Gallup’s State of the Global Workplace: 2022 Report found that only 21% of employees are engaged at work and 44% of employees experienced a lot of stress on the previous day – both findings are up 1% from 2021.
In one of the largest studies of burnout, Gallup found the biggest source was “unfair treatment at work.” That was followed by an unmanageable workload, unclear communication from managers, lack of manager support and unreasonable time pressure.
Disengagement and stress in workplaces are good indicators of an organisation’s workplace climate. They can also provide insights into potential issues with the organisation’s culture.
Organisational culture
Organisational culture influences everything that is done in an organisation. It influences how risk is defined and understood.
The perception of the executives and leaders of an organisation has a profound impact on what part risks play in the organisation and its strategy. Attitude towards change may increase certain risks and make management of others easier. Both stability and flexibility have their pros and cons from a risk management perspective.
Power, responsibility, and trust are key cultural topics that are strongly related to risk management. Decisions about whose responsibility is to identify and assess risks and who uses risk information have a profound impact on how risks are seen and managed in organisations.
Distribution of power, responsibility, and trust affects how risks are owned, how people commit to risk management and how risk or loss aversive people are.
Trust is needed if organisational members feel able or comfortable to approach the risk management function to discuss potential problems and issues that might draw attention to their risk management practice.
Organisational culture dictates how risks appear in organisational language and communications, how they are discussed and how they are communicated internally and externally.
Risk culture
Many discussions and literature have centred on the need for a ‘risk culture’, a ‘customer service culture’ or even an ‘innovation culture’. This misunderstanding can lead to the thinking that there is more than one culture in an organisation.
In reality, organisations only have one culture for achieving organisational success and excellence. There will be separate outcomes generated from that single culture. One such business outcome arising from the organisational culture is ‘risk culture’.
Attempting to specifically create different organisational cultures for different business outcomes would only lead to confusion and misalignment. There will be various initiatives competing for people’s attention. This will lead to a lack of focus and alignment on the core of how to build a strong, resilient culture that will help the organisation grow and achieve all of its goals.
Focus on building only one organisational culture with many business outcomes – that includes risk, improvement, innovation, and so forth. These business outcomes will flow naturally from that one organisational culture.
Organisational culture is not a subset of ‘risk culture’. Nor ‘risk culture’ is a subset of organisational culture. Rather, ‘risk culture’ is an outcome of organisational culture.
More precisely, the organisation’s level of risk maturity is an outcome of organisational culture.
The kind of culture an organisation has will influence how they approach and practise risk management as well as how effective their risk strategies are.
Culture v Climate
There is also a misunderstanding of what organisational climate is and how it relates to organisational culture. Culture and climate are not the same.
Culture tells you why your organisation is functioning that way (i.e., cause) and climate tells you how you are functioning as an organisation (i.e., effect). Both culture and climate are required to tell a complete picture of why and how your organisation is going to succeed or fail.
Organisational culture can influence how people believe they are expected to behave when doing their jobs and dealing with each other. It influences organisational climate, which is made up of two separate but interrelated elements:
- Perceptions – What and how people think they see going on in the organisation. This includes teamwork, influence, clarity of purpose, perceptions of fairness and equity, diversity management, etc.
- Feelings – How people feel about what they think and see about it in their workplace, organisation, managers, and jobs. Feelings are shaped by what people see and think or attitudes that are influenced by perceptions. This includes employee engagement, satisfaction, and other individual-level outcomes of the effects of culture.
At the core, culture is formed by behaviours, which in turn are shaped by attitudes (including feelings and perceptions). The formed culture, in turn, influences current and future attitudes and behaviours. This set of cyclic inter-dependencies between attitudes, behaviours and culture allows the development of self-reinforcing loops.
Employee engagement is not culture
This is why employee engagement, which relates to organisational climate, is not the same as organisational culture.
It is possible to have an organisation with a very high employee engagement and a destructive culture. People loved working for Enron because it was outstandingly successful. The high level of employee engagement and the media’s love affair with its success masked a severely dysfunctional aggressive organisational culture that pursued profits at any cost, disregarding long-term consequences.
However, Gallup’s findings of increased disengaged employees only strengthen the view that higher employee disengagement is most likely caused by poor organisational culture.
Poor organisational culture inhibits effective risk management
Poor organisational culture, in turn, can inhibit effective risk management. It can demonstrate some of these defensive behavioural norms:
- Accountabilities and ownership are blurred, ambiguous or applied inconsistently.
- Communication is filtered and sketchy.
- Ad-hoc information is provided.
- Avoid conflict and keep relationships superficially pleasant.
- Be liked by others.
- Gain approval and support before deciding and acting.
- Follow rules, conform and don’t ‘rock the boat’.
- Make a good impression.
- Lack of initiative and slow action on issues that are identified.
- Covering up mistakes so as not to experience negative consequences through being blamed.
- Follow policies and procedures.
- Make popular rather than necessary decisions.
- Please those in positions of authority.
- Ask everyone what they think before acting.
- Avoid blame and shift responsibilities to others.
- Push decisions upwards.
- Take fewer chances.
- Lay low when things get tough.
- Gain influence by being critical and opposing the ideas of others.
- Find fault and focus on why ideas won’t work.
- Take charge and be controlling.
- Act forceful and tough.
- Play politics to gain influence.
- Compete rather than cooperate.
- Turn the job into a contest and out-perform peers.
- Avoid all mistakes.
- Work long hard hours.
- Do things perfectly, potentially missing deadlines.
- Making snap decisions without considering alternative solutions or all the facts before thinking through.
- Being set in thinking and not open to others’ influence.
- Being critical and wanting to maintain superiority (point scoring).
