風險文化：研究概述（英文版）

1

ThinkAhead

airm

Riskculture:Executivesummary

Firstofakind

ACCA,Airmic,andPRMIAhaveteameduptoexaminetherelationshipbetweenriskcultureandlongterm

performance.Aglobalsurvey,roundtablesandone-on-oneinterviewswereconductedtogaugehowmembersofourprofessionalbodiesareaddressingriskculture

attheirorganisations.Theonlinesurveyattracted1,823individualresponsesfromriskandfinancialprofessionalsaroundtheworldandacrossarangeofindustries.93%ofrespondentswereACCAmemberssothereforecomefromaccountancybackgrounds,givingtheresearch

auniquescopeandauthenticity.Thesurveywas

complementedbyanonlinecommunitypop-upplatformandinterviewsthatallowedusintheendtoreachover

2,000individuals.

Theresultsrevealedanoverconfidenceaboutthe

effectivenessofriskcultures,withamixofriskperceptionsandscepticismacrossdifferentrolesandhierarchies.

Interviewsalsoshowedhowriskandfinancialprofessionalsoftenstruggletogetthenecessarycommitmenttocreatetheriskculturesandgovernanceneededtofacilitatetheirstrategyandwhereriskmanagementfitsintoit.Thisis

duetothewarningsignsoffailureswaitingtohappen,butrespondentsrecognisethatastrongriskcultureisessentialtoavoidthem.

Whatisriskcultureandwhyisitimportant?

Riskcultureisbecomingincreasinglyrecognizedasameansoftacklingandpreventinggovernancefailures.TheBasel

CommitteeonBankingSupervisiondefinesriskcultureas

norms,attitudesandbehavioursrelatedtoriskawareness,

risk-takingandriskmanagement,andcontrolsthatshape

decisionsonrisks.Wefoundindividualvalues,beliefsand

attitudestowardsrisktobenaturallyinfluencedbythe

wideroverallcultureofanorganisation.

Riskcultureisdifficulttomeasureandinvolvesparticipation

upanddowntheorganisation.Moreregulatorsare

prioritisingriskcultureandaskingfirmstodemonstratehowtheymanagehumancapitaltoassessthebroaderculture,behavioursitbreeds,andrisksitmightdrive.Thisrequiresunderstandingthewidercontextofoverallworkplacecultureandavoidingnarrowingthefocustoconduct.Thebehaviour-changingdisruptionofrecentyearsalsoposesnewquestionsaboutwhatconstitutes‘riskybehaviour’andhowitspreads.

Thisreporthighlightsthebenefitsofgettingtheriskculturethatisrightforyourorganisation.Thisstartswithanew

generationofmanagementreportinginformation(MI)thatmanymembersofourthreeprofessionalbodieshaveyettograsp.Somebankshaveinvestedindevelopingthe

metrics,butwefoundmostriskandfinancialleadersare

stillstrugglingtouseitstrategically.

RISKCULTURE|EXECUTIVESUMMARY

2

Surveyrespondentsrankregulatorychangeandcybersecurityastopriskpriorities

Thesurveyfoundthatwhile‘boxtickingisprevalent,

thereisgrowinginterestinriskculturetocopewith

disconnectedorganisationalculturesandhard-to-detectbreadthofrisks.‘Regulatory,compliance,andlegal’riskswerethetoppriorityfororganisations,with‘technology,

data,cybersecurity’and‘regulatory,complianceandlegal’beinginthetopthreeforallsectorsexceptnot-for-profitandcharities(Figure1).Byregion,regulatory,complianceandlegalriskwasthetoporclosetothetop,withNorthAmericaranking‘technology,dataandcybersecurity’

significantlyhigherthantherest.Africanrespondentsweremorelikelytobeconcernedabout‘misconduct,fraud

andreputationaldamage’issues,somethingthatwasnotamajorconcernforthoseinWesternEurope.‘Economicinflationandrecession’toppedthelistofriskprioritiesforUKrespondents(Figure2).

