Martyn O'Connor, Head of Risk and Compliance at Wellesley, spoke to FourthLine about the use of training and development in relation to improving Risk Culture.
What has been your experience of training in relation to improving risk culture, and how beneficial have you found this?
There has been great progress over the past decade in developing risk cultures, effective tools and techniques for managing risk within firms, and acceptance that boards need to be mindful of the risks inherent with strategic objectives.
However, as Compliance and Risk professionals continually experience, embedding risk management into a firm to the extent that it reliably makes a difference is still a difficult task, the main challenge continues to be people and their willingness to improve and adapt.
Every firm, Compliance and Risk teams has its own approach to risk - its risk culture. The risk culture will influence the mechanisms and techniques that the firm employs to manage risk but is also in turn influenced by them. Well-constructed training can make a massive difference, however in my experience Computer Based Training only works if it is used in conjunction with more interactive learning activities
How much of a priority do you think risk culture training is for firms, and do you agree with this? With so many areas for learning and development, how highly would you rank risk culture training?
In “The FCA and UK Banking Culture” by Peter Andrews (2016), former Chief Economist of the FCA, he suggested that “poor culture played a significant part” in the financial crisis and that it is “a root cause” of many organization’s failings. Andrews identified culture as “both a major driver and potential mitigate of risk.” He concluded that he would like to see that “firms’ senior management lead and foster a culture that has the fair treatment of customers and market integrity at its core.”
I personally think there is a slight blind spot across the industry in relation to Culture as a whole, most people will agree it’s a vital component of risk management and it’s taken seriously within the firm, but when it comes to training, culture is focused on Myers & Briggs (Which to be clear I like, it just isn’t risk), and shallow mission statements. The only way risk culture training works is when its clearly linked to strategic objectives.
Do you think risk culture training is something that is better delivered in-house and made bespoke to the specific requirements of a firm, or there more value in attending external workshops or courses?
If you keep employee training in house, you ensure you retain control over the development of that training and ensuring it can be tailored to the firm’s specific processes and procedures. On the other hand, by outsourcing, you gain access to people who have proven expertise in educating employees in specific areas, i.e. Risk Culture across many firms, which can be a good eye opener.
I’m indifferent to either, the key is the message and again how it all links together.
Who should risk culture and conduct training be delivered to within a firm?
Easy, all staff. The induction of all employees is a great place to share the risk appetite and culture of the firm in a bite size session that draws out the key behaviours the firm is looking for in its staff. If this can be delivered by a senior member of staff that doesn’t sit in the Risk & Compliance teams even better.
What do you think is the best method for delivering training and development on this topic?
As noted above, the key is less in the delivery, i.e. CBT, interactive workshops etc, but much more about making it relevant.
It sounds obvious, but content can only be engaging when it’s written for a specific group of people. With endless content at their fingertips, your time-poor audience won’t stick around reading boring content that they feel is a timewaster. And nor would you want them to!
So, it’s worth taking the time to create specific learning objectives for each section of your audience. This doesn’t have to involve completely new content or wholesale rewrites; simply using appropriate terminology, referring to people roles correctly and removing pages that aren’t relevant for certain people can go a long way.
If a firm was looking to transform their risk culture, what elements do you think need to be considered for a successful transformation?
This requires a clear understanding of the current culture and the desired ‘target’ culture. It requires recognition that this is a major change programme and requires discipline to see it through.
The process must start with someone at a very senior level taking ownership, the sponsor must win support across the top of the firm among executive and non-executive leaders, whilst commitment must be conspicuous to all and backed up by funding and resources.
The culture change should be treated as a change management project, with appropriate allocation of board time and resources. A culture cannot be rewritten simply by mandating that the values or ideology of a firm have changed.
The firm must approach the risk culture change as a project, with a set of objectives, a design for intervention and with regular reviews of both progress and outcomes. Change can be implemented by pulling on certain ‘levers’ to make noticeable change in important areas. Risk and Compliance functions will need to work closely with HR and other key departments on several key change areas.
How can progress and the positive effects of risk culture training be evaluated?
The effectiveness of how a firm responds to issues, risks or opportunities can be strongly influenced by their risk culture and governance. Effective risk governance, through use of objective measures and wider participation in decisions, should shine a spotlight into all areas of the business and make it difficult to hide or bury risks.
Conversely, a failure of risk governance and risk oversight can have dramatic consequences for firms.
In short, its difficult to measure in quantitate terms the impact that training can have in risk culture, however if your firm works collaboratively when things go wrong, and have a good mix of people at the table to help, the chances are the risk culture is where you want it to be!