Assessing and Re-setting Culture in Enterprise Risk Management

Among the tenets of enterprise risk management (ERM) is the need to instill a risk-aware culture throughout the firm. Yet, how to actually interpret and change organizational culture is generally missing from the ERM literature. Prior surveys found risk managers lacked useful information about organizational culture and cultural change to implement a “risk aware culture.” Our survey of risk managers found this gap persists. The disciplines of organizational studies, business anthropology and sociology provide guidance on organizational culture, which involves identifying and interpreting the embedded assumptions, values, myths, artifacts, rituals, and stories that communicate and perpetuate a culture. The risk manager can use this knowledge to apply change to the culture. Changing behavior without changing culture may simply result in compliance without adoption. This article seeks to bridge the studies of organizational culture and change to the risk manager.