Financialservicesweremorelikelytoraise‘technology,dataandcybersecurity’and‘regulatory,complianceand

legal’astheirhighestriskpriorities,while‘logisticsandsupplychain’issueswereoneofthecorporatesector’stopriskconcerns.Theoutliersbyageweretheover-65s,whoputeconomicconcernsasfirst,thencybersecurity,followedbytalentscarcity.

Ourresearchfoundthatriskcultureaffectsanorganisation’sabilitytodealwithconstantregulatoryimplementations.Throughourconversationswithrespondents,welearnedhow‘beingcompliant-styleofmanagement’hasbecomeacoredriverofcorporatestrategy,withtheRussianinvasionofUkraineandCovid-19nowonlypartofaperma-

crisisnorm.Climatechange,forexample,hasbecome

increasinglycompliance-intensiveandlessaboutrisk

strategy,havingcomesecondtolastoverallasapriority.Cyberriskisapriorityforeveryoneduetotheunavoidablethreatsandneedforsubjectmatterexpertise.Leaders

worryaboutretainingdatasecurityorITteamsduetooutdatededucationmodelsonriskgovernance.

FIGURE1:Topriskprioritiesbysector

Regulatory/compliance/legal

Technology/data/cybersecurityEconomicinflation/recession

Talentscarcity/skillsgaps/employeeretentionMisconduct/fraud/reputationaldamage

Internationalandgeopoliticalinstability

Logistics,includingsupplychain

ClimatechangeanditssocialandeconomicimplicationsCurrency,includingcryptoanddigitalassets

SECTOR

1stRANKED

2ndRANKED

3rdRANKED

Publicpractice

46%

44%

39%

Publicsector

41%

39%

38%

Financialservices

46%

36%

34%

Not-for-profit/charity

43%

40%

39%

Corporatesector

42%

40%

36%

Retired/betweenjobs*

43%

41%

38%

*Basedresponsesonpreviousplaceofwork

(Dataroundedtonearestwholenumber)

PLENTYOF‘BOXTICKING’ISPREVALENT,BUTTHEREIS

ALSOAGROWINGINTERESTINRISKCULTURETOCOPE

WITHDISCONNECTEDORGANISATIONALCULTURESANDHARD-TO-DETECTBREADTHOFRISKS.

26%

23%

21%

19%

19%

17%

24%

20%

28%

20%

18%

13%

15%

13%

16%

10%

19%

14%

13%

11%

11%

15%

14%

13%

15%

14%

5%.

4%

8%

.

.

.

16%

9%

8%

4%

8%

6%

5%

4%

2%

7%

5%

5%

2%

3%

RISKCULTURE|EXECUTIVESUMMARY

FIGURE2:Topriskprioritiesaroundtheworld

Regulatory/compliance/legal

Technology/data/cybersecurityEconomicinflation/recession

Talentscarcity/skillsgaps/employeeretentionMisconduct/fraud/reputationaldamage

Internationalandgeopoliticalinstability

Logistics,includingsupplychain

Climatechangeanditssocialandeconomicimplications

Currency,includingcryptoanddigitalassets

MiddleEastandSouthAsia

Africa

NorthAmerica

Caribbean

AsiaPaci?cminusChinaregions

WesternEurope,

Centraland

EasternEurope

MainlandChina,

HongKongSAR,

MacauSARand

Taiwanregion

28%

13%

15%

12%

12%

3%

4%

3%

5%

1%

4%

5%

3%

4%

4%

12%

8%

1%

2%

0%

(‘Don’tknows’remainthebalancingfigureforeachregion)

3

RISKCULTURE|EXECUTIVESUMMARY

4

57%ofrespondentssaythattheirculturehaschangedforthebettersincethepandemic

Whenweaskedaboutriskculture,mostrespondents,

irrespectiveofsectorororganisationalsizeeitheragreed,orneitheragreednordisagreed,thattheirorganisation’sriskculturehadimproved(Figure3).Respondentsin

Chinaweregenerallymuchmoreconfidentintheir

organisations’riskculturecomparedtoothercountries,

butinterestinglyranked‘regulatory,complianceandlegal’itstopriskpriority.Therealsowasapositivecorrelation

betweenthosestrongly‘a(chǎn)greeingthatriskcultureinformsstrategyanddetectsriskybehaviours’and‘havinga

positiveperceptionofaccountingprofessionalsbeingabletomeasurethehard-to-detectrisks’.

