Methodology and Statistical Requirements of A Risk Culture Assessment

Risk Culture: What Is It?

There is no consensus about the general definition of culture (Ogbonna, 1992). Even though, researchers agreed on certain characteristics. Therefore, culture can be described as a social phenomenon that is based on human actions and interactions (Berger & Luckmann, 1966). An important aspect of culture is that culture is seen as a learning process that can be “unlearned” (Schein, 1984; 1985). This is important in so far that it shows that the risk culture or also corporate culture of an institute cannot only be managed but also changed. Moreover, it has been shown that when culture is not useful anymore to the individuals using its beliefs and values, a new set of beliefs and values emerge, which help to cope with the existing problems (Tichy, 1986).

Nonetheless, it is difficult to change culture due to its implicit nature. Thus, explicit action measures must be developed and implemented, since the difficulty of changing for instance tendencies for inappropriate cultures is a complex process. In the last two decades, corporate culture has received much attention, due to its effects on organizational success (Urbanovičová, Čambál, & Babeľov, 2019). Its impact on the financial as well as market performance showed that the culture of an organization positively influences its outcomes and can be a business advantage (Denison, 1984); (Kotter & Heskett, 1992). Like corporate culture, risk culture is based on the shared norms, attitudes, and behaviors within an organization. However, risk culture arises through norms, attitudes and behaviors related to risk management, risk appetite as well as risk perception (European Banking Authority, 2017). COSO and WBCSD define risks as an event with negative impact that has the potential of affecting the achievement of corporate strategy and business objectives negatively (2018). In comparison to that, the ISO 31000 (2009) is more open with its definition of risk and refers to it as an effect of uncertainty on objectives.

Therefore, a risk can have a negative as well as positive impact. As stated of the FSB in (2014), an institute´s risk culture is a crucial factor that influences the decision-making process and behavioral tendencies of the institute’s members. Based on this a sound risk culture contains of the four principles “tone from the top”, “accountability”, “effective communication and challenge” as well as “incentives”. Moreover, it was stated that risk culture takes part in the shaping of an institute´s attitude toward its stakeholders and supervisors (Financial Stability Board, 2014). Similar to corporate culture, a sound risk culture influences an institute positively in e.g., bolstering „effective risk management, promoting sound risk-taking, and ensuring that emerging risks or risk-taking activities beyond the institution´s risk appetite are recognized, assessed, escalated and addresses in a timely manner” (Financial Stability Board, 2014, p. 1). Therefore, risk culture is a subset of corporate culture. Risk culture describes how employees handle risks and can be understood as a holistic and cross-hierarchically construct, which influences how risks are perceived and evaluated (Basel Committee of Banking Supervision, 2015); (Financial Stability Board, 2014).

Since the positive effects through a proper corporate culture have been acknowledged in the last years, the interest in risk culture has grown significantly. Whereas regulators like the FFSA or EBA have focused on the aspect of risk culture as well, this interest has switched into a need to consider it as a relevant factor of an institute´s risk strategy. In addition, the EBA (2017) defines that one of the primary functions of an institute is not only to promote a sound risk culture but also to monitor it. Moreover, they stated that the institute´s risk and nomination committees are supposed to receive reports about the risk culture on a regular basis, including possible action measures in case of any deviations of a sound risk culture. Both of those requests show the need of an accurate assessment of an institute´s risk culture, which enables a long-term perspective and the derivation of action measures.

Image

Relevance

After the global financial crisis in 2008, many commentators all over Europe concluded that the aspect culture had a key impact on the events of the financial crisis (Financial Stability Board, 2014); (Parliamentary Commission on Banking Standards, 2013); (Walker, 2009); (House of Commons Treasury Committee, 2009). As a result, the focus on risk management by the board and the central role of culture, started to be discussed. Besides the global financial crises, there are many other incidents which showed that a lack of appropriate risk culture can lead to a range of operational damages for an institute.

An example of such an incident is the cum-ex-scandal. Cum-ex-transactions denote a legally questionable tax model in which a double refund of capital gains tax is achieved by a short successive (empty) sale and over-the-counter purchase of shares shortly before and after the dividend date (Wendt, 2015). In March 2020, the court regarding the lawsuit against two British bankers decided that not only cum-ex-transactions are illegal, but also that the two accused must fulfill a suspended sentence.

