Culture is one of those corporate intangibles. You can't wrap your arms around it, but it is powerful and of increasing importance--especially as M&A grows and risk management tops the corporate agenda.
"The continuing increase in merger and acquisition activity is heightening the importance of cultural analysis (both for due diligence and post-merger integration purposes). Culture is also an issue in large-scale outsourcing partnerships, which are becoming more prevalent, not to mention more strategically significant," Mark Clemente, president of consulting firm Clemente Communications Group, told CFOZone.
By actively managing corporate culture we can reduce the opportunism, cynicism and excesses that caused the financial disaster we are now suffering through, said Curtis Alva, corporate governance attorney at Gunster. Plus, by creating a risk-aware culture companies can more effectively manage risk throughout the organization.
What is culture exactly? It's a word that inspires many definitions. "It encompasses the tone at top, management philosophy, style, organizational structure, the history for dealing with issues. It drives an individual's and the organization's mindset, behavior and action," says Rick Steinberg, CEO of consulting firm Steinberg Governance Advisors. It is the company's values, and norms. In its simplest form, it is "how we do things around here."
"It is about the behavior that is rewarded and recognized, and the actions that are discouraged. Culture drives how a company does business and the way people behave in their everyday activities," explained Frank Strenk, senior vice president, risk management at insurance broker Lockton.
One of the most critical elements of effective risk management is organizational culture. If employees at all levels of a business are not encouraged to learn and question throughout their careers, the culture is not conducive to risk management. Other risks related to culture include: incentives that do not align with desired performance; decision-makers who are not held accountable for their actions; a short-term, rather than a long-term perspective; and devotion of risk management resources merely to comply with regulations, rather than establishing holistic, enterprise-wide risk management.
While some think corporate governance is all about more controls, it is also about culture, said Rostow Ravanan, chief financial officer of consulting firm MindTree. "In everything the company does, the company should ask whether it is doing the right thing. The most critical aspect of governance is ‘tone at the top'. Do leaders say the right things, mean what they say and do what they say? The best controls won't stop someone, especially someone at the top, who is motivated by the wrong things. Greater regulation will not bring about better governance. Just like you cannot mandate common sense, you cannot mandate good governance," added Ravanan.
Culture also affects the company's risk appetite. "Some companies are high-risk environments where it's okay to bet the ranch on certain initiatives. Other companies, while not necessarily risk averse, are okay with routine returns on capital and investors are satisfied with that too," said Steinberg.
For companies that have developed a superior risk management process, risk management becomes a natural act. "Companies with a strong risk management culture make decisions with risk as a factor in their decision-making process. They consider risks and balance that with appropriate steps to value and mitigate that risk," said Strenk.
The question then, is how to foster a risk management culture. "It starts at the top with full support from senior management. They must set the tone that risk management is a part of our corporate culture. In fact, some companies include risk management as a part of performance reviews for those risk owners," said Strenk.
Leaders need to reward the behaviors they want to replicate, punish the ones they want to eliminate and model the behaviors themselves, said Linda Henman, author of The Magnetic Boss. "Behavior first, beliefs after," she added.
Adaptability to the current economic environment is key. In boom times risk really does present significant opportunities and it is appropriate to empower "profit maximizers"--those who are focused on the bottom line. During a recession, conservation is in order with an emphasis on risk control, pointed out Bob Wolf, actuary and staff fellow in risk management at the Society of Actuaries.
Also essential to developing a risk management culture is that notion that it's okay to make a mistake. "Scary thought and one that seems to contradict the whole premise of risk management. If we're trying to manage risk, aren't mistakes bad? Simply put, human beings cannot learn without mistakes. If you don't allow mistakes, you don't allow for learning. In managing risk, mistakes must become learning opportunities," said Steve Balzac, president of consulting firm 7 Steps Ahead.
A leader's culture-related mandate, wrote Clemente in an article for IndustryWeek, is three-fold: assess current ways of doing business based on best-practices that are unique to the organization (assumptions and beliefs); objectively evaluate what may no longer be working in light of shifting external forces and internal operational realities (resource allocation issues); study and monitor how people interact with one another--in terms of communication and content, and channels--to ensure effective day-to-day problem-solving and continuous learning.
Lastly, he wrote, "It is essential to understand the criticality of culture. Addressing people management and process issues from a cultural perspective is crucial to help you succeed today and--just as important--to prepare for the strategic challenges of tomorrow."