Overall,wefoundthatthereisawilltoimproveriskculture,butthepost-pandemicenvironmentischallengingdue

toscarceresources,risingcosts,andtheneedtoput

newtechnologiesintopractice.Internalauditmembers

discussedhowmodernisingandmorefrequentmonitoringwererequiredateventhemostprofitablefirmswith

matureriskframeworks.Organisationsarestrugglingwithbudgetingforthelongterm,especiallyastechnology

advancesrapidlyandeconomicconditionsbecome

increasinglyuncertain.Anoptimisticportrayalofrisk

culturewasmentioned,whichisbuilttotakeonrisksin

amoreinformedwayandwiththemostforward-thinkingfocuspossibleforgainingacompetitiveadvantage.ACFOinNorthAmericaarguedhowriskmanagementhasbeenadefensiveapproachfordecades,butthatthematerialityofrisktodayisforcingorganisationstoembeditinto

strategy,whichmanyorganisations,evenwithmatureriskframeworks,arefindingdifficultgiventheaccelerating

transformationsanddisruption.Wealsofoundthatitwasonlythoseresponsibleforriskwhohaveamorepositiveviewofhowriskcultureaffectsperformance.

Oneofthebestaspectsofoursurveyfindingsisthat

theyallowedustocompareresponsesacrossdifferent

teams,andtodigdeeperintospecificroles,suchas

chiefriskofficersandheadsofrisk.Mostorganisations

placedresponsibilityforriskwithspecificriskemployees,whileaminorityplaceditinthehandsofanon-executivedirectororotherfunction.HRwasseenasanessentialpartofaccountabilityforriskamongnon-riskfunctions.The

surveyalsofoundthatGenZsandGenYsyearnformoreinvolvementinriskconversations.Lackofriskawarenesswashighlightedasarisk,withriskgovernancelearningresourcesbecomingahigherpriorityacrossallsectors.

FIGURE3:Thepandemicgotmorethanhalfoftherespondents’organisationstorethinkriskculture

StronglydisagreeDisagreeNeitheragreenordisagreeAgreeStronglyagreeDon’tknoworN/APrefernottocomment

Sector:

4%

18%

5%

16%

5%

18%

8%

12%

4%

16%

4%

12%

12%

38%

39%

40%

45%

43%

28%

24%

23%

22%

24%

25%

25%

8%

12%

10%

6%

8%

15%

6%

4%

4%

3%

4%

4%

PublicpracticePublicsectorFinancialservicesNot-for-pro?t/charityCorporatesectorRetired/betweenjobs

SME:

Agree

37%

Neitheragreenordisagree

27%

Disagree

10%

Stronglyagree

13%

Strongly

disagree

5%

Don’tknoworN/A:6%Prefernottocomment:1%

(Dataroundedtonearestwholenumber)

Large:

Agree

42%

Neitheragreenordisagree

21%

Disagree

9%

Stronglyagree

19%

Strongly

disagree

3%

Don’tknoworN/A:4%Prefernottocomment:0%

RISKCULTURE|EXECUTIVESUMMARY

5

Procedurestodene

operationsofallfuctions*

includingrelatedriskappetiteranges,loors,ceilings,etc.

includingriskappetiteprocessandgoverance**

Howinternalauditevolveswithriskmanagementremainsabigquestion

Thesurveyexaminedtheeffectivenessofinternalauditorsandplanningprocesses.Onlytwo-thirdsagreedthat

internalauditcouldverifyinternalcontrolsforrisktaking,andone-fifthdisagreed,didn’tknow,orpreferrednottosay.Reactivecontrols,suchaspenaltiesformisconduct,

canbetestedandreportedbetter.Additionally,budget

allocationshouldbebasedonthenecessityofcontrols

andanunderstandingofhowtheywillchangetherisk.