Moreover, as a secondary participant, the Hamburger Warburg Bank must pay a refund of 177 million Euros (Daubenberger & Rohrbeck, 2020). Here, the absence of a sound risk culture resulted in legally questionable behavior of bankers, which caused financial and ethical damages to the institute. A sound risk culture is responsibility of an institute´s management. When it comes to violations caused by an unfunctional risk culture, an institute and its management can expect negative consequences and can be hold accountable. As the Institute of International Finance stated in (2008) the „…development of a `risk culture´ throughout the firm is perhaps the most fundamental tool for effective risk management”. Through a proper risk culture, incidents like the cum-ex-scandal could have been avoided. Furthermore, regulators have acknowledged the need of a proper risk culture as well and implanted those requirement (Federal Financial Supervisory Authority, 2014); (European Banking Authority, 2017); (Basel Committee of Banking Supervision, 2015); (Financial Stability Board, 2014). For instance, the FFSA (2014) and the Banking Act formulated that the management of an institute is responsible for the proper business organization and therefore, for an appropriate and effective risk management on group level (§ 25a Abs. 3 KWG) (Financial Stability Board, 2014). Since risk culture takes effect where the control environment and formal management actions cannot cover, it is crucial for an organization´s risk management.

Consequently, the idea of identifying the nature and type of risk culture in an institute arises and, the question concerning how a non-objective construct can be measured appears. In this case, the first step of managing is to assess the status of a situation. By means of the current situation, issues and areas of further development can be identified. Therefore, an appropriate method of measurement is needed, which can be used on a regularly basis. After implementing actions, the situation needs to be assessed again to pay close attention to the timing and sequencing over time. Here, the effectiveness and efficiency of the actions can be evaluated as well as the over-all result of the testing. So, to appropriately manage risk culture in an institute, the holistic measurement of it is crucial.

Problem of Measurability

Regarding risk culture assessments, there is neither a market standard nor prevalent tools, which could be used. Even though, different definitions and a variety of suggestions about risk culture assessments exist, a standardized and holistic instrument is still missing (Deloach, 2015); (Grant Thornton, 2016). In contrast to risk quantification, risk culture is not based on objective data, which can be evaluated easily. Therefore, the question regarding a research instrument arises that enables to make qualitative data quantifiable. An empirical science with such characteristics is psychology. The field of psychology makes qualitative constructs, such as attitudes and norms measurable through operationalization. Therefore, the characteristics of an individuum can be transformed into a reasonable numeric relative, which can be interpreted on a quantifiable basis. Psychology is a well-established science, which excels through its scientific research methods, statistical approaches, and long-lasting experience (Zimbardo, 1992). Therefore, theoretical constructs are defined, and information related to these constructs are collected through research instruments or methods like interviews, observations, or questionnaires. A construct is a non-empiric circumstance within a theoretical theory (Hermann, 1984). It has a theoretical origin and can be measured through different empirical measurable indicators (Hermann, 1984).

An example for such a relation is the construct intelligence. Intelligence cannot be measured based on direct observations. Here, intelligence is defined on terms of performance in intelligence tests. Therefore, the test defines the construct in this case.Another example of how a construct can be measured through a questionnaire, is the Achievement Motivation Inventory by Schuler (2004). Achievement motivation describes the general desire of an individuum to invest a significant amount of energy and persistence into achieving significant accomplishment, mastering skills and control (Murray, 1938).

The inventory consists of 170 items in 17 dimensions (e.g., Goal Setting, Engagement, Competitiveness, and Self-Control). Those items are supposed to be answered through a sevenpoint Likert-scale from “Does not apply at all” to “Applies fully to me”. The answers of the participant are summed and divided through the number of questions for each dimension of the test. The value resulting from this calculation, must be compared to the norm-values of the population, and then can be interpreted on the positive-negative continuum. These are only two examples of how psychology makes non-empirical data measurable. The relation between the construct and the measurement of its indicators is crucial for the appropriate collection of the intended information. Moreover, it is important to identify, which dimensions of risk culture deviate from the targeted risk culture of the institute. The items of the risk culture assessment load on the different prior developed dimensions of the construct. If the targeted risk culture differs from the actual risk culture, it does not necessarily mean that there is a general lack of culture in all its dimensions. A risk culture assessment has the advantage to give a detailed look on the existing risk culture in an institute. Therefore, it is possible to identify the parts of an institute´s risk culture that need further development. After the assessment´s evaluation, the dimension who need further attention should have been identified and the risk management can start to develop different measures.

Methods

So, how is it possible to measure the shared values and attitudes within an institute and, on a basis on those results, draw conclusions about its risk culture? The variety of psychological research instruments offer different approaches, which would be applicable to such a question and moreover, offer aid of interpretation of the results. Within those different research instruments, it is necessary to comply statistical criteria, which guarantee a high-quality and successful procedure.

