What Is Risk Culture in Banks and Credit Unions?

Risk culture is the set of expectations people hold about what will happen to them if they surface a problem. People learn it by watching what happened to the last person who raised something inconvenient, not by reading the values statement. Behavior leaves evidence, so a bank's or credit union's risk culture can be assessed from records the institution already keeps.

Why risk culture is not the soft topic

Risk culture has a reputation for being the soft topic: posters in the elevator lobby and a value statement nobody can recall. Much of what is written about it deserves that reputation. Saying that tone from the top matters, or that everybody is responsible for risk, is an unfalsifiable sentence. It tells a practitioner nothing they could check.

A more useful approach treats culture as a pattern of behavior rather than an atmosphere. That behavior shows up in what an institution measures, what it pays for, who it promotes and what it lets pass.

This matters because many structural ideas in risk management are really cultural claims:

• A reporting line is a control only if somebody is willing to use it. A chief risk officer with an impeccable dual reporting line who never says anything difficult has all the structure and none of the effect.
• Saying the first line owns the risk does not describe a structure at all. It is a belief about whose problem something is.
• A framework that punishes bad news stops receiving it long before it stops producing it.

The five o'clock moment

The definition puts culture inside individual heads as a prediction, and it makes culture learned. Picture where it operates. It is five o'clock and somebody has an awkward number in front of them. It is not a disaster. It might be a limit that is a little tight, a control test that half failed, or a pattern of customer complaints that might be nothing. They have three options, and all three are entirely normal:

1. Raise it, which costs them an evening and possibly a difficult conversation.
2. Park it until they have more information. This is often the right call, and it is also the perfect disguise for avoidance.
3. Reframe it, by finding a reading of the number under which it is not really a problem. People usually do this sincerely, not cynically.

An institution's culture is the sum of which option people pick, thousands of times, when nobody is watching. What decides the choice is what they expect will happen to them. That is why culture is not decoration on top of the risk framework. It decides whether the framework ever gets anything to work on.

Stated culture versus operating culture

Every institution has two cultures, and the gap between them is worth measuring.

The stated culture is the values on the wall, the code of conduct, the training completion rate and the chief executive saying the right things at a town hall. All of it is real, and all of it is cheap. It costs a few days of somebody's time and no hard choices.

The operating culture is expressed entirely in decisions:

• Who got promoted, and what were they known for?
• What did the last bonus round actually reward, as opposed to what the scheme document says it rewards?
• What happened to the last person who escalated something inconvenient?
• Which deadlines are allowed to slip? An institution that lets a revenue deadline slip but never a control deadline is telling you something, and so is one that does the reverse.

People are very good at reading the operating culture. They do it through ordinary pattern recognition, not consciously or cynically. Anybody who has been somewhere for 18 months knows what actually gets rewarded there, whatever they have been told.

When the two disagree, the operating culture always wins. The outcome is worse than a draw, because the stated culture becomes evidence that the institution says things it does not mean. That teaches people to discount the next thing it says, including the parts that were sincere. A value statement that is not backed by decisions is not neutral. It is corrosive.

How incentives shape risk taking

The economics of incentives is not in dispute, and it is worth understanding without moralizing. Three points stand out.

Incentives reward what they measure, not what they intend

Pay people on volume and you will get volume. Add a quality gate and you will get volume that passes the gate, which is not the same as quality. The gap between the two is where people put their ingenuity. That is not cheating. It is what a measure does when money is attached to it. Anyone designing an incentive should assume intelligent people will optimize against exactly what is written, because they will.

Almost nothing rewards a non-event

A loan that was not written because it was a bad loan generates no revenue, appears in no report and earns nobody anything. An outage that did not happen is invisible. Risk management is largely a discipline of non-events, and non-events are very hard to pay people for.

The timing problem

Risk taking pays now, and the risk tends to arrive later. A lender writing aggressive credit today books the revenue today. The defaults show up two, three or four years later, possibly after that person has been promoted on the strength of the growth or has moved to another firm. Put plainly, the bonus is annual and the credit cycle is not. The credit cycle is the swing, over several years, from easy lending and low losses to tight lending and high losses.

Nobody designed this mismatch. It is what happens when annual pay meets multi-year risk, and it is why the ideas of deferral, and of paying part of a reward only once outcomes are known, exist at all.

