Enterprise-wide risk management requires a shift in the behavior and mindset of employees across an organization. To realize the full benefits of improved systems, tools, and analytical skills, people need to learn new ways of perceiving situations, interpreting data, making decisions, influencing, and negotiating. This article explains ways in which targeted learning and development interventions can help banks evolve their culture to support their overall risk management strategy.
Ambitious risk management transformation initiatives often fail because banks do not change their culture
Banks want to better understand their current culture and engage in surveys that typically assess tangible products of the culture (e.g., risk appetite statements, mission statements, values, etc.). More than 85% of North American banks have engaged in this type of survey, and a similar number in Latin America have as well. In Europe and Asia-Pacific, 60% or more of banks have programs to assess internal risk culture.1 Assessing culture at this level, however, does not address the beliefs and behaviors that constitute the culture, which are harder to change. Banks need to go beyond the level of artifacts of the culture and assess motivation, skills, and attitudes.
When adopting a broad-based risk management transformation, banks also need a practical framework for evolving the culture. One of the most prominent writers on organizational culture, Edgar Schein, defines it as:
"A pattern of shared basic assumptions learned by a group as it solved its problems of external adaption and internal integration, which has worked well enough to be considered valid, and, therefore, to be taught to new members as the correct way to perceive, think, and feel in relation to those problems."2
This definition can be applied to the way in which risk management perceptions can entrench themselves in organizations. In moving toward a more comprehensive and integrated risk management framework, organizations must overcome ingrained ways of working, beliefs, and attitudes. A process of "unfreezing" these behaviors must take place before it is possible to effect cultural change.
Diagnosing problematic areas
Individuals within an organization must unlearn existing habits before they can embed new ones. One of the reasons that implementing an integrated approach to risk management is difficult is that it challenges the definition of being a "professional" and the identity of belonging to certain groups within an organization.3 For example, establishing a belief that "risk is everyone’s responsibility" in an organization where there has traditionally been a strong divide between the control and commercial teams requires people to adapt to a new set of objectives that had not previously been a priority.
Without a climate of both real and perceived safety sufficient for people to open up and explore the barriers to change that exist at a personal or emotional level, the desired cultural evolution may not occur. For learning and development (L&D) and organizational development (OD) professionals in the financial services industry, this presents one of the greatest – but also exciting – challenges.
Developing a plan to build risk culture
For most financial institutions, the logical place to start building a risk culture is with their policies and procedures. For example, they could review (or create) a risk appetite framework, set approval limits, establish their delegation authority, etc. During this phase, issues of poor quality data or the inability to aggregate and report on it efficiently are recognized, creating an urgent need to quickly upgrade systems.
Building the desired culture, however, requires further work that focuses on the competence and attitude of people and the leadership within an organization. Learning is central to this change. In a recent survey by the Institute of Risk Management, "Risk Competence" was ranked among the weakest aspects of risk culture in organizations.4
Training programs for new systems and policies are more straightforward than the training required for cultural shifts. Many banks recognize the need to upgrade the skills and knowledge of their people to match the sophistication of their new systems. There is a gap, however, between what people know should be done versus their motivation to spend time, energy, and money on it.
In a recent survey, 59% of respondents stated that improving their general knowledge of the industry would be the most helpful way of improving the resilience of their firm. Yet, of these same respondents, 66% stated that their priority learning objective for personal performance improvement was to increase their knowledge of issues directly relevant to their own role.5 There is a way forward if education about the wider industry is linked to career progression – 41% responded that improving their knowledge of issues concerning other functions within the firm, and 37% stated that improving their knowledge of the industry as a whole, is most important for their career development within the financial services industry.
Examining culture at three levels
Successful banks begin by understanding their existing culture and what elements of it must shift in order to accommodate the desired transformation. Culture can be examined at three levels: Artifacts, Espoused Values, and Underlying Assumptions (see Figure 1).
Many investigations into bank failures and crises revealed individuals who had a strong sense that something was wrong. Yet, despite their personal efforts to highlight the warning signs and the power of the control functions they represented, they were unable to prevent the unfolding crisis. One of the most common needs expressed by banks is to strengthen the way their people "challenge the business."
