Risk Culture Essential for Effective Development of Enterprise Risk Management

The global crisis brought risk management to the forefront through improvement in the corporate governance structure world over. It is now clear that risk cannot be eliminated but can only be managed. This is one of the key reasons that development of risk management is seen across the world as leading to strengthening of the corporate governance structure

Once a professor asked a question to the class, what is the difference between the Indian Institute of Management (IIM) and any other business school? He went on to elaborate that land can be purchased equivalent to the size of IIM, the building can be built similar to IIM, the syllabus can be set same as IIM, faculty can also be recruited and a tough exam like CAT can be created, but still, many of the business schools do not match IIM, why? Replying to his own question, he said, all the contents listed above can be copied and implemented but it not possible to replicate IIM, the simple reason is you cannot copy “Culture” which differentiates IIMs from any other business school in India. Culture flows within the institution or organization, it passes from one individual to another, one generation to another, such things are not written anywhere but still, it flows within the organization. It is infectious. Great organizations are separated from ordinary ones on grounds of culture.

The same is true with risk culture; it is in the system but cannot be seen by the naked eye. What does this mean? Does every employee of the organization turn his thinking to considering risk as a part of everyday work? Is risk considered in every decision-making process? Does a new employee automatically learn from his/her peers on how to think in the new organization, giving due consideration to risk without any formal training?

The way IIMs are differentiated from other business schools, similarly, risk-focused organizations will have better standing compared to their competitors which may be reflected in their stock prices. The Indian insurance industry is fast raising public money from the market through the IPO route. The Indian insurance regulator has shown willingness to move to risk-based capital. The Indian Banking industry under the regulatory regime of RBI has a target of implementing risk-based capital under Basel-III by March 2019. Similarly, there is a regulation of SEBI to implement risk management for top 100 listed companies and there is a similar requirement under Company Law 2013 asking for risk management assessment by the Board. This tells us that in the next 5 to 10 years’ time, risk management will be at the forefront of the Board, one to implement and second to take value addition through its implementation. Risk Management or Enterprise Risk Management (ERM) cannot be successful without properly developing risk culture. Without risk culture, risk management is just a tick in the box exercise and those listed companies may get a bitter taste if any risk event crystallizes which is not anticipated, the stock price may nosedive. This is because, particularly, the Indian insurance sector does not have the experience of handling the crystallization of risk event as insurance companies were never listed in India. How does a listed insurance Company react to deaths caused by a pandemic with similar global news coming from other countries as well. Risk culture helps in integrating the thought process of scanning horizons to anticipate emerging risks.

What is Risk Culture?

The Center for Advance Research on Language Acquisition defines culture as shared patterns of behaviors and interactions, cognitive constructs and understanding that are learned by socialization. The culture of the institution is influenced by the continual behavior of its members. This behavior is influenced by individuals’ values, beliefs, and attitudes. There is also a contribution of existing culture of the organization in shaping up the total behavior. The behavior of a person is influenced by external factors such as childhood upbringing, education, family traditions, social impact etc. and personal values and beliefs. The internal factor that influences the behaviors is genetic makeup which comes from the parents.

The attitude comes from the way that you think and feel about something, so attitude has linkage with the personal make-up of the individual. So culture is a combination of behavior and attitude. Overall resulting culture is also influenced by prevailing culture of the organization apart from behavior and attitude of individuals.

+

Current Risk Culture

In the current context in India, the behavior of individuals towards risk is almost minimal because of two reasons. One, because risk management was never at the forefront of the business culture and second risk management is never taught at any of the business schools in India in their core curriculum. Therefore, risk attitude has never gone into the DNA of the individuals or organizations to make it a part of the working culture and therefore, such prorisk aware behaviors are not exhibited.

The underlying reason for this phenomenon is that most of the Indian working environment since Independence has been in the closed economy where money is funded by the government. The government is not a constraint for money as they can either increase taxes or as a last resort, can print money. So, risk never came at the forefront of capital management which is a prime concern in the private sector otherwise.

Over the last two-three decades of development of the corporate world in India after liberalization post-1990, the focus of business houses has been on business development from generating the top line. Also because of insulation from the external world in the Indian economy, many of the global events have not affected the country and therefore, the corporate world has not witnessed the impact of the failure of risk management, unlike what happened in 2008 global economic crisis to the rest of the world.

The recent global crisis has brought risk management to the forefront through improvement in the corporate governance structure world over. It is getting understood that risk cannot be eliminated but can only be managed. This is one of the key reasons that the development of risk management is seen across the world as leading to strengthening of the corporate governance structure.

