How do you communicate and report on your risk culture maturity to your board, regulators, and customers?

When I joined the risk management team at my current organization, I noticed there were varying levels of understanding of risk across departments. To address this, I collaborated with our Risk Champions to conduct a comprehensive assessment of our risk culture. We used surveys and discussions to identify gaps in risk awareness, particularly around operational risks. This helped us establish a clearer picture of our organization's risk culture, revealing a need for more frequent communication and training on risk management principles.

I've found that by doing step 2 well, it's much easier to do step 3. If you've aligned the key insights from your risk culture assessment to strategic areas of focus, it's much easier to get the attention of senior stakeholders because that's what they're already focused on. Clearly highlighting how current risk culture areas of focus add or detract from the execution of strategy, and delivering nuanced recommendations that address these insights, is critical.

One of the most powerful tools for Board and regulatory engagement is going beyond dashboards and MI, and instead to discuss what is actually happening in the firm - through anecdotes, quotes from clients and feedback from all levels of the organisation. Bring key voices to the table to bring the stories to life.

As part of my role, I regularly presented risk reports to senior management and engaged with regulators. One instance that stands out is when I worked closely with my ERM Team Lead to craft a presentation for the board that not only highlighted key risks but demonstrated how those risks could also present opportunities. This dual narrative helped shift the conversation from simply mitigating risks to using them as strategic advantages.

One effective approach that can be used to measure risk culture is through regular surveys and feedback loops with both employees and clients. In one instance, Developing a scoring system that tracked risk incidents, response times, and resolutions across departments. This allowed us to pinpoint weak areas and implement targeted training programs to continuously improve our risk management processes.

It is critical to "look out" and "look in" when you are framing risk culture insights. What do your insights mean when we consider the external (Sector/global) environment and internal (organisational) environment? When framing your insights, it's also imperative to consider how your current strengths or areas for improvement position you in terms of emerging risks or anticipated challenges - consider what the actual risk outcomes are of those strengths and improvement areas.

They need to be celebrated and shared at an individual, team, and organisational level through both informal and formal mechanisms (sometimes what is explicitly or formally rewarded is incongruent with what is informally rewarded - ensuring alignment between these is critical for reinforcing desired behaviours). - Individual: Where possible, personalise how you recognise & reward behaviour to the individual. Be creative. - Team: Focus on enabling people leaders to build cultures of recognition within their teams (for demonstrating positive risk behaviours, but also the organisation's values more broadly). - Organisation: Leaders sharing positive stories and actively role modelling and communicating desired behaviours.

Focus on sharing stories and case studies on risk culture and their impacts. Your stakeholder engagement should be focused on uplifting their capability and gathering information that enable you to better understand risk culture areas of focus and support ongoing monitoring of your organisation's risk culture.

One thing I’ve learned is that fostering a strong risk culture is not a one-time effort. It requires continuous learning and adapting. For instance, in one of my roles, we encountered a new type of Data Loss threat that wasn’t part of our initial risk framework. This experience taught us to always leave room for unknown risks and encouraged us to stay ahead of the curve by regularly revisiting and updating our risk protocols.