How can you identify hidden risks in your organization's culture?

In my experience, Identifying hidden risks in an organization’s culture involves actively seeking employee feedback, conducting anonymous surveys, promoting open communication, and monitoring behavioral patterns to uncover potential issues that may impact the organization’s values and objectives. Regular assessments and a commitment to addressing concerns are crucial for mitigating hidden risks in organizational culture.

Diante da falha na ades?o ao fit cultural da empresa, podemos aplicar aos colaboradores alguns formulários para entender a demanda e diagnosticar os riscos ocultos da n?o ades?o com a miss?o, vis?o e valores!

Simplest way is- how does organization respond to any bad news- reactions can range from outright rejections of the obvious (non acceptance) to shooting the messenger itself (why did you tell the news in the first place)!. Both extremes lead to a bad risk culture & discourages people to speak up.

Identifying hidden risks involves scrutinizing communication channels, assessing decision-making processes, and analyzing dependencies within the organizational structure. Look for silos, unclear responsibilities, and potential bottlenecks. Encourage open communication to uncover unspoken concerns and evaluate how well the structure adapts to change. Regular risk assessments and feedback mechanisms help unearth hidden risks that might otherwise go unnoticed.

It's important to allow open communication to improve the risk culture in relation to hidden risks.Employee's must feel safe to point out issues in their areas of operation without adverse reactions from their supervisors

Engage in open dialogue: Encourage employees at all levels to share their observations and experiences. Often, employees are aware of cultural risks but may be hesitant to speak up due to fear of repercussions. Monitor behavior: Leadership behaviours often set the tone for an organization's risk culture. It's important to observe if leaders are demonstrating a risk-aware culture. Leverage whistleblowing systems: These systems can be a source of information about hidden risks related to culture. Ensuring anonymity and protection to those who report can encourage more openness.

We tend to pay attention to ‘obvious’ risks. Some risks we don’t have pre-determined ‘indicators’ for, hidden risks. Hidden risks are often hiding in lack. Lack of employee feedback, lack of client response, lack of stakeholder engagement. Lack often signals growing risk, especially where the lack is growing: Where employees are unwilling or unable to disagree with key leaders on important organizational decisions. Where clients decline meetings or stakeholders are too busy to engage. Sometimes the best benchmark is past performance (or engagement).

Many organizations often limit their risk assessment by relying solely on annual employee survey results, mistakenly assuming that such surveys accurately reflect the organizational culture. However, these measures, if used singularly, are unreliable. To understand the whole picture, organizations should complement survey data with metrics such as inclusion and diversity indices, decision-making processes, voluntary attrition rates, insights from exit interviews, recognition practices, and management of employee appeals and concerns.

Examples: Indicators of Incentive structure (ESG-linked variable executive remuneration- contrast with a strategy focused on growth at all costs) ,Indicators of whistleblowing (people feel safe reporting behaviour through the tool without fear of repercussions)

It is important to consider the interrelationships and relevance of performance metrics to be able to obtain adequate view of what's happening and be able to predict or foresee certain potential failures in the horizon. The access to relevant and reliable data is critical in enabling a more effective and on-point identification of risks.

This method is quite useful if you have built rapport among your internal and external stakeholders. Internally, you could initiate: 1) "Risk Talks" with corporate governance functions ( Internal Audit, Compliance, Legal, and Decentralized Risk Teams) to discuss the upcoming trends and risks from their holistic perspectives. 2) "Risk Workshops" with business units and supporting functions to better understand the correlation of risks. Read between the lines and look for might've not been explicitly mentioned by other departments. Externally, you could engage in: 1) "Roundtable Discussions" with other Risk professionals, Authorities and other agencies relevant to your organization to align on best practice.

To really understand what's going on in your organization and find hidden problems, it's important to get honest feedback from your employees. One way to do this is by conducting anonymous surveys. This lets employees speak their minds without worrying about negative consequences. Holding regular meetings or focus groups where employees from all parts of the company can talk about the company's culture is another good approach. These meetings should be a safe space for open and honest conversations. Another helpful tool is having a suggestion box or an online feedback system. This gives employees a constant way to share their thoughts and ideas about how the organization operates.

