November Culture: what does it look like and how does it impact risk management?

Transcription

1 November 2012 Culture: what does it look like and how does it impact risk management?

2 Discussion agenda Providing the context culture modelling Observing behaviours through case studies Opportunities for risk management PwC 2

3 PwC 3

4 PwC s culture model What are the key features of good culture? Accountability/ Reinforcement Infrastructure Leadership/ Strategy Culture People/ Communication Behaviours/Outcomes Knowledge/Skills/Abilities Supporting Infrastructure PwC 4

5 Risk culture made simple Three key factors drive behaviours within an organisation Belief Communicating what s important to the business tone from the top Skills Employees having required skills to perform their roles Environment The business creates an open environment Behaviours Culture = collection of observed behaviours PwC 5

6 PwC

7 An airline case study James Reason model aviation accident causal model PwC 7

8 An airline case study Cultural considerations in relation to safety To what extent is your safety strategy aligned to your overall business strategy? How is your safety strategy supported by your organisational values? Who is accountable for safety in your organisation? To what extent do your leaders actively support safety? How do you manage consistency in human factors across time and geography? How is safety currently measured and observed? To what extent are your safety policies, systems and processes appropriate to the level of risk? How is safety information communicated (and understood) by your people? PwC 8

9 9

10 An airline case study Cultural considerations in relation to security Are roles and accountabilities of employees driving defined security outcomes? Do employees believe their awareness of security is driven by personal safety motivations, a responsibility to their peers or the organisation? Are there consistent processes, procedures, and perceptions of risk that encourage employees to demonstrate security behaviours? Are business demands and KPIs aligned to promote security behaviours? Do employees understand the linkage between safety and security? Is there appetite for deeper, targeted and relevant security communications? PwC 10

11 11

12 What does this mean for risk management? Strategy Development Is risk articulated/used in business planning? Is risk applied in establishing tolerances/thresholds across business? Are thresholds/tolerances communicated to business? Operations Execution Is risk considered when assessing business initiatives? Are risk characteristics of businesses and products assessed? Management/ Monitoring Performance Measurement Are risk limits/exposures managed against targets/ thresholds/tolerances? Is regular performance reporting conducted? Are breaches openly reported to the Executive (and regulators as appropriate)? Are risk adjusted KPIs embedded in Executive incentives? Do Executive Management rewards include performance against behaviours? Is training updated to enhance skill gaps? PwC 12

13 PwC 13

14 pwc.com.au 2012 PricewaterhouseCoopers. All rights reserved. PwC refers to the Australian member firm, and may sometimes refer to the PwC network. Each member firm is a separate legal entity. Please see for further details. This content is for general information purposes only, and should not be used as a substitute for consultation with professional advisors. Liability is limited by the Accountant s Scheme under the Professional Standards Legislation. PwC Australia helps organisations and individuals create the value they re looking for. We re a member of the PwC network of firms in 158 countries with close to 169,000 people. We re committed to delivering quality in assurance, tax and advisory services. Tell us what matters to you and find out more by visiting us at WL267298