Statistical Criteria

A psychological research instrument must fulfill three statistical criteria, which qualify the latter as a respectable research tool. Those three measures are explained in the following.

Objectivity

A research instrument should be independent and therefore free of any external influences. Generally, there exist three different forms of objectivity. First, implementation objectivity, which means that the research instrument should not differ in its results irrespective of who is administering the measure. For instance, it should not make a difference if a scientific researcher or a senior manager collects the data. An additional aspect is that it exists evaluation objectivity. It describes the extent in which the same behavior or test answers of individuals are evaluated in the same way. This often requires a high level of standardization, so external influences can keep down to a minimum. Last, there is interpretation objectivity. The latter describes the extent in which similar test results will be interpreted in the same way. This often requires a set of certain rules, which provide guidance regarding the classification of answers (Döring & Bortz, 2016).

Reliability

Reliability describes the extent to which the variance of test scores can be explained through actual differences in the intended characteristic or trait, rather than by biases or noise. Also, reliability shows if the results of a research instrument are internally consistent over time and an accurate representation of the total population. If the construct is changing over time, the reliability of the construct should capture this. Due to the aspect of internal consistency, it is recommended to use characteristics, which are stable over time, when it comes to the calibration of the test. Moreover, the results should be reproducible under a similar methodology (Joppe, 2000). Regarding risk culture that means that a questionnaire and an observation, with the intention to measure risk culture, should correlate and come to similar results, which would not change even if one would collect the data several times.

Validity

The validity of a psychometric procedure describes “the degree to which evidence and theory support the interpretation of test scores” (AERA, APA, & NCME, 1999). That means that a test with a high validity would produce test scores, which represent the intended theoretical construct. For instance, regarding risk culture, it means that a questionnaire intended to measure the latter would produce test scores, which provide information about risk culture rather than information about related constructs like corporate culture or risk awareness.

Research Methods

The field of psychology offers different research methods, which are qualified to assess risk culture. Each method provides different advantages as well as disadvantages. Their structure, advantages, and disadvantage regarding risk culture, are presented in the following.

Observation

A common research method are external observations. There are different types of how an observation can take place. An observation can either be open, which means that the observer observes the participants openly as a researcher, or covertly in some disguised role. Moreover, the observer can either participate with the research subject and take part in their daily activities, or the observer does not participate and observes without any interactions with the participants. Furthermore, there is a difference between standardized observations, in which the criteria and indicators are defined prior to the observation and not standardized observations, in which the observer generally observes the behavior of participants without any pre-defined criteria or indicators. Lastly, one must differ between direct observations, in which the participants are aware that they will be observed, and indirect observations, in which the observer is not present during the observation situation. An example of indirect observations are laboratory tests or observations through audio or video transmissions.

Regarding a risk culture assessment an external observation could be handled through an expert or trained supervisor. This expert can either be part of the organization or it could be an external expert. When it comes to external experts, risks like unwanted insights into the corporate structure could occur. Therefore, it is questionable if such an insight is practical or even wanted. In contrast it is possible that an internal expert could lead to in internal conflicts like issues regarding competition between different departments. Even though an internal expert already provides the insight perspective, it is possible that other risks caused through a lack of objectivity would occur. Observations have many advantages.

First, observations are immediate. The observation takes place, while specific behavioral aspects appear. Another advantage is the holistic nature of observations. An observer does not only focus on the observed subjects. The observer also considers environmental influences, which appear during the observation. Therefore, they do not only recognize the outputs of a behavior, but also have the potential of identifying causes of it. Lastly, there is the depth of observations. By observations one may possibly observe unconscious behavior, which is not consciously accessible or which the participants are not aware of doing. Although observations provide many advantages, they also have their downside. Observations are limited to visual observable behavior like conversations or the evaluation of digital correspondences like e-mail traffic. Even though one can draw conclusions on basis of the observations, there are boundaries of the practical observable behavior. One major disadvantage of observations are the great effort and resources, which are necessary for observations. In case of risk culture, observations are a rather unpractical method. On the one hand the resources needed to observe an entire organization are comprehensive and on the one hand, the presence of an observer could lead to biased behavior, which would not reflect the actual risk culture of the institute. Moreover, observations are problematic in terms of occupational safety and privacy. Privacy policies, like the General Data Protection Regulation (2016), provide strict regulations regarding the collection of personal data. Since observations are a form of data collection in which aspects of anonymity are violated, actions such as a declaration of consent, data privacy statement, and the enlightenment of the test procedure need to be considered.