Feedback is critical, but also what you do with the feedback. All of your websites, internal CRM systems should contain ways for feedback to be captured, stored and open to contribution by the team. These are a great source of material to bring to meetings, coffee meet ups etc. It was interesting that the COVID lockdowns forced us into remote working and we have seen some great “chat” sessions on line. I am concerned with the diluted face to face post COVID.

A collaborative approach among governance stakeholders should result to a progressive attention and reaction to current and potential issues. Harmonizing external and internal feedback mechanisms and sources, audit results, violations registers, etc. improves efficiency and timely drive for actions.

to add to what my colleagues already mentioned that The type of organization structure and size also the geolocation of your employees and customers impacts the way your receive the feedback and inputs while monitoring current controls or exploring new areas of development or expansions which will impact identifying hidden risks.

After risks are materialized in incidents or near misses, root causes need to be analyzed by risk managers. This analysis helps to find vulnerabilities in the controls and understand any biases in the decision-making. Analyzing trends and patterns in these incidents also allows identifying abnormalities. Using machine learning can be really helpful in finding connections and giving early warnings about potential problems.

On thing I found helpful ! In Australia, learning from risk incidents is essential, especially after recent scrutiny in sectors like finance, where events highlighted by the Banking Royal Commission have driven a stronger focus on risk analysis and transparency. Regular reviews and corrective actions not only address past incidents but also build a proactive risk culture, keeping organizations resilient in a complex market.

One thing, I have understood is that identifying risk is very natural, its about the impact in short or long term that employees are unable to determine. This way they are unable to identify it as a risk and thus ignore. Providing clarity to understand the definition of risk and what would constitute to be a risk is more required. Many RM's feel its only a annual or regular act of filling up the excel in which pre-filled questionnaire would give an output which has to be copy & paste to give the risk identified. When the clarity comes, employees would not stick to regular or pre-defined method of identifying risk. They would identify from their or others regular work, the hidden risk and that would be a more valuable input.

En mi experiencia, la falta de una cultura de riesgos en las organizaciones desde las altas esferas hasta el empleado más humilde, fomenta gran cantidad de riesgos ocultos. Y es que lo que no se conoce y no se identifica, no se puede gestionar. Gestionar los riesgos operativos, financieros, legales y, en fin, de todo tipo de la empresa, debe convertirse en una tarea cotidiana y sistemática en las organizaciones, no para medir la vulnerabilidad o exposición de la misma a la materialización de los riesgos y sus consecuencias, sino para tener el control de los mismos y darles el tratamiento debido, que conlleve a su mitigación o erradicación total.

Hay demasiados incidentes de riesgo que no se reportan y por tanto es complejo dar un orden de magnitud real al riesgo materializado e incluso a simular riesgos potenciales o impactos potenciales. De ahí la importancia de que exista cultura de autoregulacion y autocontrol, pero también de reporte. De nuevo, cultura y ver los problemas como oportunidades.

Avaliar a cultura de risco é uma tarefa desafiadora, porém muito importante. Existem riscos ocultos na organiza??o, riscos esses que devem ser identificados para que a resposta possa ser eficiente.

The interesting paradox here is that we as risk professionals are part of that culture and it's embedded 'norms'. So you have to question are we always best places to identify cultural issues? In many respects this under scores the importance of third party involvement, preferably commissioned and reporting to a committee made up of a majority of independent directors. If your budget can't run to this type of review, look to the findings of industry inquires (and not just those in your industry) and ask 'could it happen here': it's where the real gold is. The reviews I have read all seem to have one common thread...if you want to look at an organisation's culture, start by looking at its renumeration structures...

Hidden risks can easily surface if the organization's attitude towards risk management is driven by the top leaders. They set the tone and establish the company's risk culture which will eventually dictate of how comprehensive the risk management execution.

