This post first appeared on Risk Management Magazine. Read the original article.
Culture can be an organization’s greatest asset or its most significant liability. “Companies that exhibit a winning culture, that have a strong internal compass and inspire their employees” are 3.7 times more likely to be business performance leaders, according to Bain & Company. Given this, every organization’s leaders need to build a culture that boosts employee engagement, improves the workplace environment and drives business results. As Airbnb cofounder and CEO Brian Chesky wrote in a letter to employees, “The culture is what creates the foundation for all future innovation. If you break the culture, you break the machine that creates your products.”
To help improve their organizations, risk professionals need to understand what culture is, how it drives risk management, how to identify and manage cultural risk and the importance of aligning culture with organizational strategies and goals.
Culture as an Emergent Property
If you break sugar down into its base elements—hydrogen, oxygen and carbon—and sample each, you would not be able to tell how sugar tastes because taste is determined by how those atoms and molecules are put together and how they interact. Similarly, organizational culture is an emergent property—the collaborative functioning of a system—of human behaviors and beliefs that depends on how the different pieces and parts interact.
Former IBM CEO Lou Gerstner, who is credited with revitalizing the company in the 1990s, articulated the importance of recognizing culture as an emergent property, saying, “I came to see during my time at IBM, culture is not just one aspect of the game, it is the game.” He realized that cutting costs, realigning systems and making the right moves in the marketplace were only parts of the equation for success. Recognizing culture as an emergent property helped turn the company around and ultimately grow its market cap from $29 billion in 1993 to $168 billion in 2002.
Culture Drives Risk Management
Risk is about weighing the relative benefits of options, which people evaluate through the lens of their personal value systems or, in organizational decision-making, the organization’s value system. These values are embedded in the organization’s shared belief system, which is essentially the organizational culture. Consequently, culture defines the shared belief system and, by extension, how risk is interpreted and how risk-based decisions are made.
Examining NASA around the time of the space shuttle Columbia accident provides a case study on how organizational culture can increase risk. On the surface, NASA appeared to have a healthy organizational culture, consistently ranked as one of the best places to work in the government. The organization was made up of highly dedicated, intelligent employees who viewed the program almost like their own child.
Unfortunately, these values interacted poorly with NASA’s techno-political structure to create an emergent culture of risk tolerance. Merging technical systems at the bottom and political systems at the top created an organization with conflicting identities and pressures. As part of the executive branch, NASA was constantly drawn into budget debates and warned that failure to meet milestones meant program cancellation. This made employees prioritize “saving the program,” and accept elevated risk. The resulting culture compromised their ability to judge risk and make good risk trade-off decisions.
Most decisions are not based on rigorous analysis and testing, but are actually based on heuristics—mental shortcuts formed from past experiences. Heuristics evolve to contain coworkers’ shared stories, which are then shared throughout the organization. Often, bias creeps into these heuristics undetected, essentially invalidating the decision-making process and introducing unacceptable risk.
The Heart of Risk Management Culture
Risk professionals understand that risk can only be managed, not eliminated. When managing risk, search for factors such as cognitive biases, failed reporting, poor self-awareness or individual defensiveness, all of which increase the unintentional acceptance of risk. One of the most common root causes of accidents is accepting risk without being aware of it. This is especially true over time, as the cumulative effect of unrecognized and unmanaged risk grows.
One way to mitigate risk is to build a culture that supports employee self-awareness, self-acceptance and self-accountability. These three capabilities form the foundation for the chain of action that lies at the heart of a culture of risk management:
Self-acceptance: Employees are willing to accept the existence of a risk and its effect on their work but also, more importantly, on who they are and the challenge to their self-concept.
Self-awareness: Employees then allow themselves to become aware of the risk and proactively seek additional information even though doing so may lead to discovering other risks.
Self-accountability: Employees believe that action is possible, and understand that their action or inaction will have direct and meaningful consequences.
Aligning Culture with Business Goals and Strategies
Management consultant and author Peter Drucker once said, “Culture eats strategy for breakfast.” He was not minimizing strategy’s importance for driving market performance but emphasizing that, if strategy and culture are not aligned, culture will always win.
For risk professionals, organizational culture is almost impossible to overcome if it directly opposes the strategies that risk management is implementing. This leads to the “bad apple fallacy,” where risk professionals tell themselves that they have great systems, policies and programs, the only problem is the troublesome employees who keep messing them up. Unfortunately, the “bad apple” is often the norm, because the organizational culture conditions individuals to behave a certain way. Until culture changes, the risk management program likely will not achieve the desired results.
By contrast, a culture that aligns with the organization’s mission, vision and strategy creates a blueprint for success. Culture can be designed in the same way you would design a car, software program or house. With each, you design to meet certain requirements—in the case of culture, such requirements are to execute your strategy and vision. Masterful leaders develop that vision and strategy by bringing people together to create a shared vision, which ensures alignment and, in turn, drives engagement and productivity.
Organizations that successfully align culture with business strategy have a competitive advantage. A longitudinal study by Harvard Business School Professors James Heskett and John Kotter looked at the corporate cultures of 200 companies and their long-term effect on economic performance and found that companies with effective cultures grew their net income by 756%. By comparison, net incomes grew only 1% for companies with ineffective cultures.
How to Build a Strong Culture
Because culture is built from the inside out, begin by looking inward. As a leader, ask yourself honestly: How have you contributed to your current culture? This could be through both action and inaction. For example, if you have openly expressed frustration when somebody admits a mistake, that could contribute to a culture where people try to hide their mistakes, which is detrimental when trying to mitigate risk. If you have failed to acknowledge or prioritize a safety program, you have contributed to a culture that questions the importance of managing risk. A company that does not emphasize a culture of safety cannot be expected to manage the risk and safety of others. Start from within by building your personal chain of self-acceptance, self-assessment and self-accountability. Lead by example, then invite your team to join you in being self-accountable.
Next, set aside meaningful time to think about what kind of culture supports your strategy. If you are unclear on your strategy, start there. Identify where your organization is headed, getting specific about the volume and type of work you will be doing, the organization’s size and key processes you have in place to facilitate the desired growth.
Once the strategy is clear, identify the behavior and results required to execute that strategy. This becomes the basis for your culture. Identify the beliefs you want staff to hold, and think about what experiences you want to create for them that will reinforce these new beliefs.
It is also useful to identify your core values and the beliefs and behaviors consistent with those values. You can then align your talent management processes accordingly by making hiring and firing decisions and providing employee recognition and reward based on those values. Talk about them in onboarding, incorporate them into meetings, share stories that reflect those values in action and invite each employee to internalize those values, ultimately becoming part of their identity.