2.1 Risk organizational culture

Risk management initiatives can promote employees’ sense of belonging to a group, as well as their own significance within the organization. (People can cooperate to set up a risk management system, an asset management, to define the cross-organizational measures, and so on.) Moreover, risk management provides a systematic standard mechanism of internal control, that obliges all staff to come together from different areas to discuss, and identify issues and solve problems. These activities also contribute to the quality of the working culture, and allow staff to feel valued and engaged in the process of achieving a broader organizational objective.

Human resources are recognized as one of the key elements for organizations’ successfulness[1] and some uncertainties which give rise to risks can actually come from the organization’s internal environment.[2] For example, the way in which top management reacts to the results of monitoring may affect the behaviour of employees; the organization should be quite clear about the uncertainty arising from reliance on a single individual to make a large modification to risk, and should properly reward efforts by individuals. When designing the framework, and implementing the risk management process, specific actions are needed in order to integrate such human and cultural factors.

Change, and cultural change in particular, is a weakness in risk management: the process is not the problem, but rather people’s perception of it. Two important lessons learned from implementing risk management are: embedding clear risk-based thinking at the highest level of the organization, while ensuring that it cascades down to lower management and employees; presenting the risk based thinking not as something totally new (to reduce resistance to it) and showing it as an important feature of any change process.

Job profiles (outlining role, performance expectations and development objectives), should be identified for staff responsible for risk management matters, and specific descriptions on particular issues should be included in the job profiles of the general risk manager and risk officers.

An organization should establish preventive human resource controls to reduce the likelihood and/or impact of adverse and critical events like noncompliance and misconduct[3]. Consequently, the organization should enhance and/or revise the prioritized risk matrix and, as needed, the risk optimization plan to reflect implemented human resource incentives, according to current residual risk analysis and performance against planned residual risk analysis.