Assessing internal risk communication in a financial service organisation

Abstract

Effective internal risk communication is critical for strengthening risk culture and ensuring consistent engagement with risk management processes across all levels of a financial institution. While frameworks and standards such as ISO 31000:2018 and the Basel Committee on Banking Supervision's (BCBS, 2021) Principles for Operational Resilience provide structural guidance, the internal flow of risk information remains underexplored, particularly within African financial services organisation. Most of the literature highlights external risk communication with regulators, investors, and other stakeholders, leaving internal communication dynamics inadequately examined. The study addressed this gap by assessing internal risk communication effectiveness within a South African financial services organisation. This explorative study employed a quantitative survey-based approach, using an adapted version of the Communication Satisfaction Questionnaire (CSQ) to measure employee perceptions across hierarchical levels: senior, middle, and operational staff. The instrument was refined to capture three factors central to internal risk communication: relations with supervisors, communication climate, and personal feedback. A purposive sample of 67 employees was drawn from firstand second line risk department functions. Data were analysed using Cronbach's alpha aimed at reliability, the Kruskal-Wallis H-test for group differences, and the Mann-Whitney U and Spearman rank correlation tests to assess associations between the lines of defence. The findings revealed high internal consistency across factors (α = 0.79 to 0.92). There were no significant differences observed across hierarchical levels for the first and second lines of defence, suggesting consistent communication perceptions. However, a statistically significant difference (U = 112.00, p = 0.044) was found in personal feedback between the two lines, indicating a communication gap between risk ownership and oversight functions. The study concluded that while overall internal risk communication was cohesive, feedback mechanisms required strengthening to enhance operational resilience and risk awareness across defence lines.