“You have to get senior leadership buy in from the top. If you are not getting them to drive the message then you are losing the battle from the start. Culture must be embedded through front line leaders,” said Ms Bennett.

Risk managers should be aware that there are generally two types of senior leaders—those that react well to quantitative facts and figures and those that respond to more emotional and creative risk reporting, she argued. Risk managers must alter their approach accordingly.

Whatever makes them tick resources need to be forthcoming from senior management, which needs to provide assistance at all times.

To achieve an organisation-wide culture risk managers must position risk champions throughout an organisation that will help them to fight their cause and bring others on board, advised Ms Bennett.

The risk champions must have the mandate and authority to be effective change leaders and exert influence, she explained.

“This means you also have to be able to select the right people with an influential voice. Having risk champions scattered through the business can really help. If you are a lone voice you can be a very busy person and not create much change,” she continued.

According to Ms Bennett, a risk champion should not be the risk owner in their own area of the business. Often risk champions do not have the authority to truly own the risk, which can cause severe problems and muddy the waters.

The risk champion role works well, however, when they are seen as the person who is trained to understand the language of risk and facilitate the risk process. They then become the traditional risk owner’s first of port of call on risk-related issues, said the risk consultant.

“It needs to be someone with a deeper understanding of the risk management process within an organisation, but the line managers must still have the responsibility for the risk. When they are confused they have this ‘go to’ person who can help support the process. For me that is where I have seen risk champions work very well,” she said.

Ms Bennett also suggested that a clear and coherent risk language should be adopted within, and across, an organisation. It must be consistent across the various risk functions and not necessarily be an off the shelf dictionary, such as provided by the ISO 31000 risk management standard.

“Your governance programme has to provide a clear language. I think some of the standards across specialist risk areas get in the way of this. The language of ISO 31000 doesn't necessarily match up with the language of environmental for example. We all have different languages but you have to get the same language somehow in an organisation, so people know they are talking about the same thing,” she urged.

Risk culture is also dependent on a responsive reporting structure that allows information to get up to senior level and return promptly with a response.

An inability to make decisions on risk can obviously kill the function. “If the structure is not responsive it causes blind risk appetite. The linkages and the integration are absolutely critical. If anyone in the organisation has a key risk to talk about they have to know there is a clear and easy path up to the board and back down again,” said Ms Bennett.

Although the roles of others are crucial, risk managers must take a long and hard look at themselves in case they are hindering the development of a positive risk culture.

According to Ms Bennett, risk managers need to show the value of risk management to ensure that others play ball.

Risk professionals are change managers and must adopt that discipline’s theory to succeed, she continued. “This is the theory you really need to use, risk management just happens to be the tool you are levering the change with.”

And risk managers cannot be everywhere at all times, they must not be seen to want to own all of the risks within an organisation, noted the risk consultant. “You are the facilitator and not the owner of the risk.”

To fulfil this facilitative role risk professionals need to know who the key stakeholders are within their organisation and have the time and gumption to influence those around them.

For the correct culture to flourish it is important to avoid a blame culture developing in an organisation, continued Ms Bennett. This will result in a lack of trust, which is exactly the opposite of what risk professionals should be trying to create.

It is imperative that the risk function does not work in silos and that it removes resistance to change, Ms Bennett continued.

Concluding her presentation, the consultant half joked that if risk professionals implement all of her recommendations without any success they should look for a new job in an organisation that values what they are trying to achieve.

Although lighthearted this may well be the most sage piece of advice a battle-weary risk manager can take on board.

Please sign up here to our full-time mailing list to ensure that you receive our weekly newsletter.

• More Australia and New Zealand News
• More Risk Management News