Investmentintechnologywithoutappropriategovernance,forexample,carrieshugerisks.

ONLYTWO-THIRDSAGREEDTHATINTERNALAUDITCOULDVERIFYINTERNALCONTROLSFORRISK

TAKING,ANDONE-FIFTHDISAGREED,DIDN’TKNOW,ORPREFERREDNOTTOSAY.

FIGURE4:The‘ThreeLinesModel’andRiskAppetite

Firstline

Secondline

Thirdline

Documentedproceduresfor allfunctions

Real-timemonitoringandreporting:trackperformanceanddetectadversetrendsforeffectivedecision-making

MonitoringofKRIsandKPIs

Independentoversightbytopmanagementtoensurebothapplicationandgovernanceofriskappetitemeetexpectations

Managementreview

Independentauditensuringassessment

criteriaaddressriskappetiterequirementsacrossallfunctions

Auditcontrols

(internalandexternal)

*Makesurethereareno‘blackholes’or‘glassceilings’whereprocesscontrolsandriskappetiteparametersdonotreach.

Itmayprovedifficulttodefine,controlandsetmetricsforsomefunctionssuchasthosewithsensitiveinformation(finances,HR)

orcreativeprocesses(design,marketing),ormanagersmaytrytoavoidtheprocesscontrolsappliedinthecoreoperationsandservicedelivery.Thiswouldverylikelyhavedamagingknock-oneffects,includingavoidanceofmonitoring,auditandreportingformanagementoversight,soitisimportanttomapoutallfunctionsinyourorganisationasoneconnected

managementsystemtoensurenothinghasbeenmissed.

**Emphasisedheretospotlightriskappetite,butinpractice,itislikelytobebothpartofoperatingproceduresandcontrolsdefinedaroundriskmanagement/ERMoverviewitself.

Source:adaptedfromAirmic-ArthurD.Little-QBEEXPLAINEDGuide,RiskAppetite,2021

RISKCULTURE|EXECUTIVESUMMARY

Makingsenseoftheoverconfidenceaboutunderstandingriskappetite

Around80%oftherespondentssaidtheyhadagoodunderstandingofriskappetiteintheirorganisation,withtheunder-35sandthosenotexplicitlyinarole

relatedtoriskratingtheirunderstandinglowest.The80%contradictedwhatrespondentsrevealedintheroundtablesandonlinecommunitypop-upplatform.

Toputthatintocontext,agoodunderstandingofwhat

riskappetite‘issupposedtobe’doesnotnecessarily

meanthebehavioursandcultureinsideanorganisation

reflectthestatedappetiteforrisktaking.Cultureandriskappetitetoooftendivergeandworkagainsteachotherasseparateforces.

Forsome,theoverconfidenceseemstobearesultof

optingforseeminglysimplesolutionswhereinpractice

therearenone.Riskandfinancialprofessionalscanrely

toomuchonmakingsimpleimmediatejudgements

becausebeingdecisiveisabehaviourallseniorexecutivesliketodisplay.Welookedat‘slowerthinking’asthe

moreeffortfulthinkingrequiredtounderstandcomplexentities.Thisiswhatleadersineffectiveriskcultureswilldemonstrate–thatis,theywilladmit‘Idon’tknow’.

Riskcultureisimportantforbuildingresilienceandseizingopportunities.Itisaboutbothdiversityandcohesiveness,andthereisnosingletemplate.Gettingthatbalance

rightisintegraltohowanorganisationisgovernedand

howwellanorganisationcanachieveitsobjectives.Our

researchshowshowthereisnosinglerightorwrongriskculture.Wefoundthatriskcultureandhowitisframed

variesgreatlydependingonanorganisation’sindustry,

regulations,stakeholders,purposeandtolerancefor

risk.Structureswithinanysingleorganisationmightalso

constantlychangegiventhespeedofrisk.Communicationaboutriskappetiteshouldbecarefullyadjusted,therefore,toensurealignmentremains.Theconsensuswasthatriskappetitehasbecomemoretheoreticalthanpractical,andsomemaynottakeenoughriskduetofearofsomethinggoingwrong.

