Assessing organizational culture is an integral aspect of a company’s risk management framework. Most companies, though, contain diverse groups of experts who interact with one another daily, and each group has its own distinct subculture. According to Milliman consultant Neil Cantle, companies that adapt decentralized control structures, allowing experts to make local decisions based on the company’s risk tolerance, can become more resilient and successful.
Neil’s Raconteur article “Achieving resilience by harnessing people power” provides more perspective. Here’s an excerpt:
[Companies] are complex ecosystems where people go about their daily tasks, interacting with countless others inside and outside the company. In the real world, people are faced with situations every day that don’t quite match the process manual, and they will use their initiative and try to find a way through to a successful outcome. Their judgments will reflect their values, so the question is whether those values are consistent with the culture your board wants to see? …
…In a world such as this, the notion of control, therefore, requires modification. We can no longer deliver the outcome we want with certainty, but can only choose our next action. Of course, we would like to select an action that will help take the company towards a successful outcome, but we simply don’t know for sure which one that is. We have to retain flexibility and learning as core skills, with the certain knowledge that things around us will not always go to plan.
In fact, in situations of complexity, where the environment is dynamic and changing, a model of centralised control is far from optimal and often leads to unintended outcomes. The more appropriate approach to guiding progress here turns out to be empowering local experts to make localised decisions, with the proviso that they are aware of what is happening in the wider overall context.
Organising in this way, we need to empower our experts to make local decisions in the best interests of the whole, and are much more concerned about whether their attitudes and behaviours are consistent with what we would like. We are trusting them “to do the right thing” rather than directly controlling what they do. There will be some things we are so keen to avoid that we will implement very strict controls, making it hard to do the wrong thing, but we are largely going to be using our values to guide behaviours.
For more perspective on organizational culture and risk management, read “Cultural compass,” also written by Neil.