Cultivating a Risk Intelligent Culture Understand, measure ...

1 Cultivating a Risk Intelligent Culture Understand, measure , strengthen, and report Process follows Culture Organizations wishing to better manage risk should consider establishing a Risk Intelligent Culture . There is no one size fits all solution to risk management how an organization manages A robust and pervasive risk risk should align with, and support, its strategy, business model, business practices, and risk appetite and tolerance. This is especially true in the financial services industry where Culture throughout the firm significant risk-based decisions are being made throughout organizations on a daily basis. is essential. This risk Culture Essentially, a Risk Intelligent Culture exists within an organization when its employees'. should be embedded in the understanding and attitudes toward risk lead them to consistently make appropriate risk-based decisions. Consequently, an organization's risk Culture drives the behaviors way the firm operates and that influence day-to-day business practices, and is a significant indicator of whether the should cover all areas and organization embodies the characteristics of a Risk Intelligent Enterprise.

2 1. To a large degree, an organization's Culture determines how it manages risk when under activities, with particular stress. For some organizations, their risk Culture is a liability. For others, it facilitates both care not to limit risk stability and a competitive advantage. To that end, an organization wishing to cultivate a Risk Intelligent Culture should first understand and measure its existing risk Culture . management to specific business areas or to have it operate only as an audit or control function.. Institute for International Finance. Reform in the Financial Services Industry: Strengthening Practices for a More Stable System. December 2009. 1. Please see Resources for a Risk Intelligent EnterpriseTM for more information on Risk Intelligent Enterprise management, available on 1. Understanding risk Culture Risk Culture encompasses the general awareness, attitudes, and behaviors of an organization's employees toward risk and how risk is managed within the organization.

3 Risk Culture is a key indicator of how widely an organization's risk management policies and practices have been adopted. Having a Risk Intelligent Culture means that everyone understands the organization's approach to risk, takes Key characteristics of a Risk Intelligent Culture personal responsibility to manage risk in everything that they do, and encourages others to follow their example. The Commonality of purpose, values, and ethics organization's symbols, management systems, and behavioral People's individual interests, values, and ethics are aligned with those of norms should be aligned to encourage people to make the organization's risk strategy, appetite, tolerance, and approach. the right risk-related decisions, and exhibit appropriate risk management behaviors. Universal adoption and application The first step is to understand the existing risk Culture and Risk is considered in all activities, from strategic planning to day-to-day measure how well it supports the organization's risk strategy operations, in every part of the organization.

4 And risk management approach. Deloitte's Risk Culture A learning organization Framework and corresponding Risk Culture Survey provide a structure and process to help clients in their efforts to The collective ability of the organization to manage risk more effectively achieve this. is continuously improving. Timely, transparent, and honest communications People are comfortable talking openly and honestly about risk using a common risk vocabulary that promotes shared understanding. Understanding of the value of effective risk management People understand, and enthusiastically articulate, the value that effective risk management brings to the organization. Responsibility individual and collective People take personal responsibility for the management of risk and proactively seek to involve others when that is the better approach. As used in this document, Deloitte means Deloitte LLP and its Expectation of challenge subsidiaries.

5 Please see for a detailed People are comfortable challenging others, including authority figures. description of the legal structure of Deloitte LLP and its subsidiaries. Certain services may not be available to attest clients under the rules The people who are being challenged respond positively. and regulations of public accounting . Cultivating a Risk Intelligent Culture : Understand, measure , strengthen, and report 2. Measuring risk Culture Exhibit 1. Deloitte Risk Culture Framework nc e Or ga A focused assessment is te pe n needed to fully understand ctives om Knowle iza an organization's current ics tio kc Strategy eth n & obje Ris s sse &. d risk Culture and to track ge ce es Sk o lu pr s ills Va Le s, re arn cie edu ing o l P pro &. i c progress of cultural Recru itm & induc ent tion Risk go vernanc e change. Risk ce Culture Deloitte has developed a broad approach to helping clients assess Performan nt Chall enge and measure risk Culture based on our Risk Culture Framework.