OURRESEARCHSHOWSHOW

THEREISNO

SINGLERIGHTORWRONG

RISKCULTURE.

‘Ariskappetitestatementcouldbesomethingbeautiful

andflowery,whateverthecasemaybe,butthere’snowaytomeasureitsinceitischangingallthetime.Ihaveseen

situationswherewe’renotactuallytakingenoughrisk,

becausepeoplewanttofollowtheirprocedures,andthey

don’twanttograbtheballandbethepersonwho’scalledoutifsomethinggoeswrong.Onanygivendaytheoverallpositionmightnotbeoutoflinewiththestatedappetite,butitmaybethatsomeoneisjustsoworriedaboutsomethinggoingwrong,thattheydon’twanttotakethechance.’

RiskmanageratabankinNorthAmerica

RISKCULTURE|EXECUTIVESUMMARY

7

Theinsidestoryofdebilitatingmisalignmentbetweencultureandorganisationalpurpose

Theconflictbetween‘Whatsomebodyhastoldus

wemustprioritise,i.e.,theboxneedingtobeticked’

and‘whatactuallyneedstobedonetoensureweare

compliant’isasignificantfactorrevealedbythesurveydata,whichshowsthatone-thirdofrespondentssaythatculture,strategyandpurposearenotaligned.

DonaldRumsfeld’sfamousquoteof‘Reportsthatsaythatsomethinghasn’thappenedarealwaysinterestingtome’

highlightstheshort-sightednessofrelyingonwhatyoucansee1.Therearedivergingdefinitionsofwhat‘risk’meansandhowpurposeisrelatedtoit,andindividuals

havedifferentperceptionsofwhereriskappetitefitsin.

Riskregistersandriskreportsarenotgoingtosolvetheseproblems,somisalignmentisnotsomethingonlyrisk

professionalscareabout.

Ourresearchfoundthatwhileriskleadersareworkingtoimprovecultureandalignitwithpurpose,organisationsthatfocusoncomplianceandprocessesarefallingdownthe

incompetenceslide.Agoodriskcultureisanorganisationalculturethatgivesstaffthecapacitytospotemergingrisksandactonthem,whileaweakriskcultureisdescribedas‘misaligned’,‘bureaucratic’and‘process-driven’.

THEVIEWOFMOSTRISKLEADERSINOURSURVEYWASCLEAR-CUT:IFACOMPANYHASASETOFETHICALVALUESASA

FOUNDATIONOFITSCULTUREANDTHESEAREALIGNEDWITHANEFFICIENTRISKFRAMEWORK,INTHEORY,COMPLIANCE

WITHREGULATIONSWOULDBEANATURALCONSEQUENCE.

Riskconversationsarehappeninginavacuumatthetop

Onlyaround60%ofrespondentsagreedthatrisksare

sufficientlydiscussedatalllevelsintheirorganisation

(Figure5).Ourdiscussionsabouttheresultspointedtothefactthatthisistheoppositeofwhatagoodriskcultureissupposedtodo.Wefoundhowdifferentfunctionsintheorganisationarespeakingdifferentlanguagesaboutrisk.

Overall,two-thirdsofrespondentsagreedthattheir

boardandseniormanagementhavethesameapproach.Buttherewerealotof‘I’veheardenoughabouttone

atthetop’commentsinourdiscussions,andmany

respondents,includingthoseinseniormanagement,

saidthatwiththechangesintheworkplaceandvirtual

boardmeetings‘tonefromthetop’isaclichethathaslostmeaning.Achiefriskofficerhelpedusunderstandanotherperspectivebehindthedata–exactlyhowpotentisthe

‘tonefromthetop’andshoulditalsobeassessedwhenwethinkaboutexpectationsofwhatariskculturecando?

‘‘Wecantalkabouttonefromthetopbutwhatabout

tonefromthemiddle?Youcan’tjusthaveyoursenior

management,theC-suiteandtheboardtalkingabouthowwe’vegotahealthyriskculture.Howdoyouconveythatandhowdoesitcascadetotherestofthestaff?’

