Charta is on Google Play: practise on the go. Get the app
Charta

Describe risk culture, set out what marks a strong corporate risk culture, and outline the obstacles a firm meets in building one.

FRM® Part I · Foundations of Risk Management · Enterprise Risk Management and Future Trends · FRM1.FR.8.d

The idea

Risk culture is the set of norms, attitudes and behaviours in a firm that shape how people identify, understand, discuss and act on risk. A strong culture usually shows tone from the top that is backed by what senior managers actually do, clear accountability for risk at every level, open communication where bad news travels up and challenge is welcome, and incentives that reward risk-adjusted performance instead of short-term profit alone. The obstacles are real: culture is hard to measure and slow to change, bonus schemes can reward risk-taking, business and geographic silos and merged firms bring different norms, and profit centres may see risk managers as a brake. A common mistake is to treat a policy manual or a clean record of no reported breaches as proof of a good culture. Reported breaches can mean a healthy culture. Exams look at behaviour, not documents.

A practice question

From the question bank, with the reason each wrong option is wrong.

Which statement best defines risk culture?

  1. The shared norms and behaviours that shape how people treat risk. - correct
  2. The written risk policies and procedures approved by the board of directors and published to all staff.Why not: Policies are a formal framework; culture is how people behave, which may differ from the documents.
  3. The total number of risk limits imposed on business units.Why not: Limits are control tools, not the shared behaviours that define culture.
  4. The firm's reported value-at-risk at the highest confidence level.Why not: A risk measure, not a description of attitudes and behaviours.

Risk culture is about behaviours and shared attitudes toward risk-taking and risk management, not documents or metrics.

A harder one

A trading firm pays bonuses based entirely on the current year's profit, with no deferral or clawback. Which obstacle to a sound risk culture does this best illustrate?

  1. Excessive centralisation of limit setting.Why not: Not related; the case concerns pay design, not who sets limits.
  2. Incentives that reward short-term profit and encourage excessive risk-taking. - correct
  3. Poor aggregation of risk data across the firm.Why not: A data problem, not an incentive problem.
  4. Regulatory arbitrage across several jurisdictions.Why not: Not illustrated; no mention of where or how rules differ.

Pay linked to short-term profit with no deferral or clawback makes the risk the firm takes someone else's problem, which pulls behaviour away from the stated appetite.

The hardest tier

Business-line heads at a firm complain that risk managers slow down deals, and the chair wants to build a stronger risk culture. Which approach best addresses this obstacle?

  1. Place the risk function under the business lines so that it gains their support and understands their deals.Why not: Subordinating risk managers to the profit centres removes the independence that makes challenge credible.
  2. Remove risk considerations from performance evaluation so that business managers stop resisting the risk team.Why not: Takes away the incentive link that aligns behaviour with the risk appetite.
  3. Relax limits whenever a business line shows strong profit.Why not: Limits that bend to profit make risk subordinate to revenue, the opposite of a strong culture.
  4. Give risk independence and board escalation rights, and add risk-adjusted measures to performance reviews. - correct

Independence and escalation rights make risk challenge credible, and risk-adjusted incentives align the business with the appetite. Subordinating risk to profit centres weakens culture.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Enterprise Risk Management and Future Trends