Risk culture is not the attitude people declare on a survey. It is the pattern of what gets rewarded and what gets punished when a real decision goes wrong. Change the consequences that follow a bad call and the culture shifts. Survey the atmosphere and you have measured the weather without touching the thermostat.
In 1987 Paul O'Neill took over Alcoa, required every injury to be reported to him within 24 hours with a corrective plan attached, and then watched the lost-workday injury rate fall from 1.86 to 0.2 per 100 workers while the company's value rose from $3 billion to $27 billion. No survey preceded it, no poster campaign explained it. That is the cleanest lesson I know about risk culture.
When a board or regulator asks for a stronger response to uncertainty, what usually follows is a survey and a paper to the committee. I have seen that routine for decades. It feels serious because the language is approved, yet the real question is much smaller and much harder: what happens when one person has to make one decision under uncertainty?
Risk culture is the pattern of decisions an organisation makes when uncertainty meets incentives, rewards, and decision rights.
What risk culture actually measures
Most frameworks measure signs around the decision, not the decision itself. The industry's best-known attempt is the Institute of Risk Management guide from 2012, which breaks the subject into eight aspects and invites boards to infer culture from leadership behaviour and reward settings. It is serious work. It is also still indirect. A board can complete the whole exercise and still miss the one decision that matters this month.
That guide matters because it is the strongest version of the mainstream case. If even the best framework cannot tell me whether a live decision was made soundly, I do not learn much by scoring the atmosphere around it. A decision record that names the Decider and the assumption the whole decision rests on tells me far more than a staff pulse check. That is why I prefer the Universal Decision-Making Method. It asks what the decision rests on, rather than what people say they value.
In most board packs, risk culture becomes a proxy score for decision quality. The proxy is convenient because it can be surveyed and reported at quarter end. That convenience is the whole problem. If a credit committee can still wave through a bad assumption without challenge, the score has not protected anyone from anything.
Why most risk culture programs miss the decision
They declare the answer before examining the question. I have often asked clients a blunt question: if risk management is the answer, what was the question? The same problem appears here. A board says it wants better judgement under uncertainty, a program begins, and only later does anyone ask which decisions are meant to improve.
Once that sequence starts, the machinery grows quickly. I have watched organisations spend a quarter on surveys and action plans, only to discover that nobody can point to a single decision that now rests on better judgement. That is what happens when an undefined concern is handed to people whose job is to turn it into a system.
Insurers and regulators gave the label early force, then academics and consultants gave it vocabulary and process. The confusion between risk and uncertainty deepened it further. The field has tolerated a standard so cluttered with qualifiers that the core term needed a full page to define. A word that unstable was never going to anchor a stable program.
People do not become careful because a statement says they should. They become careful when the process forces a real question into the room and someone must own the call. That is why these programs so often feel busy and hollow at the same time.
Examine one live risk decision through the five steps and see what your organisation actually rewards after the slogans. Start the Walk →
Barclays had the language and missed the point
The Barclays LIBOR scandal is a useful case because the governance language was already in place. According to the CFTC order issued on 27 June 2012, traders and submitters manipulated LIBOR between 2005 and 2009, and the penalties reached $453 million. Bob Diamond resigned soon after. None of that happened in a vacuum. Barclays had committees and published values all through the period.
If I had been asked to assess that institution before the fines arrived, I would not have started with a culture survey. I would have examined who checked the submissions and how traders benefited from them. The working assumption was that submitters would resist pressure and report honestly even when money and status pointed the other way. Nobody had good reason to trust that assumption, and the process did very little to test it.
The Harvard case on Barclays is useful for the same reason. It shows an organisation that could describe its values fluently while operating a process that rewarded the opposite behaviour. That is a decision design failure disguised as a culture problem. Survey the staff after the event if you like; the useful work would still be to repair the way that decision was being made.
Boards are often tempted to ask whether the culture was weak. The better question is simpler: what did this decision rest on, and what would have exposed the weakness sooner? If those questions are missing, the phrase risk culture has become a polite way of avoiding the mechanics.
How to change risk culture without a culture program
Change the decision process and the behaviour will move with it. O'Neill understood that at Alcoa. By requiring a report within 24 hours and a corrective plan with it, he made bad news travel fast and made inaction hard to hide. The change was structural, which is why the effect ran deeper than a speech. A useful account is in this Forbes piece on the Alcoa lesson.
If I were given a brief to improve the way the organisation handles uncertainty before the next board meeting, I would pick one live decision and make the process visible. Show who the Decider is and what the decision rests on, including the signal that would reopen it. That single exercise will tell you more than another maturity model. It is also why the article on risk-based decision making matters more in practice than most culture papers.
When Roger Estall and I wrote Deciding, Appendix C was blunt about why these programs keep multiplying even when they disappoint. Whole professions earn their living from expanding the apparatus. I would rather see one current decision examined properly than another deck about behaviours. If your board still wants a limit statement, the article on risk appetite explains why that language so often drifts away from the decision in front of you.
Culture improves when ordinary decisions are framed clearly and assumptions are exposed before commitment. It improves again when monitoring is designed before people move on. The Universal Decision-Making Method does not ask people to admire a value statement. It asks them to decide in a way that holds when the facts shift.
You could run another culture program and still leave the decision process untouched.
Work through your decisionNo sign-up. Just pick your decision and start.
Grant Purdy is the co-author, with Roger Estall, of Deciding (2020), and the architect of the Universal Decision-Making Method.