Self-report and External-report

A more subjective research method, but also one of the most common ones to collect data about individuals, are self-reports. Those reports are based on introspective answers given by individuals throughout interviews or questionnaires. Advantages of self-reports are that the data is easy to obtain and moreover, sometimes the only possible way to collect data about a research construct. Besides those advantages, self-reports have a huge disadvantage, known as response biases. So called response biases are systematic deviations of the participants reactions. In this case, it is possible that the data do not represent the actual attitude or disposition of the participants. Which response biases exists and how they influence such reports, are explained in more detail under section Implementation.

Another possibility to collect data through introspective answers are external reports. Those reports are like self-reports, but rather than asking the individual directly, the questions are presented to members of their social environment like relatives, friends, or colleagues. The advantage is that the data is more objective, since the information come from a secondary and therefore, inter-subjective source. Nonetheless, external reports are still based on introspection, and they are still exposed to response biases, which must be considered during the data analysis.

Interviews

Through an interview, researchers try to access extensive information about an individual. They are often used if the wanted information is not available through different research methods, or in combination with them, which is also called a triangulation. There are three different degrees of standardization of interviews in psychological research. First, there are non-structural interviews, which do not have pre-defined answers or section of questions. The interviewer talks to the participant openly without any lead. Due to the lack of structure, the statistical criteria of those interviews are mostly violated. The next level of standardization are structural interviews.

Those interviews have a pre-developed section of questions and possible questions, which can be asked during the interview situation. They do have more guidance in comparison to non-structured interviews and therefore, are more objective and valid. The last type of interview are standardized interviews. Those interviews have closed questions, which should be asked as well as a pre-defined sequence in which those questions must be asked. Moreover, they do consist of an appraisal system for the evaluation of the participant answers. Because of this greater degree of formalization, statistical criteria are granted.

Interviews offer different advantages. For instance, they enable to collect nonverbal information of the interviewee, such as lack of eye contact or restlessness. Moreover, the interview situation allows precise and more detailed information, since the interviewer can collect all the information needed through queries and further questions. Also, possible misinterpretation of questions can be minimized since a direct clarification of the questions through the interviewer is given. Furthermore, interviews allow accessibility to individuals, who are not able to perform a questionnaire, like children or visually impaired individuals. Even though interviews offer advantages, they also provide a range of disadvantages. In dependence of the degree of standardizations disadvantages such as a very high documentation and evaluation effort, high professional expertise of the interviewer and the violation of statistical criteria are possible.

Additionally, interviews are time consuming and need much preparation. In case of risk culture, using interviews would be very effortful. For measuring culture, the researcher needs to assess a wide and representative group of the target population. Interviews would be time-consuming and costly in such a sample and are therefore not recommended and should only be used additionally.

As stated before, interviews are often used in terms of a multi-method approach. In such a research design, more than one research method is used to collect data about a construct. Here, a possible usage of interviews could be to use them on a smaller sub-sample like the management level. Since “tone from the top” is one of the four principles evaluated as important through the FSB (2014), it would be interesting to get a more detailed impression of the management perspective of risk culture. Nonetheless, in terms of the whole institute, the implementation of a less comprehensive approach is advisable.

Image

Questionnaires

Questionnaires are the most common research method in the field of psychology. They offer many advantages like being easy to obtain and the ability of being used repetitively. Moreover, they do offer much information in a small amount of time, allow the simultaneous survey of individuals, as well as the personnel effort needed for the implementation of questionnaires is low.

As already presented in the section self-reports, questionnaires do have their disadvantages. Moreover, questionnaires are open to response biases. Traditionally, there are three different approaches when it comes to developing a questionnaire.

Explorative Procedure

In the first case, the explorative procedure, there are no specific hypothesis or assumptions made in advance. The researcher does not know much about the object of research, either because there is not much research done to this point or because the researcher simply wants to explore it without any influential previous knowledge.

The researcher wants to explore a certain field of interest with the aim to find information related to the object of research. It gives a good general first overview about a topic. An example is the usage of the lexical approach for the identification of the Big Five personality traits. Here, the researchers Allport and Odbert (1936) listed all adjectives, participles, and substantives of the 550.000 words of the Webster´s New International Dictionary, which denote personality dispositions.

After reducing this collection of words, through eliminating redundant words or dialect variants, the result was a list containing of four categories with each 3.500 to 5.500 words. Cattel (1946) used these four categories and performed statistical reduction procedures, which result were 181 clusters.

