From mopeds to risk management: Balancing culture and efficiency

When I was a youngster, a moped was a prized possession – the coolest thing one could have! I knew that my parents were not keen, so I did not even bother to ask. My younger brother however wasn’t so cautious. He went through the process of engaging with my parents, explaining his ‘business case’ and, most importantly, the financing (he used his savings). To my surprise he got approval to buy a moped! It was even easier for my sister – the youngest child. She didn’t even have to ask; she just inherited the moped when my brother left home for university. Clearly, my brother’s understanding of how our family worked – our culture – was more sophisticated than mine.

In business it is often said, to quote Peter Drucker, that “culture eats strategy for breakfast”. This doesn’t mean strategy, rules and processes aren’t important, but that a powerful culture can be a surer route to success. No matter how strong your strategic planning process is, its effectiveness will be limited by your culture.

Culture and risk management process might seem as two strange bedfellows, but culture matters a great deal from the perspective of risk effectiveness and efficiency and, in turn, risk effectiveness and efficiency impacts on the culture of the business. Sometimes it can be a concern that risk management is leading to a culture that holds back the business from taking risks.

Business processes, risk management roles and responsibilities, and their documentation can never fully cover the full range of circumstances where risks need to be considered.

Businesses that seek to articulate their risk management approaches in granular detail tend to end up with a fair amount of ‘red tape’ that adds costs and limits the pursuit of opportunities. The overall outcome is unlikely to be efficient and probably not effective – the challenge of detailed processes that do not allow the organisation to see the ‘wood for the trees', a level of detail is unnecessary. So, the company is providing an effective risk management process that provides the right level of control, while leaving space for staff and executives to make decisions.

Even if the design of risk processes is adequate, culture still matters. If the culture isn't right, people will not follow the processes and you're always going to be suboptimal, so risk effectiveness will be compromised.

Going to the other extreme, if the process is lacking and the culture is stronger from a risk perspective – perhaps, shaped by a clear purpose or values – the company will have the challenge of evidencing to the Board and external stakeholders that risks are managed adequately. In this situation, it might appear that risk management is effective, but this effectiveness cannot be evidenced – or, if it is, it will require an inefficient layering of processes to do so.

Optimising risk management effectiveness and efficiency necessitates aligning organisational culture with risk management. Business culture promotes the role of risk management in supporting business decision making and risk taking and achieves compliance and meeting regulatory expectations 'by design'. Seeking to ensure that risk management is in 'sync' with culture is likely to enhance effectiveness and generate efficiency gains for the business, through cost savings and decision making that is more responsive to a changing business environment, e.g., a sudden increase in inflation affecting all parts of the business.

What do businesses need to do to ensure that its culture is evolving in alignment with effective and efficient risk management?

It starts with the recognition that culture is both an input and an output of risk management effectiveness and efficiency. Businesses then need to define the challenge they want to address in respect of effectiveness and efficiency, given the existing culture. While some businesses are used to discuss the effectiveness of the risk management function, our experience shows that defining the efficiency challenge for risk management in the business is different and requires careful consideration, including articulating aspects of culture and ambition. The desired efficiency outcome could be achieved in several ways, e.g. defining more clearly accountabilities refining organisational structure, or agreeing new ways of working. How these approaches are combined depends to some extent, on the culture and ambition.

The most effective approach for an organisation will also impact on the culture of the organisation. This has wider benefits - enhanced risk efficiency enhances a culture of risk awareness and enables agile responses to changing business needs.

So, what's the connection between mopeds and parenting? Just as raising kids requires understanding their context for growth, optimising risk management within the organisational culture influences, and is influenced by it. Plus, who knows, they might even get a moped!

For more information, please contact Isaac Alfon, or your usual Crowe contact.