Risk culture : risk reporting versus risk management

Abstract

In recent years regulatory authorities have intensified their focus on ensuring that financial services institutions (FSIs) build and maintain an appropriate risk culture. Risk managers are therefore faced with the challenge to comply with reporting required by regulatory bodies, as well as by their own organisation, as part of their risk management processes. No academic studies were found that focused on the possible effects that complex (regulatory and internal) reporting requirements could have on risk management and therefore on the risk culture of organisations. The purpose of this qualitative study was to investigate the effect of a South African banking institution’s risk reporting approach on the integration of risk management into decision-making. Semi-structured interviews were conducted with 10 full-time risk management employees whose roles included making contributions to their organisation’s quarterly strategic risk reports. The key finding overall was that the risk managers felt that they were spending too much time on risk reporting procedures thereby impeding the effective execution of the risk management process. This hinders the organisation’s ability to make appropriate decisions and ultimately weakens the organisation’s risk culture. The present study highlights the importance of recognising the potentially significant impact of reporting, as part of the risk management process, on an organisation’s risk culture and suggests criteria for the diagnosis of risk culture issues in relation to risk reporting.