Posted: 07 May 2020 7 min. read

Keeping focus on a changing risk culture through COVID-19

The COVID-19 pandemic is having one of history’s most profound impacts on the way people work. Widespread disruption is causing increased anxiety and stress challenging organisations’ ability to manage risk effectively. For many organisations, the second line is being redirected to focus on the crisis and the regular schedule of managing risk controls is fading into the background. A strong risk culture is needed more now than ever, as line one is increasingly relied upon to make effective ethical and risk decisions in their day to day work.

COVID-19 has meant organisational risk profiles have changed overnight.  With the rapid change having variable impacts across our teams and business units.

As people adapt to different ways of working, interacting and trying to balance the competing professional and personal demands, new behaviours and attitudes are established - shifting the corporate culture.  For some organisations, this new culture will bear little resemblance to what went before.  This disruption presents companies with an opportunity to shape this emerging culture to ensure it remains values led, supports responsible risk decisions and reflects its risk appetite.  

When it comes to risk culture in a COVID-19 world, what do organisations need to think about first? 

1. Risk profiles have changed, and so has the effectiveness of your controls.

The COVID-19 situation has already changed the risk profile of most businesses. Variations in government and regulatory advice, the needs of customers and business partners, and employee’s ways of working are continuously evolving.  It is now critical for companies to understand the impact of these changes: rapidly assessing which risks are rising in importance, the likelihood of them becoming significant issues, and their potential ramifications.  In doing so, it is important that risk continues to be viewed holistically. 

For many organisations, the current control environment is likely to be operating at reduced effectiveness: 

  • Teams will be looking for work-around solutions to meet their objectives that, without the input and oversight of risk specialists, could unwittingly undermine risk controls and result in misconduct.
  • Close co-working with family and flatmates could create privacy and confidentiality risks.
  • There may be reduced availability of key oversight or peer review contacts.
  • The ease of interacting with risk specialists may be impacted by IT limitations or changes to working hours. 
  • There might be potential misconduct arising from workforce changes in a disrupted operating environment, such as increasing demand requiring a fast scaling up and upskilling of workforce in certain areas.

Risk owners and risk specialists need to actively engage with frontline teams to understand what changes are occurring to business as usual for frontline staff, and teams will need to work collaboratively to quickly adapt controls that suit how the business is functioning, while still achieving risk management objectives.

2. Decision making under stress.

Organisations must increasingly rely on people to do the right thing—not only to make the right decisions but, at times, to manage risks on their own.  At the same time, many teams are facing widespread destabilisation of their typical work environment and support structures.

Most people understand that stress impacts the ability to make good decisions.  While some level of stress can act to energise and motivate, higher levels adversely affect a range of psychological capabilities including perception, planning and memory.  Importantly, stress has specific impacts on a person’s capacity to assess risk, often leading to riskier decisions and focus on short-term benefits rather than longer-term outcomes. [1] Staff are facing increasing pressure and demand for their attention from different sources and will need to make decisions under increasing cognitive load and under greater than normal uncertainty. 

It shouldn’t be assumed that team members are making decisions under optimal conditions now.   Increased distractions and potential reduction in the level of informal peer review and support may impact how different factors are weighed in decisions and level of scrutiny applied. Supporting good decision-making means increasing the opportunities for critical review.  Seeking a second opinion and supportively challenging each other’s thinking during this period is critical.  Leaders should consider how they can develop sound review processes and encourage dissenting views to be bought forward. Allocating time for virtual staff drop-ins or holding question and answer sessions are examples of methods leaders may use to remain approachable to a remote team. 

3. Balancing mental health and wellbeing to help reduce stress and support sound decision-making.

Continuing to focus on the health and wellbeing of staff and maintaining a sense of connection and community is a key pillar of maintaining a positive risk culture.  

Those working from home may experience more difficulty separating life demands from work demands (i.e., ‘switching off’). Risks may bleed across from the professional to the personal and back again, such as living arrangements impacting the ability to maintain cyber security or confidentiality as easily. 

Managing child-care and educational commitments will impact the availability of staff to maintain the same work routines and practices they may have applied previously.  Organisations will need to consider that work demands (and ‘risks’) may not receive the same priority as they would in a normal work context and understand how this might affect risk management.  To support good risk outcomes, it will be important to establish how they can best support employees across both spheres of life.  

Many businesses are adapting communications to suit the new medium such as increasing video rather than audio conferencing, holding regular check-ins focused on personal connection rather than just work issues and seeking ways to support their teams through this period.   Maintaining connectedness and wellbeing should remain a priority to support a sound risk culture. 

4. Recognising that with change comes opportunity. 

As in all situations, risk and opportunity are two sides of the one coin.  While risk culture is undergoing significant change, there are several opportunities to intervene and shape the culture going forward. 

While outside influences present challenges, reduced connection with physical symbols and non-verbal cultural indicators means organisational culture is being carried predominantly in the conversations we have and the decisions we take.  It is the quality of this communication and the way our decisions are made that will determine what the organisation’s culture looks like on the other side.  Virtual meetings, if run well, can be an opportunity to include a broader range of expertise that might not have been available before. Meanwhile, adapting our processes of critical review to slow-down decision making and undertake better risk assessments can provide the chance to create new business practices and behavioural norms that become the new way of managing risk post the crisis.

Gaining and maintaining ongoing visibility of the changing risk culture now will allow targeted interventions that can both protect and potentially enhance the risk culture of organisations to meet the challenge posed by COVID-19.

[1] Stark, K. & Brand, M. (2016).  Effects of stress on decisions under uncertainty:  A meta-analysis. Psychological Bulletin, 142(9), 909-933.


Murray Lawson & Abigail Budiawan

Meet our Author

Murray Lawson

Murray Lawson

Director, Risk Advisory

Murray is a Director in the Ethics & Risk Culture team in Sydney.  He has extensive experience in researching how people evaluate risk and make decisions under uncertainty.  He is passionate about understanding the cultural drivers of decision-making and building cultures to support better risk outcomes. Murray has led major consulting projects for corporate clients in Australia and internationally in the resources and financial services sectors to align risk decision-making, develop responsibility and accountability frameworks and review risk controls. He has also supported the assessment and change of operational risk cultures within Australian government agencies.  Murray is a specialist interviewer, having undertaken advanced training with the Australian and US law enforcement agencies. Murray holds a PhD in the cognitive neuroscience of human decision-making and an MBA.  He has taught qualitative and quantitative research methods in universities and is a Certified Fraud Examiner and Certified Anti-Money Laundering Specialist.