- Over-working a problem rather than dealing with it.
- Reactive damage control is a core strategy.
- Focus on short-term results.
- Trading off longer-term needs in favour of being seen to comply in the moment.
- “Getting through” the moment.
Organisations with defensive behavioural norms can experience a situation where risk is being managed more reactively from a compliance perspective, especially through formal risk management mechanisms.
Controlling ‘risk culture’
Defensive behavioural norms tend to lead to the creation of a controlling ‘risk culture’. It encompasses the attributes of formality, conformity, and dependability. This type of ‘risk culture’ may encourage organisational members to make decisions that support safe courses of action. Information may not be shared quickly or easily.
This outcome may result in organisational members behaving in ways that conform to accountability and consistency while depriving them of decision-making opportunities. They are expected to follow defined processes and rules rather than use their judgement in decision-making. This may hinder responsible risk-taking or trying innovative approaches to managing risk, resulting in a culture of risk aversion, and possibly blaming others if it does not go to plan.
Unfortunately, many organisations use risk management as a box-ticking compliance exercise to develop a controlling ‘risk culture’. Characteristics of the controlling environment may help protect organisations from making reckless, excessively risky decisions, and enable them to develop coordination and stability.
A controlling ‘risk culture’ that is built on defensive behavioural norms can only propel the organisation into risk aversion.
Behavioural norms that influence risk management outcomes
Organisational cultures can either enable or inhibit effective risk management through either constructive or defensive behavioural norms respectively.
When there is constructive organisational culture, people want to, rather than have to, manage risks and do good risk management. And when there is a defensive organisational culture, people avoid doing good risk management and only do risk management when they have to or are being forced, either by management or regulators, merely as a tick-the-box compliance exercise.
An organisational culture that enables effective risk management is built on some of these constructive behavioural norms:
- Being clear about what’s expected and have clear examples of what they should be aiming for.
- Being clear realistic and challenging goals and objectives.
- Communication is comprehensive and regular.
- Communication is transparent, clear and an environment of honesty.
- Solving problems effectively.
- Strive for performance and customer excellence.
- Enjoyment from work.
- Produce high-quality products and services.
- Continuously learn, grow, and take on new and interesting work.
- Supportive of each other.
- Encourage others to learn, grow and perform their best at work.
- Help others think and decide for themselves.
- Being constructive and open to influence in dealing with others.
- Build strong relationships.
- Being friendly, approachable, trustworthy, and collaborative.
- Planning and thinking ahead are emphasised as are exploring options and opportunities.
- Encouraged to take moderate or calculated risks where it is well researched and thought out and serves the outcomes sought.
- Problem-solving involves all stakeholders so that issues can be anticipated, and contingencies provided.
- Calling out potential problems and barriers is encouraged so that mistakes are not covered up.
- Proactive prevention is a core strategy.
- Focus on continuous improvement. Forward-thinking, planning, exploring alternatives.
- Always challenging existing assumptions and forecasts – internally and externally.
- Aware of the cognitive bias to accept information that confirms.
- Communicates all aspects of risk-balanced and ethical decision-making regularly and relentlessly.
- Continually refines all risk management processes.
- Avoids leadership ‘kow-tow’ and sloppy group think.
- Encourages risk-taking, knowing that sometimes it will go wrong and may cost money.
- Has a continuous learning attitude.
Therefore, organisations can develop cultures that enable effective risk management through constructive and collaborative behavioural norms. Organisations with constructive behavioural norms can experience a situation where risk is being managed more proactively, especially through informal risk management mechanisms.
Collaborative ‘risk culture’
Constructive behavioural norms tend to lead to the creation of a collaborative ‘risk culture’. It focuses on participation, interaction, social networks, and teamwork in identifying and managing risks. This type of ‘risk culture’ values the sharing of risk information and collaborating on tasks, especially risk management activities.
Risks, issues and near misses are openly discussed among members of the organisation. Meetings about risk and performance are participative, supportive, and interactive.
Stressful workplaces are signs of organisational problems
An organisation is a system with sub-systems. It has a marketing subsystem, sales subsystem, production subsystem, etc.
When there is change, the subsystems do not change at the same speed. Marketing changes relatively fast. Production takes longer.
People are the most difficult to change.
When subsystems do not change at the same speed, cracks develop in the system and the system gets disintegrated.
This disintegration is manifested as ‘problems’ – production has a problem matching sales; sales have a problem matching marketing, etc.
The faster the change, the faster the disintegration. When problems appear as the result of disintegration, they cause stress for organisational members, which is what Gallup found.
You have to solve these problems to keep the organisation from disintegrating and potentially dying. You have to decide what to do. This causes stress for you – Should I take the risk or not take the risk?
Change can only increase your rate of stress exponentially. The level of stress reflects the rate of change the organisation faces and the disintegration that is manifested from the change.
Reduce the stress and conflicts in the workplace by aligning the subsystems so they don’t outpace each other. Slow down and align them together. The whole idea is to advance together.
Therefore, the secret to reducing stress is alignment – it is about aligning your needs and interest; managing your time; and managing your priorities correctly.
Professional bio
As a Chartered Accountant with over 25 years of international risk management and corporate governance experience in the private, not-for-profit, and public sectors, Patrick helps individuals and organizations make better decisions to achieve better results as a corporate and personal trainer and coach at Practicalrisktraining.com.
Given that improving risk culture and maturity has become a top of mind for many executives and risk professionals, he has conducted in-depth research into the topic and written several articles, which can be found at https://practicalrisktraining.com/risk-culture.
Patrick has authored several eBooks including Strategic Risk Management Reimagined: How to Improve Performance and Strategy Execution.