Culture risk with Carey Oven

Culture risk Q&A

Q. Why is culture risk a top-of-mind issue for CEOs and board members?

As reported in the media, failures of culture have occurred across industries in areas like sales practices, diversity issues, and compliance, to name just a few. Although culture has always been important and organizations have long been working to measure and monitor culture, these events related to culture failures have intensified concerns, pushing leaders and boards to retool their perspectives on what they know about their organizational culture. As such, leaders are seeking to better understand their organizations’ methods for monitoring and measuring culture, and revisit how they can harness the information to inform their strategy and plan.

Culture is one of the few areas where CEOs and boards have direct impact and control. More importantly, boards can influence management to take action on culture. Board members are recognizing culture as an asset and are now looking more deeply into the culture, clarifying their roles and responsibilities, and learning how to govern risk—both within the board and at the organizations they influence. Especially over the last year, we’re seeing many more boards asking about the information they should be getting, what management should be doing, and what to suggest to management.

Q. What’s the most significant change in culture risk management?

Recent technology advancements enable organizations to gather and analyze critical data associated with culture risk. This data allows senior leaders to get ahead of an issue before it becomes a problem.

We’ve found that some executives are reluctant to monitor employees, but let’s face it—you need information to better understand and manage your culture risk. We often recommend an initial risk assessment to identify critical areas an organization wants to protect, such as employee safety, data privacy, and intellectual property. Once you know where to focus, you can make smarter decisions on what to monitor and how to do it. Obviously, you should implement programs that are within legal bounds.

Issues such as protection of the data being monitored and appropriate use of the results should be considered. Any culture risk program should involve the chief risk, legal, and talent officers and other appropriate risk stakeholders.

Tools and techniques for managing culture and culture risk are maturing rapidly and can really help leaders better understand and shape culture. They can help predict, prevent, and respond to culture-impacting events. As with any strategic risk, it’s better to understand the risks and potential impacts, proactively develop preventive measures, and prepare useful responses well before an incident occurs. And when something does happen, it’s important to have an effective crisis management already established.

Q. What’s the best strategy for managing culture risk?

Many organizations are refreshing practices already in place such as baseline culture assessments and talent engagement surveys. But they’re also taking a hard look in the mirror, addressing messaging around vision and mission. This requires asking the tough questions such as what does the organization stand for? Are strong values being clearly articulated and communicated? Are the vision and mission tightly aligned to those values? Are communications understood?

Leading organizations are going a step beyond evaluating current culture risk assessments and considering more sophisticated means to measure and monitor culture. They’re implementing tools that make culture tangible and measurable, enabling organizations to better analyze culture data, monitor conduct and evaluate potential insider threats, capture behavioral metrics, and report on and anticipate patterns of behavior or subcultures within the organization. While traditional culture risk management approaches evaluate how employees feel and what they say, new techniques go beyond this and focus on what people are actually doing.

It’s important to remember that culture risk isn’t entirely internally focused. If you think you have a great culture, but it doesn’t align with customers, investors, and other external stakeholders’ perceptions, you have a problem. That’s why most culture risk programs should consider an outside-in view of the organization’s brand and reputation to understand the sentiment and trending topics. Integrating sophisticated predictive risk sensing capabilities into culture risk management can help rationalize the data and transform them into actionable insights that inform decision making. Risk sensing tools that examine external sentiment are essential to informing culture risk management.

The view from the C-suite

The role of culture in an organization’s performance and success remains underappreciated, as does the power of senior leaders to shape organizational culture. This lack of appreciation is a characteristic of a traditional approach to culture risk.

Illuminating a path forward on strategic risk—Deloitte’s survey of 400 CEOs and board members in organizations of more than $1 billion—revealed some alarming views on this important strategic risk. For example, culture risk was of the least concern to CEOs and board members, with only one in five citing it as a top risk. And despite the availability of cutting-edge products and services that can digitally detect and monitor culture risk, two-thirds of the senior leaders we surveyed said their organizations lack this capability.

With culture risk, the bar for a problem is low, but the potential impact is high. If one employee steps outside of the value bubble—intentionally or unintentionally—crisis may be around the corner, threatening an organization’s reputational resiliency.

Increasingly, culture risk is a topic of interest in my conversations with executives, especially with board members given their governance role. They understand that culture risk can undermine an organization’s ability to achieve strategic goals and must be managed at the highest levels of leadership. And while they recognize the importance of managing these threats, many don’t have the answers.

To strengthen an organization’s approach to culture risk, boards can take a number of steps like pressuring management to invest in technologies that can prevent a negative reputational event before it happens; establish performance systems that are aligned with risk management; foster an environment in which employees feel comfortable challenging their colleagues and executives about risk-taking; encourage transparency and accountability around risk, and ensure management has the resources for training courses, risk culture surveys, and communication to enhance a positive risk culture.

The overarching goal of a culture risk solution should be to help senior leaders close the gap between the desired and actual state of organizational culture and intended behavior. Innovative solutions that leverage technologies like analytics, data visualization, and artificial intelligence can help close this gap and strengthen organizational culture. Organizations can use cutting-edge tools to pick up on behavior that appears to be atypical, such as a drastic increase in email to an external account or requesting access to confidential information by someone who typically doesn’t need access.

But technology isn’t the only answer. It’s important to create a culture where risk is everyone’s business, and senior leaders need to communicate that on a consistent basis. A strong culture aligned with business strategy drives an organization’s ability to accelerate performance and outpace competitors.