Literature Review
Management Attitudes towards Risk Culture
Finding satisfactory empirical data on the subject matter has proven difficult because of the limited literature exploring the relationship between risk and corporate resilience. Early scholars presumed that individuals are risk averse when they are making decisions independently (Ross, 1981, p. 644). When faced with a risk that has certainty in outcome and another that is more of a gamble with the same value as the first, a person is likely to choose the one with certain outcomes. In a 25-year study of mutual investment funds, Levy and Sarnat (1984) discovered that investors tend to avoid investments with varying outcomes. A research by Kahneman and Tversky (1982, p. 42), revealed interesting results, where they observed that when faced with a risky situation, with possible positive results, a person tends to be risk averse. However, the same individual would abandon the first option and choose a risky alternative that has the possibility of negative or poor outcomes. Conversely, Individuals are likely to ignore risks that appear as remote regardless of the magnitude of their consequences (kunreuther, 1976, p. 23). These findings suggest that attitudes towards risk of outcome are stable properties of persons, and are related to personality attributes. Risk preference therefore is associated with the dimensions of managers’ or employees’ personality and motivations for achievement. Thus, placing the burden of risk navigation on the shoulder of a few individuals at the executive level is counterproductive.
The executive leadership sometimes denies the existence of risk or ignore the severity of its possible consequences (March & Shapira, 1987, p. 591). Similarly, they may refuse to associate themselves with the realities of a risk within the organization. Although the latter might be an indication of a psychological pathology, these characteristics are evident in both the risk-averse and risk-seeking executives. Business resilience involves trade-offs between expected positive outcomes and risks. While the risk-averse decision maker is willing to sacrifice little, risk-seeking policymakers sacrifice more, both of which can have major effects on the future existence of an organization. A risk-seeking executive is more likely to sail a firm into greater market opportunities, but can still run the business to bankruptcy because they take risks with maximum benefits and risks. As pointed out by Langer (1975, p. 312) high-risk takers tend to perceive the chance of risk events in a casual manner and under control until it happens. They are more of gamblers who are willing to settle for a big win or total loss. The same applies to risk-averse decision makers who are likely to stagnate growth as a result of being too cautious, hence missing on opportunities. However, they have the ability of farseeing an impending disaster in a project and saving a company from collapse in the long run.
In his research, Barnabei (2008, p. 78) attempts to answer why the corporate leadership needs an integrated risk culture to realize a greater level of resilience. His analysis indicates that risks often trigger negative responses in individuals who will attempt to avoid them by passing them to the next person or making quick fixes. The negative responses are automatized by a person’s cognitive parameters of emotional intelligence, heuristic biases, and psychometric paradigms (Barnabei, 2008, p. 79). This explains the reason why many organizations anticipate risks, but fail to establish necessary measures to mitigate effects in the event they materialize. Because individuals already understand the risks and severity of consequences, the responses are likely to be poor. Managers take uncertainty-absorbing risks, make short run reactions, delay decisions, and delegate avoid risks (MacCrimmon and Wehrung (1986, p. 24). As the level of perceived risk and the probability of negative significances increases, demand for avoidance arguments (Sjoberg, 2011, p. 145). Additionally, it is easy to characterize risk verbally, which makes it difficult to translate the verbal risk expressions into numerical variables (Budescu & Wallsten, 1985, p. 392). This suggests that different individuals tend to see and define risk situations in different ways (Kahneman & Tversky, 1982, p. 62). Therefore, it is a mental snag for leaders to approach risks with an objective and proactive response, hence necessitating the distribution of the responsibility to every member of staff. A culture of risk creates a collective attitude in an organization that helps promote risk management best practices. Barnabei (2008, p. 82) concludes that a firm that has adopted a risk culture seeks out risks, which impart confidence in effective risk management.
To conceptualize why the culture of risk is necessary for the continued survival of an organization, it is important to understand the managerial attitudes towards risk. A study conducted by Shapira (1986, p. 58) among 50 Israeli and American executives show significant differences in tendencies towards risk taking between business and personal perspectives in decision making. Managers are more willing to take risks when it is a business decision than when it is a personal decision. These findings confirm the conclusions made by Mark D. Barnabei (2008, p. 42) who found out that risk trigger negative responses in individuals that propel them dissociate themselves from the consequences. As you move up the management hierarchy, the level of willingness to take risks reduces (March & Shapira, 1987, p. 593). The top executive leadership has delegated the responsibility of making risk decisions to the junior management so that in the case of failures, they distribute the blame downwards (Shapira 1986). In fact, the new management is advised to take less risk and is encouraged to transfer the responsibility to other managers when possible. The findings show that corporate leaders portray themselves as judicious and high-risk takers than they really are.
