification
  5. Risk assessment and measurement, including Value-at Risk analysis and portfolio stress testing
  6. Performance measurement (shareholder value added) that allocates risk-adjusted capital to business units and charges a cost against that capital.

Some people may say that risk management is analogous to the brakes in a car—getting in the way of growth or speed. However, the fastest cars have the best brakes. Good brakes give the driver the confidence they need to go faster—safely.

Step 3: Make Good Risk Culture Easy and Accessible

Driving a car doesn't require detailed knowledge of the internal combustion engine. The third lesson that driving culture teaches us, then, is that easy driving is good driving. Two important ways of making driving easier are investing in human capital, and investing in driving infrastructure. The first way that the government can make driving easier and safer is by investing in human capital: namely, the knowledge of the drivers. Driver education courses, lessons, and public service campaigns about seatbelts and texting behind the wheel all serve to create competencies and habits that make safe driving easy.

Establishing a sound risk culture among business units is no different. Remember the story in the previous chapter about the president of GE Capital shutting down business for two days of risk training? The commitment to risk management he demonstrated was just the first step in improving the company's risk culture. The training he instituted provided core competencies that traders lacked. A major obstacle toward sound risk practice is the lack of risk knowledge and awareness. For CEOs wishing to improve their company's risk culture, workshops and training programs are a necessary first step. Between these training programs, executives should make sure to communicate the importance of risk management and risk culture throughout the organization.

The second way driving can be made easier is by investing in the right infrastructure. Imagine what the accident rate would be if cars lacked speedometers or freeways lacked speed limits, or if those tools were inconvenient to access? Auto designers have given careful thought to creating dashboards that communicate critical data at a glance to reduce this risk. All of these tools make driving easier by integrating information and allowing for well-informed decisions.

The value of integration applies equally in a business setting. By establishing an infrastructure that increases the flow of risk information among business units, management can ensure that decision makers have all the information they need. When risk exposures are correlated and move dependently relative to each other, their severity increases. How are business units supposed to respond appropriately when they lack the proper infrastructure to understand all the risks involved?

A study of retirement savings habits clearly illustrated the value of making the best choice the easiest one. In the study, experimenters measured 401(k) participation rates among employees and manipulated the ways in which employees could enroll.5 When the 401(k) was presented with opt-in enrollment, only 40% of the employees joined. However, when enrollment was made easier with a simple checkbox, 50% enrolled. And when employees were forced to decide whether to enroll or not, enrollment climbed to 70%. We can interpret the last two cases as instances where (among other factors) the opportunity cost of a certain behavior is reduced, and we find that decreasing the opportunity cost of desirable behavior increases its likelihood. Increasing risk information integration, then, is akin to decreasing the opportunity cost of sharing important risk indicators.

Step 4: Use the Right Yardstick

Car owners face very high costs—from the cost of the car itself, any loans taken out for the car, gas, maintenance, and so on. Insurance premiums are generally some of the highest costs a car owner faces. As car owners become better drivers, they are rewarded. The insurance company measures a variety of behaviors to track and reward drivers. The fewer accidents and speeding tickets one has, the lower one's insurance premium will be. Making good driving appealing increases the likelihood that we'll practice it. The negative incentives are strong as well. Policymakers use negative incentives to encourage desired behavior: They set numerous rules and enforce them with penalties to suit the infraction, such as fines, points, suspension, and even jail time. Similarly, CEOs and board members should incentivize good risk management both positively (by spelling out the rewards of sound risk practice) and negatively (with strict policies against unauthorized and unethical behavior).

The measures a company uses (or fails to use) to track and compensate individual and group performance comprise a key driver of behavior. Most companies establish performance goals in terms of sales, revenue, and profitability, reinforcing the desired behavior with incentive compensation. But increasingly, management experts are recognizing that performance measurement should not be limited to these parameters alone, and have devised frameworks that take into account broader considerations. One such framework is the Balanced Scorecard, which augments financial measures with metrics pertaining to customer satisfaction, operational efficiency, and organizational learning. In the same way, if management wants to gain a proper risk/return perspective, it must incorporate risk measures into the processes that generate management reports and track performance. (We'll examine risk frameworks in greater detail in the following chapter.)

