Organizational culture has been blamed for many recent disasters. 

These include BP Deep Water Horizon — referred to as both a “culture of greed” as well as a culture that had defects relating to safety, GM — called a "culture where you get fired if you do talk about quality and safety issues, and you get fired if you don’t talk about them”, Toyo Tire — “Toyo Tire’s problems stem from its corporate culture” and VW — "North Korea without labour camps”.

Culture also has been the focus of some interesting articles, including:

Made Up of Many Cultures

I recently spoke with former Chairman of the Institute of Risk Management and author of its publication on Risk Culture, Richard Anderson about organizational culture. I pointed out the many dimensions of organizational culture, illustrated by people talking about "safety culture," "risk culture," "ethical culture" and so on.

No single corporate culture exists. Culture can be quite different between units, departments, locations or teams within a single organization. Culture reflects people, and since the employee population is changing all the time, we should expect culture and the behavior patterns it influences to similarly change. 

However, a dominant culture can emerge that reflects the influence of leadership (whether of the organization, a unit, team or so on), and that influence is likely to remain fairly constant until leadership changes.

Anderson shared the results of some research and study into corporate culture, with an emphasis on risk culture. He mentioned that while many are driven by performance, others are driven by a need for "control." A balance needs to be found.

Some are highly collaborative, while others are prone to taking the lead and directing others to follow.

These differences in personality can drive behavior when it comes to risk decisions — how much "risk" to take.

What's Your Organization's Risk Culture?

So how can you assess whether your organization’s culture is what it should be?

  • Because there are so many aspects or dimensions of organizational culture (safety, ethics, risk, and so on), focus on a limited number of dimensions at a time
  • Try to define: a. what you want to see in a model culture; b. how defects in culture would impact corporate success and the achievement of objectives (in other words, assess the risk); and c. how you might identify red flags that would indicate such defects
  • Based on the above, determine appropriate assessment methods and tools. I personally like surveys and have used them with some success in partnership with the Human Resources department. However, we should not underestimate the fact that all of us (if we are alert) can provide input and insight into the culture of our organization. We typically know, or at least suspect, when problems exist in corporate culture.
    I was very much aware of issues at several of my employers, and always a. considered whether they represented a threat to the organization that merited my attention, b. took them into consideration when defining my internal audit plan, and c. discussed serious issues with top management and the board. Of course, I did not rely on my own suspicions. Surveys and interviews provided additional information for confirmation or clarification.

Are you sensitive to the possibility of defects in corporate culture that might represent an unacceptable level of risk — through their impact on decision-making — to the achievement of organizational objectives?

I am interested in your experiences and insights.

Editor's Note: Norman Marks and Richard Anderson will continue their discussionrisk culture and its effect on the management of risk. Details can be found here.