ChiefriskofficerintheUK

Ouronlinecommunityplatformalsoprovidesinsights

aboutwhetherpeopleare‘onthesamepage’andhowincentivesfosterariskculturethatgivesorganisationsacompetitiveadvantage.Thedifficultquestionofhowyourewardsomeoneforcontributingtoa‘goodculture’washighlightedindiscussions.

FIGURE5:Only60%ofriskandfinancialprofessionalsbelieveriskissufficientlydiscussed

61%

CHIEFRISKOFFICER

62%

HEADOFRISK

60%

OTHERROLE

RELATEDTORISK

54%

NOTINAROLE

RELATEDTORISK

1<

/About/Biographies/Biography/Article/602800/

>

RISKCULTURE|EXECUTIVESUMMARY

8

Howwelldoesriskculturedetectmisconduct?

RespondentsfrommainlandChinaweregenerallymoreconfidentintheirorganisations’riskculturecomparedtoothercountries,whilethepublicsectorplaced

‘misconduct,fraudandreputationaldamage’higherthanallothersectorsasariskpriority.Thecorporatesector

placed‘misconduct,fraudandreputationaldamage’significantlylowerthanothers,raisingconcernsaboutpossibledisconnectionsbetweenthemanagersor

guardiansofwhistleblowingchannelsandtherisk

leaders,especiallygiventhescaleofscandalsoverthepastyearalone.2

Thedataonaregionalandcountrylevelforawarenessofwrongdoingandresolutionprovidesinterestingfoodforthought.Forexample,Africarankshighestforstating

‘Iamawareofwrongdoingthathasbeeninvestigated,butnotresolved’andChinahighestforstating‘Iam

awareofawrongdoingthathasnotbeeninvestigated’.Wealsoaskedspecificallyabout‘comfortwithusingawhistleblowingplatform’notjustwhetherrespondentswereawareofawrongdoing,andifsowhetherithadbeeninvestigatedandresolved.TheCaribbeanscoredlowesthere.

Respondentspointedoutthatevenaperceptionof

being‘safe’wouldnotbeenoughtoincreasecomfort

levelsinwhistleblowingplatforms.Inotherwords,how

doorganisationsensuresomeonecanbenefitfordoingtherightthing?Thecommonthemeinouranalysisisthatbeingsafeisnotabenefit,it’sabasicright.

‘SENIORLEADERSMUSTFINDAWAYTOMAKEJUNIORPEOPLEFEEL“SAFE”WHENCOMMUNICATINGWHAT

MAYBEPERCEIVEDAS“BADNEWS”.’

Whistleblowingdoesnotpreventfraud

Ourresearchrevealsseverallimitationswith

whistleblowingforthebroaderquestionofcombatingmisconductthattranscendregionalboundaries.

Unfortunately,theoutcomesforwhistleblowersareoftenunhappyonesandtheirexperiencesmoreregretful

thanrewarding.Whistleblowingasaconceptisquitereactiveanddoesn’tnecessarilystopsomeonefrom

beingtemptedtocarryoutfraudorothermisconduct.

‘Wemustsomehowemphasisehowvitaltrustis.The

threelinesofdefence–nowthethreelines–donotworkifthoseonthedifferentlinesdonottrustoneanother.

Teamsunderperformwhenthereisadearthoftrust

amongmembers.Thisistrueinanyindustryandit’snotsomethingeventheregulatorstrulyappreciate.Atpresent,theclosestproxyisafocusonpsychologicalsafetyand

whetheranorganisationpromotes,orfailstopromote,a“speak-up”culture.’

Specialinterestgroupmember

Ourresearchdelvesintotheidiosyncraticissuesinherentinspecificindustriesratherthangeneralsectorialtrends,forinstance,inhealthcareandaviation,andwhatdrives

behavioursinthem,giventhenatureofthebusiness.

Ofcourse,airlinesaregenerallysuccessfulatmakingsurewhathappensintheskyissafe,butthesecompanieshaveotherchallengesonthegroundthatwereheightened

duringthepandemic,forexample,da