He presented those clusters individuals for evaluation and reduced those results further, ending in a 16-factor framework for personality and its questionnaire. Lastly, Tupes and Christal (1961) used Cattel´s questionnaire on a sample of individuals and did further reduction through factor analysis. The result of those statistical analysis were the Big Five personality traits, also known as Extraversion, Neuroticism, Openness to Experience, Conscientiousness and Agreeableness (Costa & McCrae, 1985).

Throughout this bottom-up approach information were collected and systematically reduced. The approach described a procedure in which the results of each step were evaluated through another sample of individuals and underwent further adaptation. This is a great example of the importance of a long-lasting perspective of psychological measurement and how information from each step was used for further development. On basis of the analysis, hypothesizes and theoretical assumptions can be done. In case of the explorative approach regarding the development a risk culture assessment, two possible approaches can be followed.

Inductive – Bottom-up Approach

An example of a possible explorative procedure in case of risk culture would be that investigators could ask employees by interviews what they believe risk culture is. The first step would be to explore the construct and collect information about it. Then, the investigators would use a prior defined section of questions to ask throughout the employees to define risk culture and collect their perspectives about it. The collected information would be used to develop items, which represent the different aspects of the risk culture within the institute. Like the development of the Big Five, a multilevel approach would be used. The collected information would be classified and tested on a sample of employees. The results of the questioning would be reduced and used to develop a questionnaire. Before using the resulting questionnaire, it is recommended to run a pre-test, which test the appropriateness of the items as well as their completeness. The pre-test should be run through a risk-related sub-sample of the institute. Here, the investigators need to reduce the information again and identify factors, which summarize and represent the collected information. This can easily be done through statistical analysis like explorative factor analysis.

The result of this analysis are factors which represent the main dimensions of what the employees think that risk culture is. Based on the identified dimensions, the items of the questionnaire need to be reduced to create a fit between the items and the dimensions on which they load. This can be done through item analysis (item difficulty, discriminatory power, and Cronbach´s alpha). The resulting questionnaire can then be used on all employees.

Here, the employee´s understanding of risk culture would be measured and can be presented to the senior management and board. Advantages of this approach are that the questionnaire is tailored to the organization. Disadvantages are that it is comprehensive because of the two-step approach.

Moreover, there is the possibility that the identified dimensions through the employees, do not represent senior managements idea of risk culture or in what they are interested of measuring.

Also, since the dimensions are developed through statistical analysis of the data provided by the research instrument, it is possible that the identified dimensions are difficult to interpret. Here, there would not be any kind of prior literature research to the development of the questionnaire, so the resulting dimensions need to be put into context, after one has identified them.

It is possible that this is connected to difficulties, since one does not know how easily the dimensions stand in relation to already existing theoretical constructs.

The result of this analysis are factors which represent the main dimensions of what the employees think that risk culture is. Based on the identified dimensions, the items of the questionnaire need to be reduced to create a fit between the items and the dimensions on which they load. This can be done through item analysis (item difficulty, discriminatory power, and Cronbach´s alpha). The resulting questionnaire can then be used on all employees. Here, the employee´s understanding of risk culture would be measured and can be presented to the senior management and board. Advantages of this approach are that the questionnaire is tailored to the organization. Disadvantages are that it is comprehensive because of the two-step approach. Moreover, there is the possibility that the identified dimensions through the employees, do not represent senior managements idea of risk culture or in what they are interested of measuring. Also, since the dimensions are developed through statistical analysis of the data provided by the research instrument, it is possible that the identified dimensions are difficult to interpret. Here, there would not be any kind of prior literature research to the development of the questionnaire, so the resulting dimensions need to be put into context, after one has identified them. It is possible that this is connected to difficulties, since one does not know how easily the dimensions stand in relation to already existing theoretical constructs.

Image

Inductive – Top-down Approach

Another approach in sense of an explorative procedure would be to ask the senior management to define the dimensions of risk culture. Here, interviews would be the preferable method, due to their precision and detail. Also, the senior management is a relatively small sample. Based on the collected information, dimensions can be formed and items regarding those dimensions can be developed. Like the Inductive – bottom-up approach, the inductive – top-down approach is based on a pre-test design. The developed items will be tested on employees. The results of those testing’s would be exposed to statistical analysis, such as explorative factor analysis and item analysis to secure the appropriateness of the items and to identify the factors, which represent the dimensions of risk culture. Based on the statistical analyses, the questionnaire can be formed, and risk culture can be measured within the institute.

