A risk culture comparison between risk practitioners and business managers
Abstract
When external auditors identified a lack of buy-in into risk management in a telecommunications organisation and gave a ‘risk immature’ rating, it aligned with the perception of a poor risk culture. Risk culture relates to the understanding of risk management as well as the common goal or strategy everybody within an organisation supposedly strives towards, which is to mitigate the negative effects that events can have on reaching the objectives of the organisation. To investigate the reason for the risk-immature rating was the motivation for this study. An online survey was conducted on a population comprising risk practitioners and business managers at relatively junior levels in the organisation to establish the perceived risk culture, as well as to determine if there are possible factors contributing to the level of risk culture that existed. The survey consisted of statements about risk management and risk culture as well as questions measuring risk knowledge, understanding and application. The survey used Likert-type scales, and some free-format comments and recommendations. The main aim of the questionnaire was to assess how respondents view the levels of: i) integration of risk management into the management of the organisation; ii) risk management as an enabler for achieving the organisation’s objectives. The results were analysed using descriptive and inferential statistics. The risk culture maturity for both independent groups was high, but significant differences were observed for understanding of risk. Participants responded that in order to improve risk management in the organisation, the following needs to be addressed: responsibility and accountability; risk communication; risk training and awareness. The literature also supports risk awareness, understanding and communication as key success factors for an enhanced risk culture. The contribution of this research is that the survey was conducted in a large organisation at the junior work levels, not senior or executive management. The results highlighted that key success factors for a mature risk culture is not present at the junior levels. A total of 739 completed surveys were received. The survey also formed part of the Centre for Applied Risk Management’s pilot Risk Culture Questionnaire study.