Assessing Risk Culture

Why Assessing Risk Culture Matters
Risk culture is the set of shared values, beliefs, attitudes, and behaviours that shape how people within an organisation identify, understand, discuss, and act on risk. Formal frameworks, policies, and controls are only as effective as the culture that surrounds them. History offers repeated lessons: organisations with sophisticated risk functions have still failed because the lived culture tolerated excessive risk-taking, discouraged escalation of bad news, or rewarded short-term results over sustainable performance. For the Certification in Risk Management Assurance (CRMA), understanding how to assess risk culture is central because internal auditors are increasingly expected to provide assurance not only on what the organisation says about risk but on how it actually behaves.

What Is Risk Culture?
Risk culture sits at the intersection of organisational culture and risk management. It is reflected in:
• Tone at the top – how the board and senior leaders talk about, model, and prioritise risk.
• Tone in the middle – whether managers reinforce or dilute leadership messages in day-to-day decisions.
• Accountability – clarity of risk ownership and whether people are held responsible for outcomes.
• Communication and challenge – the extent to which staff feel safe raising concerns, questioning decisions, and reporting incidents or near misses.
• Incentives – whether reward, promotion, and performance systems encourage behaviour consistent with the stated risk appetite.
• Competence and awareness – whether people understand the risks relevant to their roles and have the skills to manage them.
• Risk appetite alignment – whether actual decisions reflect the risk appetite and tolerance approved by the board.
The Institute of Internal Auditors, COSO ERM, ISO 31000, and the Financial Stability Board all highlight culture as a foundation of effective risk governance. COSO ERM 2017 in particular places Governance and Culture as the first of its five components, making it explicit that culture underpins everything else.

How Assessing Risk Culture Works
Because culture is intangible, it cannot be audited by simply ticking a checklist. Assessment relies on gathering evidence from multiple sources and triangulating it to form a view. Common approaches include:

1. Define the target culture. Start from the organisation's stated values, code of conduct, risk appetite statement, and risk policies. These articulate the espoused culture against which actual behaviour is compared.

2. Gather qualitative and quantitative evidence.
• Employee surveys and pulse checks on risk awareness, psychological safety, and perceptions of leadership.
• Interviews and focus groups across levels and functions.
• Direct observation of meetings, decision-making forums, and risk committee discussions.
• Review of documents: board minutes, risk reports, incident logs, whistleblowing records, audit findings, and remediation tracking.
• Analysis of indicators such as repeat findings, overdue actions, policy breaches, exceptions granted, turnover in control functions, and speed of issue escalation.
• Review of remuneration and performance frameworks to test whether incentives align with risk appetite.

3. Use a framework or maturity model. Assessors often map evidence against dimensions such as leadership, accountability, communication, challenge, incentives, and competence, rating each on a maturity scale (for example, from ad hoc to optimised). This structures what would otherwise be subjective judgement.

4. Identify gaps between espoused and actual culture. The most valuable insights come from contradictions – for example, leaders who speak of transparency while staff report fear of raising concerns, or a conservative risk appetite statement alongside bonus schemes that reward aggressive sales.

5. Report and recommend. Findings should be communicated carefully, focusing on behaviours and root causes rather than blaming individuals, and should be reported to the audit committee or board because culture is a governance responsibility.

Internal Audit's Role
Internal audit, as the third line, provides independent assurance on the effectiveness of risk governance, including culture. The CRMA syllabus expects candidates to understand that internal audit can:
• Incorporate cultural indicators into every engagement (root-cause analysis of findings often reveals cultural drivers).
• Conduct stand-alone culture audits or thematic reviews.
• Assess whether the first line (management) and second line (risk and compliance functions) actively promote and monitor culture.
• Advise on culture-related improvements while safeguarding independence – internal audit should not own or design the culture itself.
• Remain objective and avoid being influenced by the very culture it is assessing.

Common Red Flags of a Weak Risk Culture
• Repeated audit findings that are not remediated.
• Low whistleblowing volumes combined with high incident rates (suggesting under-reporting).
• Risk reports that are consistently "green" despite known problems.
• Dominant leaders who override controls or discourage challenge.
• Incentive schemes tied solely to financial targets.
• High turnover or marginalisation of risk, compliance, or audit staff.
• Decisions routinely made outside documented governance forums.

Exam Tips: Answering Questions on Assessing Risk Culture

Tip 1 – Recognise that culture is about behaviour, not documents. If a question offers a choice between reviewing a policy and observing how decisions are actually made, the stronger evidence of culture is usually the observed behaviour. Policies show espoused culture; behaviours show actual culture.

Tip 2 – Triangulate. The best answer typically involves combining multiple sources of evidence (surveys, interviews, data, observation) rather than relying on a single technique. Be suspicious of options suggesting one method alone is sufficient.

Tip 3 – Tone at the top is the anchor. When asked where to start or what has the most influence on risk culture, leadership and board behaviour is almost always the correct emphasis. Remember also tone in the middle as the mechanism that transmits or distorts leadership messages.

Tip 4 – Link incentives to behaviour. Scenario questions frequently describe a bonus or performance scheme. Ask yourself whether it rewards behaviour consistent with the risk appetite. Misaligned incentives are a classic root cause of poor risk culture.

Tip 5 – Watch for the espoused-versus-actual gap. Many questions present a contradiction (e.g., a values statement promoting openness while staff fear retaliation). The correct response usually involves identifying and reporting this gap as the key finding.

Tip 6 – Protect independence and objectivity. Internal audit assesses and advises on culture but does not design, own, or enforce it. Options that have internal audit taking management responsibility for culture are incorrect. Also remember that auditors must stay alert to being captured by the culture they are assessing.

Tip 7 – Report to the right level. Culture is a governance matter. Results of a risk culture assessment should be communicated to senior management and the board or audit committee, not just to operational managers.

Tip 8 – Use root-cause thinking. When a scenario describes repeat control failures, consider whether the root cause is cultural (lack of accountability, fear of escalation, poor tone) rather than purely technical. CRMA questions reward candidates who look beyond symptoms.

Tip 9 – Know the frameworks. Be able to connect risk culture to COSO ERM's Governance and Culture component, ISO 31000's principles (particularly human and cultural factors), the IIA's Three Lines Model, and the Standards' emphasis on evaluating the organisation's ethics and values.

Tip 10 – Choose balanced, constructive language. Where a question asks how to communicate culture findings, prefer answers that focus on behaviours, evidence, and root causes rather than blaming individuals, and that encourage dialogue with management while still being candid.

Quick Revision Summary
• Risk culture = shared values and behaviours that drive how risk is managed in practice.
• It is the foundation of risk governance; weak culture undermines even strong frameworks.
• Assess by defining the target culture, gathering diverse evidence, applying a structured framework, identifying espoused-versus-actual gaps, and reporting to the board.
• Key dimensions: tone at the top, tone in the middle, accountability, communication and challenge, incentives, competence, alignment with risk appetite.
• Internal audit provides independent assurance and insight but does not own culture.
• In the exam, favour answers emphasising behaviour, triangulated evidence, leadership tone, incentive alignment, independence, and board-level reporting.