Risk Culture in Management
Managers are insensitive to risk estimates and the probability of a possible negative outcome, according to a study conducted by March & Shapira (1987, p. 594). Their administrative decisions focus on critical performance targets set out in the strategic business plan. This finding exposes the disconnection between management decisions and resilience approaches of a business entity (Bennett, 2013). A risk culture, therefore, bridges the gap between leadership and business continuity by ensuring that while managers implement performance targets, risk management strategies are considered in the process.
Although all levels of management feel that risk taking is part of business management, they picture organizational culture as inhibiting in nature. Risk taking is more associated with job expectations that with personal preference. This is despite the fact that risk taking in corporate leadership is sustained by personal rather than organizational incentives. Executive leaders are likely to take risks when their role in risk taking is framed as business decisions, even when they are motivated by personal inducements such as satisfaction (Kahneman et al., 1982, p. 23). A risk culture provides a more willing environment for the leadership to take risks based on the understanding that even though the risk taken is largely anchored on personal judgment, they have the support of the staff and other organizational systems.
A large percentage of managers agree that risk-taking is crucial to the resilience of an organization. More than 90% of the business leaders that participated in Shapira’s study said that they would not take a risk that would jeopardize the existence of an organization. However, some situations warrant extreme and immediate strategic measures. For example, when a competitor threatens an organization’s market share, a significant percentage of executive leaders would be prompted to take riskier strategies.
Managers prefer alternatives that can easily be managed to meet targets but avoid accepting and accessing risks (March & Shapira, 1987, p. 593). This understanding has implications for decision-making approaches and engineering of risk culture in management. Corporate leaders are often criticized for taking too little or too many risks especially when they fail. Therefore, there is a need to change risk-taking incentives and other related factors to encourage competitive decision-making within the organization. Experts often propose re-education of managers to instill comprehensive managerial skills needed to manage risks and ensure continuity of a corporation.
Few studies have sought to advance the knowledge on the significance of a risk culture in the efficient management of risk and resilience of a business organization. A risk culture increases the capacity of an organization to manage risks, which translate to an increased appetite for risk in the leadership. A risk culture has inbuilt resilience structures that automatically develop resilience in existing functions by minimizing or preventing the likelihood of disruptions or crisis, and developing measures to minimize their impact on business existence. A risk culture can be realized through risk-awareness and promotion of corporate-wide risk culture in all areas of decision-making processes. It follows the realization and acknowledgment of risks as an unavoidable and integral component of any business seeking to achieve its objectives. A robust risk culture framework incorporates responsibilities such as protection of the corporate citizen, employees, contractors, customers, environment, and the community from damage or loss.
Significance of Risk Culture in Business Resilience
Good governance sometimes does not translate to the sustainability of the income of an organization. Major organization relatively good models of management have become victims of bankruptcy due their inability to be resilient against competition and changing customer needs. The research hypothesis of this paper suggests that there is a significant link between an effective management and risk culture in promoting the resilience of an organization in the market. Michael Tarrant (2010, p. 32) opines that an organization’s adaptive and transformational abilities to risk are the core part of good governance of an organization. As more organizations face the increasing turbulence and uncertainties in the business environment brought about by economic globalization, effective risk management critical. This is because organizations must take risks to increase their exposure to market opportunities, otherwise, face negative consequences all the same.
Adopting conservative risks for any major organization with transformative strategic goals is not an option for many. Conversely, it is rather wise to try new and risky waters with the possibility of making a greater catch. This argument is supported by Alpaslan et al. (2009, p. 43) who argues that adopting a crisis management behaviours within the structures of an organization helps the management to respond to crisis effectively. Their investigation focused on crisis management with significant considerations of the corporate risk and governance. This point of view provides a theoretical basis for understanding how a risk-readiness culture improves the outcome of the directorate efforts.
According to the Global Regulatory Network (2014, p. 23), a strong risk culture is essential in enabling supervisors monitor and manage employee behaviours. This viewpoint is especially true in a large firm where the supervisors are expected to meet certain expectations. As discussed earlier, a risk culture plays a crucial role relative to the strategic significance of the human resources. Incorporating risk culture into supervisory work transfers the responsibility of managing risk to individual employees in the organization. Therefore, the contribution of each member of the staff trickles down into the pool overall organization's risk management. The intern ensures that an organization is able to allocate the necessary resources and competencies to manage the challenges, demands and changes.
Paton and Johnston (2006, p. 82) describe resilience as the organizational capacity to reorganize internal and external resources in responding to an impending danger or even after it has occurred. He observes that resilience requires a systematic establishment of conditions and staff competencies that could facilitate change and continuity in response to risk conditions. In many cases, the corporate management lacks necessary skills and resources to manage unforeseen events. Management of risk requires routine corporate management that can be readily deployed to inspire stakeholders, leverage existing relationships, and make a rapid judgment in executive decisions.