Applied to the risk management functions of a bank, the following are typical examples of these levels of culture:
- Risk policy, risk appetite framework, approval limits and processes, organizational structure, systems, templates/forms, physical layout, and geographic diversity
- Observable behavior of employees (e.g., communications, committee membership, meeting attendance, tenure, and attrition)
- Published statements of corporate values, corporate and departmental mission statements, departmental goals, competency frameworks, and performance and selection criteria
- Revealed in day-to-day attitudes and choices expressed through situational behavior. For example:
- Overruling decisions according to risk policy
- Challenging business lines and senior decision makers
- Influencing and persuading decision makers outside of the formal approval process
- Promoting or retaining individuals whose behavior flouts corporate values, but whose technical capabilities or revenue-earning record are deemed to be of greater importance
- Standing by while colleagues flout rules (e.g., as reported in the Libor rate submissions investigation)
- Investing in technology to aggregate data, but not the skills to interpret the output
Figure 1 The three levels of examining culture [Source: Moody's Analytics]
L&D plays a key role in diagnosing and fixing cultural impediments
Cultural impediments to training on new policies can be seen even at the design stage of a training program. On one hand, an organization states that they need to improve credit skills. On the other hand, they are reluctant to have senior people take diagnostic tests or put them through training programs that appear too basic. The Underlying Assumption revealed in this type of comment is that it is more important to save face and defer to senior titleholders than to ensure that everyone has the requisite level of credit skills.
To change the culture, financial institutions need to develop meta-cognitive abilities – such as reflection, critical thinking, and conscious awareness of the thought process – which is different from the expert-learner paradigm dominant in technical training. They need to develop people who can recognize and address difficult, uncomfortable, or intangible issues arising during their daily work. Many investigations into bank failures and crises revealed individuals who had a strong sense that something was wrong. Yet, despite their personal efforts to highlight the warning signs and the power of the control functions they represented, they were unable to prevent the unfolding crisis. One of the most common needs expressed by our banking clients is to strengthen the way their people "challenge the business."
Training that is implemented in support of evolving a risk culture must be integrated and designed to give people the awareness and ability to acknowledge, act, and discuss the "un-discussables." When a critical mass of people have developed this, new norms emerge.
A secondary objective for many banks is to enable people to communicate and share the desired culture with colleagues. This does not mean being able to reel off a statement or a set of values. Communicating the culture is about everything people do and say that aligns or undermines the culture banks are trying to create.
This is where the assumptions underpinning the culture, versus personal assumptions, come into play. For example, this could include what people pay attention to, what questions they ask, what stories they tell/repeat, and what emotions are attached to those stories (e.g., admiration, disbelief, anger, disappointment, etc.). Storytelling can be a powerful means to reveal these assumptions and challenge them.
L&D and OD play an important role in moving the organization toward integrated risk management. They can help implement new learning methodologies and training designs and align the other parts of the organizational system – such as performance management, reward, selection, and talent management – with the desired culture.
Achieving cultural change
For risk culture transformation to be effective, the following must all be considered when implementing training interventions:
- Understand the bank’s desired culture.
- Diagnose the existing culture and identify issues requiring change, using a tool such as Credit Pulse that measures motivation and ability.
- Develop a transformation plan that takes account of the values, mindset, and behaviors required, in addition to the Artifacts and Espoused Values.
- Design targeted interventions that:
- Break traditional learning silos.
- Combine knowledge of risk taxonomy with an understanding of cognitive and social influences on decision-making.
- Ensure that employees are trained to interpret and use the output from new risk measurement technology, as well as in the system itself.
- Build abilities, such as reflection, critical thinking, and conscious awareness of the thought process.
- Enable credit officers and client relationship managers to attend training together and support managers to reduce the cultural antagonism created by using "them" and "us" language.
- Develop people who recognize and address difficult, uncomfortable, or intangible issues arising during their daily work and foster the willingness and ability to challenge others in the business.
