Implementing Enterprise Risk Management

CHAPTER 6Risk Culture

INTRODUCTION

Think about it: Stepping into a car is probably the riskiest thing most of us do on a daily basis. Because of the inherent risks involved in auto transportation, policymakers have implemented numerous systems and controls to reduce the instance of accidents and mitigate their severity. Rules about what to do at stop signs and intersections permit drivers to cross safely each other's path; tools such as speedometers and fuel gauges facilitate compliance with those rules and promote intelligent decision-making; and safety devices including seatbelts and airbags reduce the severity of accidents. And yet every day, thousands of drivers fail to comply with these rules, often at the cost of their lives and the lives of others. Some run red lights or exceed the speed limit. Others drink and drive or text behind the wheel. Many don't wear seatbelts. Clearly governance structures and policies are of little use if drivers ignore or devalue them. Drivers must internalize the proper values and attitudes to make these policies successful. As a society, we need a sound driving culture.

Just as policymakers cannot maximize motor vehicle safety merely by enacting rules and regulations, corporations cannot optimize risk management simply by establishing oversight committees, audit processes, and risk reports. These processes and systems, which comprise what I call the “hard” side of risk management, become useless without the soft side: all the factors that ...