How do you build a risk culture?
Have you ever noticed that risk management is almost always implemented once the risk or accident has occurred? Caught up in the hectic pace of daily life, we forget that risks are omnipresent and that it is essential to anticipate them in order to eliminate them, minimize them or better deal with them. It seems that it is only when we are facing a disaster like the 2008 financial crisis or Covid-19 that we react and try to put measures in place to save what can be saved.
Today, beyond risk management, it is becoming essential for companies to develop a risk culture to better anticipate potential problems and effectively manage all crises. Find out how to do it.
What is risk culture?
A distinction is made between risk culture and risk management.
- Risk culture is the knowledge by all company employees, regardless of their function, of the various existing risks and vulnerabilities of the company in order to enable them to acquire appropriate rules of behavior and reflexes in the event of disastrous events.
- Risk management consists of identifying, evaluating and prioritizing the risks that an organization may face in order to eliminate them or reduce their impact.
Risk culture takes into account the attitude of employees and their behaviors in the face of risks because attitudes shape behaviors, which themselves form the risk culture. These three elements need to be aligned.
Every employee, from the department manager to the operator to the project manager, must know the level of risk that the company is ready to take and must act accordingly by adopting appropriate behavior.
Developing a risk culture within your organization makes it possible to prevent all types of major events and to protect the company more effectively through adapted behaviors, and thus to improve risk management more generally.
The different types of risks
We cannot talk about risk culture without drawing up a non-exhaustive list of the various risks that an organization may face.
There are nine risk categories:
- economic and financial risks,
- environmental risks (natural disasters, pollution, waste treatment, etc.),
- health risks (for example, the Covid-19 crisis),
- security risks (burglary),
- the risks of cybercrime,
- competitive risks,
- technical risks (bad tools or bad machines),
- human risks (absenteeism, conflicts, lack of skills, etc.),
- legal risks (regulations, policies, legislation to be respected).
However, it is important to note that while most risks have a negative impact on projects and on the business in general, there are risks that have a positive impact. For example, your product is so popular that your website is collapsing due to too many orders. Your regular supplier is out of stock or bankrupt and you end up finding a new supplier that is cheaper and of better quality. And so on.
5 steps to build a risk culture
Building a risk culture within an organization is a major undertaking that must be undertaken by management and then spread to all levels.
Here are the different steps to follow.
1. Define the risk propensity of the business or project
You need to start by determining the level of risks the business is prepared to take. In English, this concept is called risk appetite, or the appetite for risk in French.
THEInstitute of Risk Management (IRM) defines risk appetite as “the quantity and type of risks that an organization is prepared to take in order to achieve its strategic goals.” This is the balance between the benefits reaped through risk-taking and the threats that this will cause.
Obviously, the level of risks accepted will depend on the sector, culture and goals of the company, and it may vary over time.
2. Implement risk management
Once you know what risks you are prepared to take, it is essential to implement risk management, which includes the following steps:
- Identifying risks : List all the potential threats that your project or business could face.
- Risk assessment and prioritization : Analyze the impact of each risk and the likelihood of it happening, then rank them by putting the most likely and most important risks first.
- Risk treatment : Do what is necessary to eliminate the risk, limit its impact, or, if possible, modify your project or certain business processes to avoid it.
- Follow-up and control : follow the evolution of risks and ensure that preventive measures are always appropriate.
- Capitalization and documentation : Remember what you have learned from this risk management to gain experience and document this new knowledge to share it and help employees who need it.
3. Organize workshops and training sessions
The best way to transmit a risk culture is to bring together all the company's employees (in small groups), and to organize brainstorming sessions to identify all potential risks as well as the different ways to remedy them. In this way, you involve your employees in the process and instill in them a way of thinking.
It is also important to train your employees on the various existing risks as well as on the attitudes and behaviors that must be adopted to react effectively. For example, train them on the risks of cybercrime and on the behaviors to follow when dealing with an email from an unknown sender.
4. Communicate risks openly
Risks and delicate situations that can turn into disaster scenarios should not remain secret. It is essential to be transparent and to communicate honestly and openly about the potential risks that the company may face. In this way, you ensure that everyone is well informed and prepared if a disaster occurs.
5. Rewarding good behavior
To be sure that the risk culture is well established, do not hesitate to recognize and reward your employees when they adopt the right behaviors in the face of risk.
Conclusion
To function and attract the support of employees, the risk culture must be supported and followed by management, which must lead by example. Real resources must also be put in place. Finally, you must strengthen the risk culture by communicating openly on the subject and by rewarding the good behaviors of your employees.