- Enable change by involving people at all levels. For example, senior managers should attend training programs that their staff attends to improve communication and (peer) interaction and show leadership by agreeing to take the same diagnostic tests as their staff to establish existing competencies.
- Evaluate progress – both quantitatively (e.g., through metrics and surveys) and qualitatively (e.g., through focus groups).
A CASE STUDY
One client – a large regional bank in Southeast Asia – wanted to create a highly effective training solution for their credit and relationship officers in the commercial and credit area. At the outset, a diagnostic survey, using Moody’s Analytics Credit Pulse, identified barriers to effective employee or organizational performance and any potential impediments to a successful implementation of the program.6
Three main findings were uncovered that helped to identify the culture of the bank. First, compared to other similar banks, the institution’s employees appeared more motivated to carry out their work, especially in the areas of financial risk assessment, knowledge of and assistance to their clients, and the ability to find products and services that could help them. Second, the frontline employees surveyed had a relatively strong distaste for managing their portfolios of existing loans. This finding was especially troubling as the bank’s strategic objective was to accelerate loan growth.
Third, the greatest concerns of respondents involved organization-level support. Overall, bank policies, procedures, organizational structure, and especially computer and software-related tools were seen as inefficient and unhelpful to business growth efforts. Further, frontline employees reported a pervasive feeling that the bank’s credit executives were distant and not in touch with the realities and needs they confronted on a daily basis. This finding led the bank management to spend significant time discussing what might reasonably be done to effect change.
The results suggested several implications for a successful implementation of a training program. First, the bank’s employees appeared to care enough to be receptive to and use additional inputs and tools to enhance performance. Additionally, because of the level of agreement and support at the small group level, it appeared that new initiatives – if properly communicated and implemented – stood a good chance of being widely adopted. Adoption was critical, as it is common for initiatives at institutions to be sabotaged at the team level by peers and supervisors who are unreceptive to change and refuse to implement a bank’s new direction.
The survey results, combined with a credit skills diagnostic designed to evaluate specific employee skill sets in detail, indicated that job performance was uneven, as purported by upper management. A tailored credit and risk training program geared to develop skills to meet specific job requirements was created. In order for the program to be successful, however, senior management had to be engaged.
In this institution in particular, senior executives had to overcome the perceived distance between the leadership and the frontline staff. The management team began a campaign to demonstrate they understood the employee needs, as well as provide timely and explicit messaging surrounding the upcoming training. Additionally, they worked extensively with supervisors at all levels to understand the changes that would come about from both the training and management’s increased attentiveness.
As a result, the program was able to achieve broad adoption and create greater connectedness throughout the credit organization. Management committed to upgrade supporting systems and improve loan and portfolio management policies and processes. And finally, the cultural change was supported by a concerted effort on the part of management to ensure its goals and key points were communicated, understood, and committed to by the employees.
Sarah Tennyson, Senior Director, Global Head of Faculty – Financial Services Training, Moody's Analytics. Sarah is a recognized expert in transforming individual, team, and organizational performance. She combines elements of business psychology, behavioral sciences, and organizational dynamics to bring about a meaningful shift in people’s motivation and actions. She is a sought-after trainer, consultant, speaker, and author in this mission-critical field.
1 EY and IIF, Remaking Financial Services: Risk Management Five Years After the Crisis, 2013.
2 Edgar Schein, Organizational Culture and Leadership, page 17, John Wiley & Sons, Inc., 2010.
4 Institute of Risk Management, Risk Culture Resources for Practitioners, October 2012.
5 The Economist Intelligence Unit, A Crisis of Culture: Valuing Ethics and Knowledge in Financial Services, 2013.
6 Credit Pulse is a multidimensional diagnostic survey process that identifies the skill development, social, and organizational factors needed to create a profitable lending environment. It addresses individual employee skill sets and motivations, as well as social and organizational motives and abilities.
[Source: Published in Moody's Analytics Risk Perspectives: Integrated Risk Management - Volume IV | November 2014, www.moodysanalytics.com]