BUILDING A RISK CULTURE

Ali Almuwaijei - SVP Dubai South

Living in a world of uncertainty

Expect the unexpected

CHALLENGER

KODAK

TSUNAMI

ERICSSON

DEEP WATER HORIZON

There was risk management (maybe) but

surely not a risk culture

There was risk management (maybe) but surely not a risk culture

Know your risks..• “To take risk and fail is not a failure. Real failure is to fear taking any risk”

• “Innovation is not an option but a necessity. It is not a culture but work style, and

governments and companies that do not innovate risk losing their competitiveness and

falling far behind”

• “I plan carefully in my mind before taking a risk. Its always a calculated risk, not an

impetuous decision”

One of the key factors setting Dubai apart is the leadership's willingness to take the risk of pursuing the vision of a diversified economic structure that would hold the emirate in good stead whatever the regional or global economic climate might be.

His Highness Sheikh Mohammed bin Rashid Al MaktoumVice President and Prime Minister of the United Arab Emirates and Ruler of Dubai

What is risk culture?

“a term describing the values, knowledge, attitude and understanding about

risk shared by a group with a common purpose”

Every stakeholder should know about their risk

management function and their role and responsibility

towards risk management

Why is risk culture important?

Organizations need to take risks, it is not cost

effective to eliminate all possible risks1

An organization will be exposed to risk irrespective

of its desire to take risks2

To be sustainable, organizations need to manage

those risks3

What does poor risk culture look like?

• Poor Communication

• Unclear appetite

• Lack of insight

TRANSPERENCY

• Indifference

• Slow response

RESPONSIVENESS

• Overconfidence

• No challenge

• Fear of bad news

TRANSPERENCY

• Beat the system

• Gaming

RESPECT

• Risk culture is the glue that bonds enterprise

risks management (ERM) together

• An effective and efficient culture can make a

strong contribution to business performance

• To achieve this, it is crucial to improve not

only governance procedure but also the

understanding and involvement of the

organization personnel.

What does good risk culture look like?

What does good risk culture look like?

Leadership invests in risks management both time and

resources

Strong flow of risk information throughout the

organization

Organization wide exposure to risk management

practices

Risk taking is encouraged, provided the

appetite is clear

Continues learning attitude

Avoid Silos

Risk Culture Framework

Source: McKinsey

Transparency of risk

Acknowledgement of Risk

Responsiveness to Risk

Respect for Risk

Communication

Tolerance

Level of Insight

Confidence

Challenge

Openness

Level of Care

Speed of Response

Cooperation

Adherence to rules

Poor

Unclear

Lack of Insight

Over Confidence

No Challenge

Fear of Bad News

Indifference

Slow

Gaming

Beat the system

Groups Dimensions

Good

Clear

Good Insight

Confident but careful

Constructive Challenge

Reward honesty

Diligence

Fast

Coordinating

Play by the rules

High Risk Low Risk

P

Personal predisposition

to risk

Personal Ethics

Behaviors

Organization Culture

Risk Culture

Components of an organization risk cultureSource: IRM

10 Principles of Risk CultureInvolvement of the board in risk managementRisk Governance1

Clear statement of statement of the risk that the organization would be willing to accept

Risk Appetite2

Incentive compensation does not conflict with goals of risk managementCompensation3

Board and Top Management are publically vocal in support of risk managementTone at the Top4

Individuals are help accountable for violations of risk limitsAccountability5

10 Principles of Risk CultureIt is acceptable to publically disagree with risk assessmentChallenge 6

Individuals are assigned specific roles to facilitate the risk management program including a lead risk officer

Risk Organization7

Risk management is everyone's job and everyone knows what is happeningBroad Perception8

Risk Management program is consistent with company strategy and planning considers risk information

RM linked to Strategy9

No one assesses their own performance regarding riskSeparate

measurement and management of risk

10

Ensure team alignment with RM framework

and Organization

Strategy

Break the silos, promote

knowledge and data sharing

Simplify the RM process, use technology

Encourage risk and incident

reporting

Don’t Push RM, Pull people towards RM

Simple adjustments

Top Management

Middle Management

Operations

Workshops Brainstorming Mobile Application Monthly News Letter

Risk Committee Quarterly Meetings Risk Direction

Workshops Brainstorming Mobile Application Training

Monthly Meetings Cascading Risk Information KPIs

Awareness Sessions Appraisal Mobile Application Training

Technology Risk reporting platform Rewards

Risk Champions

Primary Group/ Secondary Group

Some quick wins

TECHNOLOGY AWARDS STRATEGIC PARTNERSHIPS STRATEGY ALIGNMENT

Diagnose your risk culture

Work on the results and focus on weak areas

SIMPLE SURVEY 4 THEMES IMPROVE

Conduct a simple survey of the risk culture

TRANSPERENCY

RESPONSIVENESS

ACKNOWLEDGEMENT

RESPECT

Diagnose your risk culture

Source: McKinsey

• Know your organization culture

• Pull people towards ERM, don’t push ERM on them

• Focus on the key areas • Link the importance of each

with the strategy

Leverage Tools Offered by RIMS

Leverage Tools Offered by RIMS

“Good Risk Management fosters vigilance in times of calm and instils discipline in times of crisis.”

Dr. Michael Ong

THANK YOU