The most important tool at a CEO's disposal is compensation. It has often been said that people don't do what you want them to do; they do what you pay them to do. And, as we discussed earlier, a compensation scheme that overemphasizes profitability can set a company up for risk hazard far beyond its appetite. In order to prevent this, key risk metrics must factor into performance evaluations to reward employees not for the highest returns per se, but for the highest risk-adjusted returns.

Figure 6.1 shows two different perspectives on revenue-based incentives. In the graph to the left, note that as risk increases, so does marginal return, though along an ever-flattening curve. Many companies evaluate and reward employees based on sales or revenue results alone, without considering risk exposures or losses. Now take a look at the graph to the right, which reveals risk-adjusted return. As you can see, at a certain point, risk-adjusted return peaks as risk increases before descending precipitously. As a result, this company is incentivizing its employees to expose it to increasingly higher levels of risk that may ultimately surpass its risk appetite. Such a company has opened itself to risk hazard, in which there is a fundamental misalignment between performance measures and compensation incentives of a company and the optimal level of risk it should take on.

Image described by caption and surrounding text.

FIGURE 6.1 Risk Hazard

The presence of risk hazard among companies is rampant. One need look no further than the 2008 financial crisis to see the adverse consequences that result from a focus on sales and earnings targets at the expense of risk. Too often, companies attempt to influence a single consequence of certain decisions (e.g., increased revenue) rather than the justification for those decisions (e.g., taking risk into consideration). They set aggressive earnings growth targets in the range of 15 to 20 percent per year. But are these targets realistic when the general economy is growing at 3 to 4 percent? What kind of pressures do they put on business units? How will people behave if aggressive sales and earnings goals, all tied to compensation, do not account for appropriate risk measures and controls?

Rules and exhortations are useless unless they are backed with fair and consistent enforcement, which not only corrects individual behavior, but also deters others from committing the same transgression. Drivers (or traders or accountants) are unlikely to follow the rules if they see others flout them with impunity. What message does it send to employees when management looks away as a rogue trader takes excessive risks simply because she's on a winning streak? Or when a business unit operates within risk policies without recognition or reward? In my practice, I've often found that management fails to distinguish between useful and reactive criticism. Consider two traders within a bank: One produces a gain but failed to adhere to risk policy. The other produces a loss but stayed within established tolerance levels. Management's response to these disparate results speaks volumes about the risk culture.

Effective risk management is about insight and foresight on current and future risks. Unfortunately, many companies struggle to anticipate emerging risks. Apart from our tendency to think in the short term based upon recent experience, we're all too busy focusing on the business at hand to give much thought to the future. But risk anticipation and modeling are essential components to crisis aversion. Consider Sarbanes-Oxley: While the regulations adequately responded to the recession of the early 2000 and the fraud and accounting scandals of companies like Enron and WorldCom, it failed to anticipate a key factor in the later economic meltdown—subprime lending.

Another difficulty in identifying risks stems from the fact that we tend to use heuristic strategies—shortcuts that facilitate decision-making at the cost of accuracy—when dealing with risk information. By contrast, proper risk management demands algorithmic strategies: well-defined steps that are more likely accurate. When identifying risks, many people succumb to availability bias, in which we judge things that we remember more easily as occurring more frequently or being more important than they actually are. For example, people often believe that flying has become riskier after news of a plane crash, when in reality the risk has not changed. Because we recall anecdotes with ease, they skew our perception of risks.6

Step 5: Understand the Information

Even for companies that collect the right data, a serious obstacle remains: understanding what that data actually means. We must be able to get from point A to point B without allowing our biases to lead us astray. Risk management demands objective analysis of probabilities and their implications. In this section, we turn to the shortcomings of human psychology that make quantitative understanding so difficult.

Something That Appears Certain May Be Highly Unlikely

Take the oft-conflated terms frequency and probability. Frequency describes the number of times something happens while probability describes the likelihood that something will happen in the future. Generally speaking, people are better judges of frequency than they are of probability. We need to address this problem, also known as frequency bias, since a proper understanding of probability is essential to risk management. To appreciate this bias, consider this example: Imagine that you go into the doctor's office to be tested for a rare disease that affects only 0.001% of the U.S. population. You are told that the equipment used to detect the disease is quite accurate. If you have the disease, the test results will be positive 100% of the time. Meanwhile, the specificity of the test is 99.9%, which means if you do not have the disease, the tests results will show positive just 0.1% of the time.