Risk culture promotes resilience by ensuring that the corporate leadership stays ahead of the risk (Bennett, 2013, p. 24). Because the beliefs, behaviours, and values of the risk culture are embedded in the organization’s policies, practices, and procedures, the entire organization is involved in the management of risks. As such, risk management responsibilities are automatically executed without necessitating the creation of a different business entity. The concept is made possible by the understanding that the staff derives value and benefits of risk management. Different employees are engaged in a consistent risk management practices because they recognize that risk management prevents and minimizes adverse outcomes. Conversely, members of the workforce understand that their inputs in risk mitigation help the business realize gains that are crucial for growth.
The risk culture is embedded in the vision, values, and mission of the organization which means that the risk appetite is defined clearly from the onset of the development of strategies and objectives. An environment of risk ownership is formed where staff at all levels, willingly exercises risk leadership and ownership that leads to better decision making. The management, therefore, able to escalate risks towards the desired direction through individual inputs without having to act out of their defined roles. Dressel (2015, p. 37) suggests that the use of risk management should be consistent throughout the organization to promote a harmonious connection at all levels of operational and strategic management. The culture of risk in an organization manifest when practices such as reporting of events and bad news and proactive response to them are evident.
Jareett (2016, p. 43) concludes that managers must prepare to embrace a risk culture as an essential component of business decision making. The possibility of project failure should be anticipated and develop appropriate attitudes towards such disappointments. The most important part of ensuring business resilience seems to be anchored on a business's ability to analyse risk and assembling of response measures. As indicated by Jarret, this role falls entirely on the shoulders of the executive management. He categorizes risks into three basic groups that include high, medium, and low. This model is easy to interpret all members of the staff who make different contributions to the risk culture of an organization.
Cultivating a Risk Culture for Resilience
The 2008 financial crisis prompted many organizations to rethink the role of their risk culture in fostering business resilience during hard times. Donna Epps of Deloitte’s National Governance states that many organizations have failed to institute a risk culture that touches every member of the staff, but has instead placed too much focus on the risk function. By focusing too much on risk functions, some firm’s risk culture has become liabilities that provide a little stability and competitive advantage (Pal et al., 2011, p. 62). Deloitte (2013, p. 24) points out that there are certain common features of a resilient organization related to a good risk culture. They include 1) Universality of application, 2) commonality of purpose, ethics, and values, 3) timely, honest, and transparent in communication, and 4) continuous learning and improvement. The commonality of purpose refers to the extent to which a worker’s value, interests, ethics, and beliefs align with the risk culture, appetite, and tolerance of an enterprise. Continuous learning refers to the ongoing improvement of the collective capacity of an organization to manage risks. The risk culture has to be flexible enough to be deployed in all activities of a company. Most importantly, a strong risk culture that fosters resilience needs to encourage an open, honest, and comfortable communication and sharing of understanding of risk vocabularies and activities.
Deloitte (2013, p. 24) suggest three stages of development of an organizational risk culture. The first stage entails deliberate awareness building by communicating roles, responsibilities, and expectations to employees. Companies take time to educate employees through formal and informal training sessions. Activities in this stage include clarification of accountabilities, embedding of risk management into onboarding programs, general education on risk vocabulary, and refining recruitment policies to include risk management capabilities.
The second stage risk culture development entails the transformation of the current management system to accommodate advanced risk approaches. It involves challenging the status quo by rewarding behaviors that pay attention to risk. This strategy is supported by the study conducted by Shapora (1986, p. 72) that shows that there is an absence of organizational incentives in supporting risk taking and management behaviors. Mr. Blakely points out that rewarding the right behavior is crucial in the development of talents necessary for sustaining a strong culture. Valuable stamps at this stage include the establishment of ethics and compliance standards, reinforcing behaviors, embedding risk performance metrics in the organization’s motivation systems, and forming a philosophy of constructive challenge (Kelly, 2009, p. 27). Conversely, the right talents are positioned in risk-oriented roles where critical risk factors can be managed effectively.
The third and the final stage involves activities aimed at refining the established risk culture, which ensures continuity and growth. Risk culture performance and resilience expectations are monitored, and adjustments are made where necessary. The factors being monitored include people, communication, strategies, and market resilience (Ashby et al., 2012, p. 82). The steps at this stage include improving risk management skills through training, developing accountability metrics, refining risk appetite, and tolerance, redeploying talents to match business and strategic priorities, and refining risk performance metrics.