6 The me manage framework consists of sixteen Risk Culture Indicators aligned to the n M. an four Risk Culture Influencers. a tio ag ient em or en Our Risk Culture Survey allows us to measure an organization's risk Le t es k Ris tiv ad Comm bility Culture against each indicator. Once an organization's risk Culture is en ers Inc understood, we can use the Risk Culture Framework to identify and hip ta ps unicat Accoun M. recommend specific target areas in order to help strengthen it. hi va ot ns ti o ti o i la ion n Re Risk Culture Influencers Risk competence Motivation Relationships Organization The collective risk The reasons why How people in How the management people manage risk the organization organizational competence of the way they do. interact with environment is the organization. others. structured and what is valued. Source: Deloitte Source: Deloitte Consulting Consulting LLP LLP. 3. Strengthening risk Culture Strengthening an organization's risk Culture requires focused effort and the support of leadership.

7 The organization's initial focus should be on building cultural awareness, predominantly through communications and education. Cultural improvement will likely require meaningful changes to established ways of operating. Once the desired risk Culture has been established, the organization should continually refine it to reflect ongoing changes in business strategy. Finally, it is important to recognize that this road map focuses on the cultural aspects of risk management. The assumption is that all the components of a formal risk management structure have been adopted, or are being implemented, by the organization. A strong and Intelligent risk Culture requires that this risk infrastructure be in place and be effective. Exhibit 2. Risk Culture Influencers Road Map for Continuous Cultural Improvement Cultural Cultural Cultural awareness change refinement Build risk competence Risk competence Risk function Deliver Create a Culture Integrate risk Existing employees communications of constructive management New employees from leadership challenge lessons-learned Future employees using a common into communications, risk management Embed risk education, and training vocabulary performance metrics into motivational systems Hold people Clarify risk management accountable for their responsibilities and Establish risk management actions accountabilities considerations in talent Refine risk performance Align motivational systems management processes metrics to reflect Incentive systems Roll out risk Motivation Position individuals with changes in business Reward systems management general the desired risk orientation strategy, risk appetite.

8 Performance systems education and in roles where effective and tolerance Individual and team accountabilities customized training programs based on role risk management is critical Reposition Reinforce behavioral, individuals to Establish risk reflect changes management in ethical, and compliance standards to business induction programs strategy Strengthen relationships Refine recruitment and priorities Leaders to managers Relationships methods to include Leaders/managers to employees risk management Peer to peer capabilities Risk function to businesses Enablers Leadership commitment Secure the buy-in and commitment of the leadership team, including executives and the board Promote organizational risk Communications Communicate program goals to all stakeholders, and Organization management infrastructures proactively seek out feedback Governance and reporting protocols Measurement and reporting Establish an objective measurement of the Procedural protocols organization's risk Culture and report on it regularly Behavioral and ethical expectations Compliance expectations Program management Manage as a program of change, including coordinating with other relevant change initiatives Source: Deloitte Consulting LLP.

9 Cultivating a Risk Intelligent Culture : Understand, measure , strengthen, and report 4. Reporting risk Culture Organizations should include risk Culture metrics in their regular risk reporting to the board and management. These quantitative cultural metrics should also be supplemented with those risk management metrics that are the key leading and lagging organizational cultural indicators. Exhibit 3. Risk Culture Report XYZ Corporation Risk Management Metrics XYZ Corporation Risk Culture Metrics Compliance with mandatory training requirements (0-100) . We are continuing to experience the gradual strengthening of our risk Culture across the organization as a whole. This follows the significant decline that we experienced in 2009 resulting from the insurance business acquisition in Europe that completed in late 2008. Related to this, we remain significantly below leadership's cultural expectations in our European Insurance business.

10 We still have a number of leadership and management integration-related challenges remaining (notably in France, Spain and Italy). Addressing these is one of our top priorities. In terms of cultural leading practices, Asia Pacific continues to serve as a model and we are in the process of codifying a selection of risk management practices from our australian business and will pilot them in other geographies in late 2012. Organizational Risk Culture (0-100) Divisions (0-100) . Organizational Risk Culture (0-100) Divisions (0-100). 66 70 Insurance Divisional managers with risk 64 Acquisition of the Corporate Bank European Insurance 60 weighted performance metrics Retail Bank (0-100) . 62 Business 60 50. 58. 40. 56. 54 30. 2008 2009 2010 2011 2008 2009 2010 2011. Cultural Influencers (0-25) Regions (0-100) . 20 70 LATAM Limit breaches*. APAC. 18 EMEA. 60. 16. 50. 14. 12 40. 10. 2008 2009 2010 2011 30. 2008 2009 2010 2011.