The test results come back positive. Should you be worried? Most people give a quick yes, arguing along these lines: “If I have the disease, the results will always be positive. My results are positive, so I probably have the disease.” The problem with this reasoning is that there is an enormous difference between the chance of testing positive, given that you have the disease, and the chance of having the disease, given that you test positive. In the situation presented, if you test positive, the probability that you have the disease is only 0.1%.7 In the case of business management where a large portion of planning is contingent on likely scenarios, there is a lot of planning based around the expected, but not necessarily the unexpected or full range of possible outcomes. Risk management should be careful to properly analyze events past and present, taking frequency bias into account, and create multiple contingency plans; otherwise it is likely they will fail.

Something That Feels Highly Unlikely Could Be a Sure Thing

Consider two scenarios. In the first, you're in a room with 29 other people. What are the odds that two of you share a birthday? You might reason that with 365 days in the year, any given person has a 1/365 (0.2%) chance of sharing another's birthday, so among 30 people, it is unlikely that two individuals share a birthday. In the second, you are given the name of every person in Michigan (roughly 10 million), and asked to randomly pick 10,000 names. What is the chance that at least one person gets picked twice? You reason that for each pick, a person has a 1/10,000,000 chance of being selected. For the person who was picked first, he has about a 1/1,000 chance of being picked again in one of the 9,999 future picks, so the odds of someone being picked twice are quite slim.

Both of those conclusions are incorrect. The chance of at least two people in a room of 30 sharing a birthday is greater than 70%. The chance of at least one person in Michigan being picked twice? Over 99%. You can find a full mathematic explanation elsewhere. The key point I want to make here is that the original reasoning above neglected the interconnectivity of the individuals in each situation. This is a common shortcoming of human perception, and it holds many consequences for standard risk practice. When risks are interdependent or correlated, their consequences are multiplied. In business terms, correlated risks introduce greater earnings volatility. If management fails to recognize the interconnectivity of the company's risks, it may exceed its risk appetite due to the wrong interpretation of the right data.

Other Problems with Understanding Data

The previous two examples highlight our inability to grasp the actual probabilities inherent in risk situations. But humans also have a tendency to inject entirely extraneous information into certain decisions based on preconceived notions. We will glance at the ones most pertinent to risk management now:

  1. Framing effect: The same information, presented in different ways, can significantly alter how people perceive a situation. If people hear that a medical treatment offers a 95% chance of survival, they will be more amenable to it than if they learn that there is a 5% chance of death. Perhaps the most common instance of framing in the business setting is the sunk-cost fallacy, in which people make present decisions based on previous investments. For example, imagine that a manager has invested $100 in a machine that he values at $120. A negligent employee damages it during installation, rendering it useless. If the manager were to refrain from buying a new machine, reasoning that it would be an effective $200 payment for a $120 machine, he would be acting irrationally since the $100 previous investment is a “sunk cost,” that is, unrecoverable under any situation.
  2. Conjunction fallacy: Where do more murders occur each year: Michigan or Detroit? Since Detroit is in Michigan, it is logically impossible for Detroit to have more murders. Yet when a large sample of college students were asked to estimate the number of murders in either the city or the state, the median estimate of Detroit murders was twice as high! In another study, 89% of participants thought that it was more likely that a woman was a bank teller and active in a feminist movement than just a bank teller alone. In both cases, people based their estimates of probability on impressions and stereotypes, erroneously concluding that the conjunction of two events is more likely than either alone.
  3. Anchor effect: Do you think that a porcupine has more or less than 5,000 quills? Guess how many. You probably guessed somewhere around 5,000, because of our tendency to anchor our actions around previous information. This effect even takes place when the information is entirely unrelated; people with higher Social Security numbers, after writing them down, tend to give higher estimates for the number of doctors in New York.

