• Organisational resilience. Increasing organisational resilience allows entities to resist affected by an event or increases their ability to return to an acceptable level of performance in an acceptable period of time after an event has occurred.3 Alignment with specialist risk categories Specialist risk categories often have their own legislation, standards, compliance and reporting obligations. Entities may also have specialist programs and processes including: • business continuity and disaster recovery • fraud control • workplace health and safety • protective security a specialist program may lead to an increased focus and management of these risks, specialist programs may benefit from being connected to the entity’s overarching risk management framework to ensure consistency. This can be achieved by adopting common terminology and processes across all programs. Practical tips • Use the entity’s risk management policy and its accountable authority instructions to link the risk management framework to other corporate frameworks and processes. • Reflect the entity’s risk appetite and tolerances in the entity’s internal control framework and delegation arrangements in such as finance, procurement, business continuity and human resources. • Assist business unit owners to embed risk management into their activities by providing common risk tools and templates that can be incorporated into their documents and processes. • Use changes or restructures in the entity as an opportunity to embed risk management in business processes or functions. • Include easy-to-use risk management tools and templates into corporate and business planning documentation and processes. • Communicate quick wins as soon as they occur. Highlight how embedding risk management into business processes resulted in innovative outcomes or other benefits to the organisation through identifying and treating risks.
How to influence risk culture A brief description of the influencers of risk culture, and some examples of desirable and detrimental risk behaviours are provided below. Risk competence The collective risk management competence of the entity Desirable behaviours • Proactive sharing of best practice • Consulting with others often Detrimental behaviours • Reluctance to learn from past mistakes • Following the herd Organisation’s risk environment How the organisational environment is structured and what is valued Desirable behaviours • Adhering to risk management policies, processes and procedures • Listening to others • Involving risk professionals in important risk decisions Detrimental behaviours • Reluctance to escalate risks • Minimising risks, optimism bias • Cutting corners Motivation The reasons why people manage risk the way that they do Desirable behaviours • Innovating and changing poor practices • Taking personal accountability for managing risks • Admitting to making mistakes Detrimental behaviours • Shooting the messenger • Avoiding responsibility • Rewarding excessive risk taking Relationships How people in the entity interact with others Desirable behaviours • Open and honest dialogue regarding risks • Constructive response to challenge Detrimental behaviours • Inadequate challenge of excessive risk taking • Yielding to inappropriate pressure from others