In this approach the implicit knowledge, expectations, objectives and demands regarding risk culture of the senior management are operationalized and it is tested if those assumptions are represented within the institute. An advantage of the approach is that the dimensions represent what the senior management thinks of what risk culture should be. Nonetheless, it is not secured that the questionnaire measures risk culture, since there is no literature review, and the questionnaire is only based on assumptions and the implicit knowledge of the senior management. Therefore, it is possible that the questionnaire only measures partial aspects of risk culture.

Confirmatory Procedure

In contrast to the explorative procedure, the goal of the confirmatory procedure is to test hypothesizes, which have been formulated prior to the testing. This way of testing is used when much information about a topic is already available. Moreover, it is used when the investigators want to gain more detailed knowledge about a certain topic.

Deductive – Top-down Approach

In case of risk culture, a confirmatory approach would be to research about the construct and its related constructs like error culture, leadership style, awareness, and incentivization (FSB, 2014). After the literature research, risk culture should be defined in cooperation with the Senior Management of the institute. When the definition of the construct and its dimensions are developed, the process of designing a questionnaire can take place. The questionnaire would consist of items, which represent the different dimensions of risk culture, and a Likert-scale that allows appropriate responding on a positive – negative continuum. Prior to the execution of the test, one should do expert ratings of the items to secure their reliability. After this the questionnaire can be run through the employees of the firm. After evaluating the results of the questionnaire and the statistical analysis like confirmatory factor analysis, the items can be revised like it was recommended in the explorative approach. In contrast to the first approach the results of the questionnaire will show if the prior defined risk culture of the Senior Management is lived through the institute or if there are variances. In comparison to the explorative approaches, here risk culture would be measured through an external standard, rather than based on internal assumptions and knowledge. Advantages of this approach are that the questionnaire measures the risk culture defined by the senior management and therefore, follows a top-down approach. A disadvantage is that if the questionnaire has been revised through item analysis after the first run, the results cannot be compared to the results of the following elicitation. Therefore, it is recommended to do the revision of the test and then, run the test a second time. Not only are the items of the test more accurate and statistical correct, the results are then also available for comparison with later elicitation.

Image

Implementation

With regards toward the implementation of a risk culture assessment, several formal and ethical relevant aspects as well as research biases, must be considered.

Confidentiality and Anonymity

Research studies have the potential of revealing embarrassing or potentially damaging information about its participants. Therefore, it is important to keep one´s participants` identities anonymous. A simple and common way to provide their anonymity is to create pseudonyms. Those pseudonyms or participant codes are created by the participants and normally consists of a combination of letters and numbers. In case of organizational behavior research, it is likely that employees show biased response tendencies based on their worries about their anonymity (Donaldson & Grant-Vallone, 2002). For instance, in small organizations or departments it is easier to identify certain employees based on their socio-demographic information.

Here, it is likely that employees would not answer honestly, rather than social desired. How to handle those response biases and which socio-demographic characteristics of the employees are still important to collect, are described in the following sections.

Socio-demographic Characteristics

Socio demographic characteristics are variables dealing with for example the age, sex, education, ethnicity, religious affiliation, and marital status of one´s participants. Those variables can be used for the creation of index variables, such as the socio-economic status, which appears out of the combination of education and income. Furthermore, socio-demographic characteristics give an overview of the population. The more variance of aspects such as ethnicity, cultural and educational background are represented in the sample, the more reliable are statements regarding the sample, applied on the general population.

On the one hand this data can be used to describe one´s sample, but on the other hand it is also used to determine sampling error. In the case of risk culture, it makes sense to collect certain socio demographic characteristics about the employees, such as period of employment, department, and hierarchical level. For instance, one would want to know in which department people work, since the risk culture could vary throughout the departments. Therefore, it is good to identify, which areas of the institute need measures because of a lack of proper risk culture. The difficulty is to collect the socio demographic information needed and still provide the participant´s anonymity.

Forced-choice

Forced choice is a response format in the usage of questionnaires. In this case the participants are forced to answer each item. So, if participants are answering a set of questions of an online questionnaire, the participants would not be able to skip to the next page of questions, until they answered every single question on the current page. The advantage is that unanswered questions and incomplete datasets are avoided. Therefore, it is recommended to use such a response format. A disadvantage is that the dropout rate could increase, if items do consist of critical content and the participant do not comfortable with it.

Free Text-feedback-function

A free text-feedback option makes sense to include at the end of a questionnaire since it helps to further advance the questionnaire. The opinions and feedback of the employees help to develop the assessment further and influences the acceptability of such assessments positively.