Step 6: Communicate the Problem

Once a business unit adequately evaluates a risk and establishes a response, it must relay this information to risk management and integrate it into its practices and decision making in a meaningful way. Often, this means discussing loss and other unpleasant topics, which few businesspeople enjoy doing. After all, those who go into business tend to be optimistic and ambitious, highly focused on success and what they are doing right. Successful people get promoted so it becomes a virtuous circle. But a large portion of ERM deals with what has gone wrong, what is going wrong, and what could go wrong. As a result, I often see risk managers characterized unfairly within their organization as Dr. Nos and naysayers. To use a complaint often lobbed at the Fed, risk managers seem to “take away the punchbowl just as the party gets going.”

Of course, nobody wants to be a party-pooper. And if management is pleased to see what appear to be positive results from an initiative, individuals have little incentive to speak up when they have concerns about a looming risk. This attitude can infect an entire organization. How often have we read about financial institutions that turned a blind eye to the trader delivering 20% returns annually year after year—in a market that was growing much more slowly? Such miraculous results should merit skepticism at the very least, but more often than not, these seemingly invincible individuals are instead given a pass when it comes to established oversight and controls.

In a healthy risk culture, people are comfortable identifying risks and discussing mistakes. They're prepared to pull projects and reject ideas when the risks involved exceed a company's appetite. They don't simply roll over just because management is enthusiastic about results, nor do they assume that an individual's or business unit's past success guarantees positive results in the future. Sure, they might pull the punchbowl just as the party's getting started, but maybe it's because the partygoers have to get behind the wheel later in the evening.

Step 7: Act on it

Suppose a business unit has the right incentives to consider risks and properly understands the bell curve. It objectively examines the problem at hand and, appreciating its severity, communicates the problem to the pertinent actors. Surely then it would act appropriately? Not necessarily. The growing field of behavioral economics has spurred a departure from our classical assumption of man as Homo oeconomico by exposing major flaws in our ability to make fully rational decisions. In particular, the phenomena of hyperbolic discounting and risk aversion present major obstacles to sound risk practice in an otherwise strong culture, and we will consider each in turn.

Hyperbolic Discounting and Delayed Gratification

There is nothing inconsistent about valuing something in the present more than something better in the future. For example, it would be rational to take a $100 payment today versus a $110 payment in a week if you could invest that $100 and, in a week's time, earn a return greater than 10%. However, it is inconsistent to change preferences depending on how far into the future the dilemma is presented. That is, we tend to give greater weight to immediate rewards, whether rationally or not. A funny example of this comes from gym memberships: Many people sign up for memberships as a cheaper alternative to paying for each visit, but end up going so little that they effectively increase their cost per visit. To see how this works numerically, imagine that exercising costs 80 points today (you exert effort and spend money), but results in a 100-point benefit tomorrow. (You feel better and improve your health.) Let's say that your bias toward the present means that you give full weight to events today, but just 75% to things that happen tomorrow. When we sign up for gym memberships, we are imagining the costs and benefits in the future, so we calculate .75(100 − 80) =15 net points, and conclude that it is best to enroll. But on any given day, we feel the full weight of the dumbbells and less so the delayed benefits. On those days, we calculate: −80 + .75(100) = −5 net points, and procrastinate.

The implications for risk management should be clear. Even if we rationally calculate that creating value in the future would be objectively better (whether more profitable or less risky), we might wish to realize the profit immediately due to our biases. Moreover, we might rationally understand that investing in some future technology would be better for the company, but decide not to.

Prospect Theory

According to a rational model of human behavior, people should make decisions with the highest expected utility. However, research conducted by Daniel Kahneman and Amos Tversky in the late 1970s shows that people act inconsistently with this model by exhibiting risk-prone behavior with respect to potential losses and risk-adverse behavior with respect to potential gains.8 For example, when people must choose between a guaranteed $250 gain versus a 25% chance of a $1,000 gain (and a 75% chance of a $0 gain), they tend to choose the former. Yet when they choose between a guaranteed $250 loss versus a 25% chance of losing $1,000 (and a 75% chance of losing nothing), they tend to choose the latter. This directly interferes with a sound risk practice by cutting off the right tail of the bell curve (potential positive results) while fattening the left-hand, negative tail. This is a reflection of the problem we encountered with typical incentive structures. While many compensation incentives push business units to exceed a company's risk appetite, yielding a lower than optimum risk-adjusted return, our psychological preference for realizing gains immediately may prevent us from taking the appropriate amount of risk. The result, again, is lower than optimum risk-adjusted return.

