Risk governance, structures, culture, and behavior: A view from the inside

Abstract

Manuscript Type EmpiricalResearch Questions/Issues Risk governance (emphasizing internal structures and risk culture) is a relatively new approach to the governance of financial institutions that is being widely adopted in the industry. Due to obvious assessment challenges, to date no evidence exists regarding the effectiveness of risk structures nor the status of risk culture in financial institutions.We therefore investigate the extent to which bank employees view risk structures as effective and risk culture as favorable. We also investigate how risk structures and risk culture together influence risk behavior.Research Findings/Insights Risk structures were typically rated as effective with the exception of remuneration. Risk culture varied at the business unit level as well as by firm and country. Senior leaders tended to have a rosier perception of risk culture than staff generally.Favorable risk culture together with effective risk structures was associated with high levels of desirable and low levels of undesirable risk behavior.Theoretical/Academic Implications The study provides a window into internal bank governance using a novel survey methodology. Many governance papers rely exclusively on external measures of governance; these do not guarantee effective internal risk governance.Practitioner/Policy Implications Further managerial and supervisory attention should be paid to ensure that culture and remuneration structures support risk management in financial institutions. As risk culture varies at the local level, it should be measured and managed at the local level. Senior leaders cannot rely on their own perceptions but should rely instead on independent assessments of risk culture.

Organisational culture and enterprise risk management: The Australian not‐for‐profit context

“…Kimbrough and Componation () and Cooper, Faseruk, and Khan () conclude that one common element to all key risk management frameworks is the emphasis on the organisation's culture. This is further supported by John, De Masi, and Paci () and Sheedy and Griffin (, ), who claim that organisational policies per se are limited in their ability to determine the behaviour of organisational members, and that it is organisational culture that plays a major role in shaping that behaviour. Nevertheless, although there has been much discussion around the relation between organisational culture and ERM practices, empirical evidence is generally lacking (Cooper et al., ; Kimbrough & Componation, ).…”

“…Ring et al., ; Roeschmann, ; Sheedy & Griffin, , ). Risk culture is defined by Sheedy and Griffin (, p. 4) as ‘shared perceptions among employees of the relative priority given to risk management, including perceptions of the risk‐related practices and behaviours that are expected, valued and supported’. Organisational culture is different from risk culture in that it serves to provide the overarching antecedent conditions which may give rise to a subsequent and particular risk culture.…”

“…Beasley, Branson, & Pagach, ; Kleffner, Lee, & McGannon, ). However, the installation of these formal structures alone might not be able to penetrate sufficiently widely or deeply into the layers of the organisational fabric to effect ERM (Beasley et al., ; Power, ; Sheedy & Griffin, ). This may especially be the case for NFP organisations, which, as noted previously, are likely to encounter difficulties in obtaining organisation‐wide ‘buy‐in’ of ERM practices.…”

“…Both scholars and practitioners have recognised the important role of organisational culture in shaping ERM, as well as risk management in general, predominantly on a normative basis (e.g. Ring, C, McKinney, & Webb, ; Roeschmann, ; Sheedy & Griffin, , ). Kimbrough and Componation () and Cooper, Faseruk, and Khan () conclude that one common element to all key risk management frameworks is the emphasis on the organisation's culture.…”

Leading Markers of Risk Culture in Organization

“…Risk management culture has become an important topic in today's more complexity business environment. The debate on risk management culture is conducted by academic researchers for nearly 30 years (Banks 2012, Gorzeń-Mitka 2016, Sheedy and Griffin 2015, Palermo et al 2017, but now this discuss is more intensive. Research regarding risk culture are based on diverse theories such as organizational culture theory, cultural theory or other psychological approaches (Lam 2003, Liebenberg and Hoyt 2003, Moeller 2007, 19.…”