Corporate culture is crucial for an organisation’s ability to identify, assess and manage risks. However, an efficient risk culture cannot be dictated, but develops through a combination of leadership behaviour and active employee involvement. This is the conclusion of a new research project from Aarhus BSS.
In 2013, when the Danish Rangvid Committee was asked to point out the villains behind the 2007-2009 financial crisis, their long-awaited report1) concluded that the crisis could not be blamed on one specific bank manager, one politician or one public authority.
However, although the reason for the crisis rested on a number of villains, experts did agree that a lack of risk management was one of the explanations for the financial tsunami that swept across the world and taught us words such as credit crunch, recession and derivatives - and left the world in a financial shell shock.
Culture is crucial
Since then, the general risk landscape has developed into a volatile environment in tandem with increased globalisation, greater complexity and demands for shorter reaction times. Today’s risk landscape is thus characterised by an increasingly sophisticated technology. This makes it more important than ever to be able to identify, assess and manage risks.
However, we still know very little about what creates an organisational culture of risk awareness. This question has now been explored by Assistant Professor Evelyn Caroline Braumann from the Department of Economics and Business Economics at Aarhus BSS, Aarhus University together with her colleagues Isabella Grabner from Vienna University of Economics and Business and Arthur Posch from the University of Bern.
“In order to achieve an efficient risk management, risk awareness must be part of the company culture. Risk awareness arises when all employees share and reflect on how their behaviour and actions are related to the causes and outcomes of potential risks to the firm,” explains Evelyn Caroline Braumann. Together with her two colleagues, she has published the article ”Tone from the top in risk management: A complementarity perspective on how control systems influence risk awareness”2).
"Not until the company moves from having only systems to having a shared underlying risk awareness the company will truly increase its risk readiness. And not until then has risk awareness become part of the company culture."
Evelyn Caroline Braumann, assistant professor, Department of Economics and Business Economics, Aarhus BSS.
Culture won’t happen on its own
However, risk awareness cannot be implemented directly by a management decision. Thus it is crucial for companies to create an effective control environment in which all employees are encouraged to demonstrate risk awareness i.e. react to threats and know what to do about them.
Previous research shows that the tone from the top - i.e. the leader’s visible awareness, articulation and specific support of risk management - is crucial for creating risk awareness in the organisation. However, Braumann and her colleagues argue that tone from the top does not work in isolation but must be combined with other, more formal, control practices in order to result in proper risk awareness and thus efficient risk management.
The study therefore explores the interplay between tone from the top and the use of budgets and performance measures (KPIs) - either in the form of diagnostic or interactive control. It also concludes on how the two forms of control promote or inhibit tone from the top in terms of increasing risk awareness.
Put differently: The researchers took the most common tools used by management to evaluate employees, i.e. budgets and KPIs, and explored whether the use of diagnostic and interactive control of these tools increases or diminishes tone from the top and vice versa in relation to the company’s risk awareness.
“In diagnostic control, management sets a number of targets and leaves it up to the employees to monitor these targets and react to significant deviations. Diagnostic control is thus retrospective, while interactive control has a forward-looking focus based on collaboration and continuous dialogue between management and employees about their experiences,” explains Braumann.
Read also: Sustainable Development Goals
Dialogue fosters risk awareness
The conclusion is that interactive control complements tone from the top in terms of fostering risk awareness, while this is not necessarily the case for diagnostic control.
The study finds that interactive control increases the effect of tone from the top and vice versa. This underlines that in order to increase risk-awareness in an organisation, management needs to communicate, involve the employees and let them voice what they see and hear,” says Braumann.
However, she also stresses that diagnostic control can still have an effect in situations where the business environment is regarded as stable, e.g. there is political stability in the company’s sector, and/or you do not feel threatened by your competitors. In the presence of tone from the top, diagnostic control has a potentially negative effect on risk awareness in a dynamic environment, e.g. in the context of the coronavirus in which market developments are unpredictable and you cannot foresee your competitors’ next move. Given that setting precise and meaningful targets in advance becomes more difficult, employees may more likely experience a conflict between diagnostic results and management expectations.
“Risk management takes a lot of resources and because of that, companies might find it easier to stick to diagnostic control in which they try to solve challenges by creating systems that monitor the deviations in relation to the set targets rather than through dialogue and active employee involvement. However, according to the study, this is not always as effective. And in an unstable environment, it may even lead to undesirable results,” Braumann says.
Management must lead the way
Her advice for management is that they should lead by example by displaying a behaviour signalling that risk awareness should be taken seriously. This involves telling employees what you expect from them and demonstrating the same behaviour yourself. E.g. by asking employees how they perceive the company’s competitors and markets - and not least by making employees reflect on how their own behaviour increases or reduces the risk level. Management should do so while creating a culture in which employees feel comfortable voicing issues without fearing to be punished for making mistakes or for pointing out the weaknesses of the company. This would allow all risks to be put forth.
“Culture is crucial for picking the right action in the context of risks. And here, management characteristics - combined with the right use of diagnostic and interactive control – will lead to culture characteristics,” says Braumann and elaborates:
“Effective risk awareness is not just about systems and following instructions, but also about understanding what to react to and why. Not until the company moves from having only systems to having a shared underlying risk awareness the company will truly increase its risk readiness. And not until then has risk awareness become part of the company culture.”
What the researchers didThe researchers decided to conduct a quantitative survey prior to which they conducted a number of qualitative interviews in SMEs. The purpose of the interviews was to uncover what questions to pose in the survey, e.g. What characterises your company, how do you work with risk management, etc. Subsequently, they developed the survey and tested it with their peers to make sure the questions made sense. The survey was then sent to 1,435 Austrian companies with up to 250 employees, which is EU’s definition of an SME. 198 companies responded. The weakness of the study is that it only uses data from Austrian companies and only from SMEs. In addition, a survey only measures what is being asked, which means that the data cannot demonstrate causal relationships, but correlations. |
Sources:
1) The Rangvid-rapport (In Danish).
2) Braumann, E. C et al.: Tone from the top in risk management: A complementarity perspective on how control systems influence risk awareness. Accounting, Organizations and Society.