Risk Culture: A strategic asset

Every organisation has its own distinctive culture: the set of shared values, beliefs and norms (formal and informal) that influence individuals’ behaviour at work. In financial services, where risk-taking is at the core of business, the attitudes and norms relating to risk are termed risk culture. Risk culture shapes how bank employees make decisions on taking and managing risk, within (and sometimes beyond) the framework of their institution’s formal structures, policies and procedures. A healthy risk culture is not one that discourages risk-taking: rather it aligns employees’ actions and decisions with a bank’s stated risk appetite while promoting compliance with internal rules and regulatory requirements.

The European Central Bank (ECB) has made risk culture an important part of its approach to bank governance. Risk culture – which ECB Supervisory Board Vice-Chair Frank Elderson has described as the “software” of governance, alongside the “hardware” of formal structures and policies – is one of the nine components of the ECB’s assessment of internal governance and risk management under the Supervisory Review and Evaluation Process (SREP). In July 2024, the ECB published a draft Guide on Governance and Risk Culture setting out its expectations for how banks should maintain a healthy risk culture as part of good governance.

Promoting a strong risk culture, however, is much more than just a matter of meeting supervisory expectations. As the latest KPMG White Paper explains, it is also a hidden strategic asset in uncertain times.

Banks today operate in a context of unprecedented uncertainty. The business environment in which banks operate is being reshaped in dramatic and often unpredictable ways by rapid technological advances, shifting social structures, climate change and heightened geopolitical tensions. In this uncertain world, banks need to be agile with the ability to adapt swiftly to unforeseen developments. Meanwhile increasing AI adoption will shift the focus of many roles from executing routine processes to supervising automated systems. In this context, it will not be possible to craft rules and procedures to cover all possible scenarios. Banks must instead increasingly rely on judgements and decisions made, often under pressure, by individual employees. A healthy risk culture, in which employees focus on the long-term interests of the bank, discuss problems openly and abide by the bank’s strategy and risk appetite, is a powerful force to ensure the right decisions are made.

The good news for banks is that risk culture can be both measured and actively shaped. Drawing on extensive academic research (including investigations of 150 cases of misconduct), KPMG has developed a model for assessing risk culture along 8 dimensions, ranging from leadership tone and role modelling, through openness to discuss dilemmas to incentives and enforcement.

This model allows organisations to understand the current state of their risk culture. It also provides a framework for compiling documentary evidence that supervisors will want to review, for example on the content of leadership communication or use of ‘speak up’ channels for staff to raise concerns.

Measuring and assessing risk culture then allows banks to identify areas where they wish to improve, design interventions to drive progress, and then monitor their effectiveness and the quality of risk culture over the longer term. This process of continuous monitoring and improvement can be summed up in a 5-step model of culture change.

Improving risk culture brings clear business benefits. Academic research has shown that banks with a strong risk culture outperform peers on several performance metric including return on assets, return on equity and return per unit of risk. Further studies also show that firms with better-developed risk cultures have more stable earnings, are more resilient in crisis situations and experience fewer instances of misconduct by employees.

Assessing, enhancing and monitoring their risk culture will not only help them prepare for supervisory scrutiny. It will also unlock strategic value for their businesses.