En base a mi experiencia, la cultura organización se construye desde el alto mando, considerando de asumir y destinar los recursos para diagnosticar la situación global propia y de sus empleados, sin esta visión no es factible diagnosticar. Además, se debe tener en cuenta que de la evaluación nacen planes de trabajo para hacer gestión y mantenerlos en el tiempo, no es una prueba que entrega un reporte y se guarda. Luego, la empresa debe considerar hacerse cargo de la mantencion y mejora de esta cultura a futuro.

To know the hidden cultural risks within an organization, an integrated approach is essential. Regular anonymous employee surveys encourage feedback, shedding light on unseen issues. Complementing this, an open-door policy not only invites ongoing dialogue but also reinforces trust, enabling staff to voice concerns without fear. Examining performance metrics with a cultural lens can highlight discrepancies that hint at underlying problems. Together, these strategies can reveal and help address the subtle, often overlooked risks embedded in an organization's culture.

Embracing ongoing, collaborative change and improvement is fundamental for robust risk management. Aligning these initiatives with our risk appetite, closely monitoring outcomes, and celebrating successes collectively contribute to a culture adept at identifying and addressing hidden risks effectively.

Job rotations and three years maximum contracts with third parties, segregation of duties are all methods to shake the stagnant water and see the hidden fish.

Communication, when implementing change and improvement, is vital across the managent levels. Change will bring with it new risks and can fragment different people groups within the organisation. No surprises! Teams do not like surprises. I have seen C-Suites implement change quickly and have destroyed the culture.

Culture is key for organization's success and any failure in organization culture results in toxic culture which will contribute to the de-growth of the organization. Identifying the hidden risks in organization culture is key. Aspects to be considered are: 1. Culture assessment or audits to identify hidden risk with the current culture, culture tenets 2. Identifying the gaps in the culture with regards to the expected culture along with identification of any hidden risks 3. Insights from employees, customer, third-party on the culture & any risks they foresee 4. Expertise review of the organizational culture, ways of working to identify hidden risks It key to develop a list of hidden risk and mitigation plans to address hidden risks

Hidden risks in organizational culture are like unseen currents—impactful yet not immediately obvious. They hide in subtle behaviors and unspoken norms. Identifying them demands a keen understanding of leadership, governance, communication, and education's influence. Regular evaluations, benchmarking, and a thorough analysis reveal these concealed risks, allowing organizations to proactively strengthen their resilience and risk management.

Um dos pontos mais importantes para trazer a tona numa avalia??o de riscos é o qu?o a empresa está comprometida com a gest?o em todos os níveis da organiza??o. Neste caso, o professional de seguran?a da informa??o pode fazer duas a??es fundamentais para trazer ainda mais perto os profissionais das empresas: - Trabalhar conteúdos sobre riscos de tecnologia a partir de a??es coordenadas dentro de programa de conscientiza??o com exemplos claros e relacionadas às atividades do dia a dia. - Buscar aproxima??o da vis?o/miss?o da empresa para a gest?o de forma que fique claro qual o interesse da organiza??o e das equipes em mitigar estes riscos versus os objetivos tra?ados pela companhia (o que facilita para cria??o do programa de conscientiza??o)

Identifying hidden risks in organizational culture is crucial for stability. Key standards guide risk management but often miss aspects like leadership's role in fostering a risk-aware environment and the importance of open communication. Tailored training and responsible use of analytics tools are essential in revealing risks. Promoting a safety culture where hazard reporting is encouraged is also key. Integrating these elements strengthens an organization's ability to manage risks, ensuring safety and integrity. Leadership's commitment to transparency and strategic training and technology use is central to this approach.

It is important to remember that addressing hidden risks in your organization's culture takes time and effort. However, it is an investment that is worth making, as a positive and healthy culture can lead to increased productivity, employee satisfaction, and customer loyalty. It is important to note that there is no single answer to the question of how to identify hidden risks in your organization's culture. The best approach will vary depending on the specific circumstances of your organization, an excellent start point is what was mentioned in this article