Response Rate

The response rate of a questionnaire gives information of how many people have answered your questionnaire. Based on the rate one can retrieve information about the acceptability of the questionnaire by the employees. Also, generalization of reliable statements over the population, is influenced by the response rate, since a certain number of participants is needed to do such generalizations. In case of a low response rate, it is recommended to emphasize the importance of the questionnaire through the Senior Management as well as direct leaders of the different hierarchical levels.

Response Biases

When it comes to the collection of data through questionnaires, one needs to be aware of common response biases that distort the data. It exists different types of biases and based on the case, different approaches to handle them. One can differ between formal response biases, which describe the direct response behavior of participants and content related biases, which distort the content of the participants answers. An example of formal response biases is the acquiescence tendency, which describes the participants tendency to consent regardless of the item´s content. Moreover, there is the error of central tendency, which is the tendency of participants to avoid the extreme and use one of the middle scale points of a Likert scale. The opposite is the error of extreme tendency. Here, the participants either tend to choose the extreme low or extreme high scale points of a Likert scale. Those kinds of errors need to be considered, since they distort the data during the statistical analysis. Mostly, they can be detected through simple analysis programs. It should be considered to leave those kinds of participants out of the analysis, since their answers do not represent the institute´s risk culture.

One of the most common content related bias is social desirability. It describes the response tendency of participants into social favorable and acceptable directions, even though they do not represent their actual attitude or behavior. Regarding the corporate context, social desirability could show its influence in the way employees would evaluate their own work as well as their colleague´s work. Employees would show the tendency of evaluating in a more positive manner to avoid a negative depiction of the former. As stated in the section Confidentiality and Anonymity, in organizational behavior research this bias is likely, since employees could believe that their response could anyhow be tracked to their identity (Donaldson & Grant-Vallone, 2002).

Possible ways of reducing this effect is to use participant codes and assure the participants that their anonymity will be secured or completely resign of pseudonyms. The difficulty is that social desirability can occur, even if precautions regarding anonymity have been considered. Especially in small institutes or departments it is likely to occur. Lastly, there is the Hawthorn-effect (Roethlisberger, Dickson, & Wright, 1939). This effect describes the influence of the experimenter towards the participants of an investigation. Because of the presence of the experimenter, participants change their behavior or response tendencies. This could be handled through an online questionnaire, since the possible feeling of being investigated by a superior would be reduced.

Evaluation

When evaluating the results of the risk culture assessment, different aspects should be considered. First, it should be evaluated if the results of the questionnaire match the expectations of Senior Management as well as the corporate objectives. If the risk culture does not meet the culture desired by management, it should be analyzed where those variances are and if they either emerged through a lack of risk culture or if the aspects has not been considered in the questionnaire. Those variances should be detected and need further analysis in order to develop concrete action measures. Furthermore, it must be analyzed if the risk culture and the institute´s strategy are compatible with each other. Since it is stated through various regulators, risk culture must be considered and included in an institute´s risk strategy. Therefore, the institute should analyze if the shared risk culture within the institute meets the strategy of the institute´s risk management and furthermore, supports this strategy. If this is not the case, practical implications and action plans are more likely to fail since the employees of the institute do not support the strategy. Moreover, on basis of the risk culture assessment trends can be identified. Those trends can be used to identify possible developments of the risk culture and derive action implications to either support the trend or intervene when it should come to a negative trend development. Another important part of the evaluation is to consider systematic differences within the institute. It is possible that the risk culture differs between different parts of an institute. Therefore, the data should be checked for systematic differences between for instance different departments or locations. This is an important part of evaluation. It may show a lack of proper risk culture within the institute, rather than if related constructs, such as error culture or the tone from the top, are affected as well. Additionally, the response rate should be considered. A low response rate can give much information about the motivation of employees as well as the risk culture since it shows if they consider the risk culture assessment as important.

Regularity of Implementation

Culture is a construct that develops over time and can be influenced through environmental changes. Those changes will need time to affect the culture, since shared attitudes, values and behaviors are relatively solid variables, which only develop slowly. If measures have been implemented to influence the dimensions of risk culture positively, it will take some time until these developments will be emerged in the employees and their assessment. Generally, it is recommended to assess the risk culture regularly, since a longterm perspective of the construct will show the institute’s development, which brings many benefits. Therefore, it is recommended to assess the risk culture annual.

