by dr. david hillson

Cultivating a Risk Culture

Risk Management

Developing a risk culture
Developing  a risk culture

We need a risk process that is simple and scalable, which can be applied across the organisation to manage all types of risk; we also need competent people, with the knowledge, skills and experience to deal with the risks that might arise; infrastructure is also important and provides the tools to support risk management and handle significant amounts of risk data. However none of these factors are as important as that of culture. The ideal culture is risk-aware, encouraging people to take the right risks, and rewarding good risk management.

So how can an organisation develop a strong and mature risk culture?

Two approaches are possible: Culture first. One possibility is to start at the top, addressing cultural aspects directly. This requires a clear statement of intent from leaders in the organisation, laying out their vision and policy for risk management. This statement should describe their values and beliefs about risk, and explain the approach that they intend to take in order to exploit risk and create benefits. A senior manager should act as risk champion and the desired risk culture should be actively communicated to all staff, so nobody is in any doubt that risk is being taken seriously.

Once a risk-aware culture has been established, other detailed elements can be put into place to turn the risk vision into reality. Staff can be recruited and trained for specific risk roles, risk processes can be developed, and a suitable risk infrastructure can be established. These steps should be easy to complete because the risk culture already exists and is understood.

Culture last is the second option, which involves not worrying about developing risk culture proactively, but to allow it to emerge naturally. This approach concentrates on putting all the practical elements into place within the organisation to allow risk to be managed properly, with good people, processes and tools. The focus is on getting the day-to-day implementation right.

As people across an organisation put risk management into practice within their routine jobs, they should start to see results. Managing risk properly results in fewer problems and enhanced benefits. As they see risk management working for them, people will recognise the importance of managing risk. Their belief in the value of risk management will reinforce correct behaviours. A positive cycle is created where acting properly towards risk creates a risk-aware culture, and that in turn makes people want to manage risk in all they do.

Both approaches to creating a mature risk culture in our organisation work and either one can produce a strong risk-aware culture. However each approach also has potential weaknesses. If you start by addressing culture first, any delay in providing the supporting implementation can result in lost momentum and demotivated staff. But if you concentrate on practicalities and wait for risk culture to develop naturally, the culture that emerges might not be exactly what you expect or want. The most important thing is to do something. If you want a risk culture that promotes effective risk management at all levels in your organisation, choose one of these two approaches and get started today. Risk culture matters, whether it comes first or last.

Please visit for more information.

comments powered by Disqus

This edition

Issue 29


TPM_Editor Old boy brings new life to Joburg school buildings using Corobrik’s quality face bricks 4 months - reply - retweet - favorite

TPM_Editor Global pump manufacturer obtains level 1 B-BBEE certification 8 months - reply - retweet - favorite

TPM_Editor IDT works on Tshwane inner city heritage project for Public Works 8 months - reply - retweet - favorite