View the Standard

Weaknesses in risk culture were a root cause of the global financial crisis, as they led to failures in compliance. Culture can be a very complex issue as it involves behaviours and attitudes. But efforts should be made by financial institutions and by supervisors to understand an institution’s culture and how it affects safety and soundness. While various definitions of culture exist, supervisors are focusing on the institution’s norms, attitudes and behaviours related to risk awareness, risk taking and risk management, or the institution’s risk culture. A sound risk culture consistently supports appropriate risk awareness, behaviours and judgements about risk-taking within a strong risk governance framework. A sound risk culture bolsters effective risk management, promotes sound risk-taking, and ensures that emerging risks or risk-taking activities beyond the institution’s risk appetite are recognised, assessed, escalated and addressed in a timely manner.

The Guidance on Supervisory Interaction with Financial Institutions on Risk Culture sets out a framework to assist supervisors in their assessment of risk culture and identifies some foundational elements that contribute to the promotion of a sound risk culture with a financial institution. The paper does not define a “target” culture but provides guidance for supervisors to assess the soundness and effectiveness of a financial institution’s risk culture.

Supervisors should assess the processes in place by which core values are communicated, understood, embraced and monitored throughout the institution. In particular, supervisors should assess how the board and senior management systematically assess the risk culture of the institution. Supervisors should also assess the extent to which the institution is able to define its risk culture, document the material elements that support it and actively assess gaps and areas of concern to be addressed or enhanced. The institution's willingness to sufficiently document the elements supporting its risk culture should form part of the supervisor's overall assessment.