Monitoring and Reporting

When the Results of the Risk Assessment Were Evaluated, The Question Arises How the Information Can Be Included in the Institute´s Monitoring and Reporting.

Measures

As stated in the section Introduction risk culture is based on shared risk related attitudes, values, and behaviors within an institute. If the risk culture differs from the target culture, different measures should be considered. Since the action measures differ in dependence on the institute´s definition of risk culture, it is difficult to generally recommend specific measures in this paper. To give an idea of how those action measures could look like, we will sketch a possible risk culture assessment as an example. Here, we use the top-down, rather than bottom-up, approach, due to its superiority in case of literature base and alignment with senior management. An example of possible dimensions of risk culture are the four principles of risk culture (tone from the top, accountability, effective communication and challenge, and incentives) proposed through the FSB (2014).

Here, the approach would be aligned with the deductive and inductive top-down approach since the existing research and literature would be considered right in the beginning of the assessment ´s development. Those dimensions should be fine-tuned in cooperation with senior management to secure the perfect fit between the targeted risk culture of the institute and the research background. Also, it is important to assess the measures, which are already implemented by the institute´s Risk Management, since these provide information about their effectiveness. Here, if the first dimension, tone from the top, shows need for action, different corrective actions can be considered. Tone from the top describes behavior of the management board members (Steinbrecher, 2015). An important first step is to secure a consistent communication within the firm. The communication of senior management should not be limited to the first management level. Rather it should be communicated cross-hierarchically to all employees. Therefore, the tone from the middle is an important action measure since all leaders are responsible for the implementation of an appropriate risk culture within the institute. Moreover, the error culture of the institute needs to be considered. Aspects, which could be supported are a speak-up-culture within the institute. Through the open communication of materialized risks, the awareness for potential risks within the employee´s increase. Additionally, it is recommended to implement a whistleblowing system and develop lessons-learned processes throughout the institute to support the exposure of optimization requirements. Furthermore, in the case of accountability, a focus lies on each employee´s awareness of individual accountability. Here, the formalization of an internal control system would be useful since it makes the organizational structure as well as process organization more transparent and comprehensible. Besides, it defines responsibilities and accountabilities throughout the institute. In case of the third dimension, effective communication and challenge, the employee´s awareness of what risk culture is and how to contribute to it should be supported.

Therefore, trainings through supervisory functions could be implemented, which clarify the risks in the specific fields of activity. The last dimension would be incentives, which describe the entirety of an individual’s tangible incentives with a subjective value. An easy example of influencing this dimension would be to not only support goal (over-) fulfillment through bonus payments, but also punish serious violations of external and internal regulations through refunds or claw back-agreements. Those measures are only examples of how to react to a lack of sound risk culture. Here, the sketched assessment gives an idea of how a thoughtful designed assessment can impact the implementation of action measures by using the dimensions of the latter as sources. Collectively there are different action measures, which can be considered and implemented to support the risk culture in an institute. As previously demonstrated, the action measures can vary in dependence of the risk culture´s dimension. Therefore, the risk management should work in collaboration with the senior management, when it comes to the decision of which measures are appropriate and fit the criteria of the dimension.

Conclusion

The relevance of a risk culture assessment emerged within the last years immensely and its development would need a psychological approach based to its unobjective nature. Regarding the presented research methods and possible approaches, a multi-method research design containing an (online-) questionnaire and interviews seems to be advisable when it comes to a risk culture assessment. As presented in the section Methods different advantages and disadvantages come with every research method.

The questionnaire offers great advantages like the simultaneous and repetitive testing of a larger sample, its low personnel effort and that the information is easy to obtain. Additionally, it allows a long-term assessment of an institute´s risk culture, which allows the derivation of action measures in case of a not-sound risk culture. Moreover, if the design of the questionnaire happens in collaboration with the institute´s board members, the integration of the assessment into the institute´s strategy would be secured. Therefore, it is advisable to additionally use interviews. The usage of interviews on the senior management and board allows a detailed view on risk culture. Even though interviews are rather time-consuming and effortful, the sample would be rather small, and it would allow an in-depth analysis. Therefore, a combination of the prior explained Inductive – top-down approach and Deductive – top-down approach seems to be advisable regarding the design of the questionnaire. Even though, questionnaires could lack of detail and are exposed to response biases, their advantages do outweigh the disadvantages.

Therefore, the development of an (online-) questionnaire seems the appropriate method for a risk culture assessment. The paper “Risk Culture Questionnaire” of Emily Pfeiff, Ellen Holder and Denis Lippolt, illustrates how Protiviti Germany developed such a questionnaire.