The law has not settled this. The Dodd-Frank Act directs the federal financial regulators, acting together, to prohibit incentive pay arrangements that encourage inappropriate risk, either by paying excessively or in ways that could lead to material financial loss. It reaches credit unions as well as banks above a billion dollars in assets. The rule the statute calls for has been proposed more than once by several agencies acting together, and none of those proposals has been finalized.

The statute is in force and the rule it calls for is not, which is an uncomfortable position for a compliance officer. The economics above are stable and do not depend on any specific rule. A rule's status is not stable, and it does damage when repeated from memory. When somebody tells you confidently what the compensation rules require, ask them when they last checked.

Escalation is the behavior that matters most

Every control, however automated, ends with a person deciding whether to tell somebody. A monitoring system flags an exception and a person decides whether it goes further. A test half fails and a person decides whether that counts. If that decision goes the wrong way, the control has failed, however sophisticated it was.

The economics facing that person are poor. The cost of escalating is immediate, concrete and paid personally: an awkward conversation, a displeased senior, worse numbers for their own team, perhaps a delayed project. The benefit is diffuse, delayed and usually invisible, because when escalation works the bad thing does not happen and nobody gets credit for a loss that did not occur. Escalation is bad for the individual and good for the institution, so it does not happen by default. An institution that wants it has to make it deliberately cheap. That means:

• A route for raising issues that does not run only through the person the problem is about.
• A low threshold. If people must be confident a problem is real before raising it, you only hear about the certain ones, and early warning is valuable precisely because it is uncertain.
• A proportionate response, so that raising something small does not trigger an investigation that teaches everyone watching not to bother.
• Visibly not punishing people who raise things that turn out to be nothing.

The last point is the test. What happened to the last person who escalated something that turned out to be fine? Everybody in the building knows the answer, and it sets their behavior.

How to assess risk culture from records

Culture looks unmeasurable, but much of it can be counted from records the institution already keeps.

Signs a healthy risk culture is working:

• Issues raised early, while they are still small and uncertain. Timing tells you more than volume.
• Breach reports that include the harmless ones, showing people are not filtering for significance before reporting.
• Audit findings the business identified itself before audit turned them up. This is the single best indicator.
• Minutes that record a disagreement and what came of it.
• Risk roles that people get promoted out of into senior business jobs.

Warning signs:

• Problems that surface only at year end or when somebody leaves, meaning issues were held rather than raised.
• Long-running exceptions nobody revisits.
• Findings closed and then reopened repeatedly, meaning the fix was cosmetic and everyone involved knew.
• Minutes that record only agreement, month after month.
• Risk roles used as somewhere to park people who are not wanted elsewhere.

The last contrast reveals more than an institution intends. If the risk function is a career destination that able people compete for, it will attract people with the standing to challenge. If it is where people go when their business career has stalled, no reporting line will save it.

How risk culture actually fails

The popular picture is somebody deciding to cut a corner. That happens, but it is not the common case. The common case has four parts:

1. A target that is slightly out of reach if the job is done honestly, such as 20% growth in a market growing at five. Wildly unachievable targets get challenged and reset; slightly unachievable ones do not.
2. A small accommodation that closes the gap and works: an exception that was probably fine, a slightly optimistic assumption within an acceptable range, a control step treated as a formality.
3. Nobody senior asks how the number was achieved. The target was met, asking feels ungrateful, and everyone is busy.
4. It repeats, until the accommodation becomes the way things are done and is taught to new joiners as normal practice.

Nobody along that path made a decision they would have recognized as wrong. Asking people whether the culture is good will get a sincere yes. The pattern is visible in the records long before it is visible to the people in it. Note that the first ingredient, the target, is the one management controls directly. Much of what gets called a culture problem starts as an arithmetic problem: a number promised to somebody outside that could not be delivered honestly from the business as it stood.

Key takeaways

• Risk culture is the set of expectations people hold about what will happen to them if they surface a problem, learned from what they have watched happen to others.
• When stated culture and operating culture disagree, people believe the decisions, and the stated culture becomes corrosive.
• Incentives reward what they measure, almost nothing rewards a non-event, and the bonus is annual while the credit cycle is not.
• The statute on incentive pay is in force but the rule it calls for has not been finalized, so check rule status rather than repeating it from memory.
• Escalation does not happen by default. Institutions must make it deliberately cheap and visibly safe.
• Culture can be assessed from existing records: early issues, harmless breach reports, self-identified findings, recorded disagreement and where risk staff get promoted.
• Many culture failures begin with a target that cannot be met honestly.