The risk culture in modern-day India is at a seeding stage, not even germination stage because most of the risk management is brought over through the regulatory changes, especially in the financial sector. The development of risk culture under these circumstances is bound to take time as the behavior and attitude of individuals needs to be molded in the pro-risk management direction. Such risk culture development is not easy and quick as behavior and attitude change takes a long time. The challenge that will be faced by the Indian financial corporate over the next 5 to 10 years is resulting from three lines of defense model which is used by Companies as a part of governance structure to enhance risk management.

Three Lines of Defense Model

To ensure effectiveness of an organization’s risk management framework, the board and senior management have created line functions for monitoring and assurance within the organization. The role of the first line of defense is to own and manage risk. Under the first line of defense, operational management has ownership, responsibility, and accountability for directly assessing, controlling and mitigating risks. On the other hand, the second line of defense is a risk function that oversees and specializes in risk management and compliance and the third line of defense is the Audit function that provides independent assurance.

Given the background of risk culture currently prevailing in India, especially for the first line of defense, it will be a big challenge to implement risk management effectively and make three lines of defense model as a success. Even at the global level, similar challenges are observed because “risk” as a thought process has not been part of attitude and resulting behavior due to similar reasons cited for the Indian example. However, the difference could be due to their some more advanced level of risk management implementation compared to the Indian market. Even at global business schools, risk management as a part of the core curriculum is yet to be developed.

So, unless a habit disappears from the very DNA, the success of any initiative may have a shallow base, this is some kind of a universal principle. It is of paramount importance to improve the risk culture to make corporates less susceptible to failure to anticipate risk and take proactive management action. There is a need to change the risk culture.

Some of the efforts discussed below may be used to transform the risk culture to help effective implementation of risk management.

Improvement in risk culture

Similar to risk mitigation, risk culture also needs risk mitigation plan because poor risk culture is a risk to the organization. The first step towards risk mitigation is risk identification which we have discussed above. The key core areas that we have identified that need addressing are:

1. Improvement in risk education

2. Development in risk behavior

3. Change in the attitude towards the risk

Improvement in risk education

There is now a greater need to re-look the course curriculum at undergraduate and postgraduate levels to ingrain the risk culture slowly into the habit and behavior of the budding next-generation corporate workforce. This can be done by introducing risk management in the core curriculum both at undergraduate and postgraduate levels which include subjects of business studies. Risk management can also be introduced in the commerce and economics stream to develop “What if” thinking so that when they grow up, their thought process has a natural inclination of thinking about risk in all their decision-making.

As a part of the risk education, the Indian corporates need to establish a special program on risk management as a part of employee training on regular basis rather than a one-off. The employees may be encouraged to go for standard risk management certification programs that are imparted by many professional bodies. There could be incentives for such certification programs. To further enhance more structured risk management education, Risk team hierarchy including the position of Chief Risk Officer must have a standard risk management qualification. Most of the current trends in the risk management hierarchy are not linked to any risk management qualifications. Such qualifications will attract new talent to make risk management a career which the future will need.

Development in risk behavior

As discussed above, behavior does not change in a day, but a human has a habit of quick learning if they are bent in any particular direction. There could be several methods of changing the behavior.

Humans learn in two ways, when there is a compulsion or when there is a passion. You do not need to worry about those who have passion but they will need guidance to move in the direction of understanding risk management and the values that it adds to the business. This will entice employees to naturally take up the profession and develop the habit of learning.

The second way is a compulsion route followed by policies and procedures including the linking of incentives both fixed and variable in the proportion of benefit added to the Company through the route of risk management. This should be started at the Board level followed by Senior Management goal sheets and the rest of the employees. This will help in properly implementing enterprise risk management across the business. In Risk-based capital, managing risk is equivalent to managing capital which will mean improvement in the shareholder’s return.

At present, the Indian financial sector is some distance away from embracing the risk-based capital, however, this presents a good preparatory ground in the meantime to develop the formula for the incentive right across the hierarchy.

Such behavioral change will lead to cultural change, helping in setting the tone from the top to develop risk culture.

Change in attitude towards the risk

As seen above that the attitude comes from the way that you think and feel about something, to further develop risk culture within the organization, the attitude towards risk may be assessed at the time of recruitment. So if the students know that risk attitude is one of the recruitment criteria, they will develop themselves the risk attitude which they have to demonstrate at the time of recruitment. In a longer term maybe 50 years later with the development of risk-based thinking in the previous generation, the future generation may inculcate this habit as their natural thought process.

Conclusion

When risk is getting to the forefront, at least in the financial sector and maybe later in other sectors, there is no doubt that risk culture will improve either voluntarily or involuntarily. This is because regulators are pushing such reforms in the direction of risk management. On the other hand, with risk-based capital, shareholders will have the opportunity to optimize usage and increase returns on capital. In time to come, the CFO will drive the risk culture within the business in consultation with the CRO.

Disclaimer

– The views expressed in this article are the personal views of the author and are purely informative in nature.