Civil and administrative actions to enforce personal behaviour are essential despite the growing prominence of risk culture, argue two academics at the Cambridge Centre for Risk Studies.

Ever since the financial crisis in 2007-2008, there has been a growing focus in academic and regulatory circles on the idea of “risk culture” within companies and organisations – particularly banks.

This focus stoked recent political controversy in the UK over a decision by the Financial Conduct Authority (FCA) to cancel a broad review of banking culture – igniting a fresh debate over how banking conduct should be overseen and regulated. While the FCA said it would be more productive to “engage individually with firms” to encourage cultural reforms, the decision to abandon a broader review could prove a “dangerous and costly mistake,” said John McDonnell, top treasury spokesman of the opposition Labour Party.

Though there are varying definitions of the concept, “risk culture” in essence means the collective norms adopted by people within a group or company to define and act on risks to the organisational culture. A simple example: a bank’s reputation is based (at least partly) on its perceived soundness as a place to deposit or borrow money, so a bank’s risk culture reflects its broad patterns of behaviour to protect that reputation.

There have been reams of commentary on risk culture since the financial crisis, and some see the increased attention on this concept to be a healthy development as banks and other financial institutions seek to rebuild and retain public trust. The aborted FCA study was billed as a “new thematic review on whether culture change programmes in retail and wholesale banks are driving the right behaviour.”

But is a focus on risk culture enough in and of itself? Two academics at the Cambridge Centre for Risk Studies at Cambridge Judge Business School argue that it’s not.

“Risk culture as a regulatory tool that is divorced from business relevance [incentives and disincentives] cannot sustainably steer corporate behaviour,” Dr Michelle Tuveson and Professor Daniel Ralph argue in a paper published in the journal Banking & Financial Services Policy Report. “A more realistic alternative is needed that enforces personal accountability through greater use of civil and administrative sanctions.”

Such civil and administrative penalties – which allow for faster and “more nuanced” action than criminal sanctions – may include suspending or prohibiting individuals or firms from undertaking specific activities, financial penalties, injunctions and statements of public censure.

The paper, entitled “Is regulation of risk culture the missing piece? Civil actions reconsidered,” argues that the recent vogue toward collective risk culture – manifest in corporate guidelines on ethical behaviour – could in effect backfire. “This focus on directives from and responsibility at the top of organisations may be overshadowing the role of individual decision-making and therefore individual accountability for harmful outcomes,” the paper says.

The authors also argue that, without a link between misconduct and business relevance, statements about good versus bad organisational ethics and culture are “divorced from the reality” of individual behaviour. Such statements also don’t convince the public – as shown by scepticism about corporate social responsibility pronouncements and a recent UK poll showing that 80 per cent of consumers pay closer attention to price, value and quality than a company’s ethical behaviour and brand.

Dr Tuveson is a founder and Executive Director of the Cambridge Centre for Risk Studies, and Professor Ralph is a founder and Academic Director of the Centre, and Professor of Operations Research at Cambridge Judge Business School.

The Centre’s 7th Risk Summit on 20-21 June will examine the topic of risk culture, its effectiveness and whether there is a need for its regulation. One of the keynote speakers is Professor Michael Power, Professor of Accounting at the London School of Economics, who co-authored a 2013 research paper that said: “It is widely agreed that failures of culture, which permitted excessive and uncontrolled risk-taking and a loss of focus on end clients, were at the heart of the financial crisis. Many official reports, analyses, commentaries and blogs go further to focus on the cultural dimensions of risk-taking and control in financial organisations, arguing that, for all the many formal frameworks and technical modelling expertise of modern financial risk management, risk-taking behaviour and an absence of ethics were poorly understood both by companies and regulators.”

The concept of instilling risk culture has many advocates as a way forward, and guidelines on risk culture have been published by the Financial Stability Board (FSB), an international body set up in 2009 to promote international financial market stability.
For the FSB, indicators of a sound risk culture include:

• Tone from the top: “The board and senior management are the starting point for setting the financial institution’s core values and expectations for the risk culture of the institution.”
• Accountability: “Relevant employees at all levels understand the core values of the institution and its approach to risk, are capable of performing their prescribed roles, and are aware that they are held accountable for their actions in relation to the institution’s risk-taking behaviour.”
• Effective communication and challenge: “A sound risk culture promotes an environment of open communication and effective challenge in which decision-making processes encourage a range of views.”
• Incentives: “Performance and talent management encourage and reinforce maintenance of the financial institution’s desired risk management behaviour.”

Last October, in a sixth annual study of risk management practices, professional services firm EY in cooperation with the Institute of International Finance said: “It has become increasingly apparent that having a strong firmwide risk culture is one of the key components of successful risk management, and both regulators and boards are demanding significant enhancements to governance, structure and controls in an effort to improve risk behaviour.”

Based on a survey of 51 firms across 29 countries, the study there had been an “intensified effort” across financial services in recent years to proactively manage risk culture – with 77 per cent reporting an increase in senior management attention to risk culture in the past year, and 75 per cent saying they are in the process of changing their culture.

A decade on from the start of the financial crisis, the global debate over the proper oversight and regulation of banks and bankers shows no signs of slowing down – as shown by reaction to the FCA abandoning its planned bank-culture review.

The new paper from the leaders of the Cambridge Centre for Risk Studies is a timely reminder that the complexity of risk management in the financial services requires a holistic approach to address performance and public confidence in the sector.

Source: Judge Business School