Step 8: Assess the Risk Culture

Safe driving isn't just about teaching the right skills and hoping drivers will apply them properly. Policymakers must also take time to track driving trends so they may better respond to changing behaviors and implement appropriate measures. Take, for example, the issue of texting behind the wheel—a problem that didn't even exist until relatively recently, but which has emerged as a particularly deadly trend. Policymakers in nearly every state responded by banning the practice, while insurers and other organizations produce PSAs to warn drivers of the danger. Likewise, companies should track and record both internal and external trends and respond to the data with their own measures. One of the easiest ways to do so is to create a schematic of key risk culture categories—each with its own metric—and benchmark the results.

Few policymakers could have predicted in the 1990s that texting while driving would grow to become a serious, widespread issue. But continued research and trend analysis led to a quick response that has likely saved untold lives. In the same way, being open to and prepared for change in your company, your industry, and the economy at large will ensure that you face fresh challenges effectively well into the future. For this reason, a company must monitor progress to refine the behavioral change initiatives set forth by management. Consider an internal survey that asks the following questions:

  • Leadership. Do the board, executive, and line management set the appropriate “tone from the top” with respect to risk management?
  • Accountability. Do employees understand and accept their risk management roles and responsibilities? Are there consequences if they don't?
  • Challenge. Does the company have a strong feedback culture in terms of raising issues and challenging existing practices? Do leaders encourage such views and challenges?
  • Transparency. Is there a clear process to communicate and escalate risks? Do we use the right metrics and incentives to support risk-related decisions?
  • Value-added. Is there an appropriate balance between business and risk requirements? Does risk management add value to the business?

The results of these surveys can help companies understand risk drivers as well as the effectiveness of their risk-management processes. As the data accumulate year after year, they measure the evolution of risk culture and promote swifter response to the changing needs of the business.

BEST PRACTICE: RISK ESCALATION

An effective risk-escalation process is a vital component of enterprise risk management. The objective of this process is not to undermine accountability for risk mitigation at the front lines, but to ensure that greater potential risks receive the swift, broad responses they may require. Proper escalation also enhances transparency and aids in data collection.

Risk escalation should never be left to chance. Rather, companies must set clear policies and processes in place to carry it out. Such policies exist in our everyday life as well as in business environments. Consider the “If You See Something, Say Something” campaign in the United States. The Department of Homeland Security has set a clear risk-escalation policy: If you see something appears suspicious, you should say something.9 This initiative gives clear instructions—call Homeland Security and describe the following things:

  • Who or what you saw
  • When you saw it
  • Where it occurred
  • Why it's suspicious

Similarly, businesses must set clear policies to deal with risk. Corporate disasters, such as the BP oil spill of 2010, began as lesser, often preventable problems.10 See Chapter 20 for a best-practice benchmark outline and illustrative content for a risk-escalation policy.

CONCLUSION

The dynamic and multiform nature of risk means that making rules is simply not enough to keep it in check. Instead, it is imperative that your company create a strong risk culture so that people know what to do in most situations even if they do not have specific instructions. By contrast, a poor or inconsistent risk culture could easily lead to ignoring the rules even when they're explicit. What's worse, many companies talk the risk culture talk, but when it comes down to brass tacks—that is, incentivizing behavior via compensation, rewards, and correction, they focus on results and ignore risk altogether.

Creating a positive risk culture is not as nebulous a process as many assume. Rather, it is a systematic endeavor that begins with a framework for influencing individual decision-making and follows concrete steps from integrating risk awareness into recruitment, setting the tone from the top, and establishing clear, consistent policies that reward positive behavior, correct errors, and punish transgressions. The fact is, however, that a company with a vibrant risk culture that embraces core values will not need to rely entirely on the rules, instead tapping into the human impulse to do the right thing.

NOTES

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset