Enhancing Risk Culture Through Storytelling 

The concept of risk culture has been around for a long time but has been increasingly in the spotlight.  

APRA defines risk culture as “the behavioural norms and practices of individuals and groups that shape an entity’s ability to identify, understand, openly discuss, escalate and act on its current and emerging risks.”^[1] 

The topic comes up regularly in industry and profession forums and in my conversations with directors and other professionals, risk culture is undeniably a fundamental pillar of risk management, and intrinsically linked to the overall culture of an organisation.  

As a Chief Risk Officer, I have been exploring storytelling as a tool to enhance risk culture and recently presented this idea at the 2024 All-Actuaries Summit. 

Risk awareness 

We face risks every day, both in professional and personal life. As someone who thinks a lot about risk, I have categorised the time horizons of management of risk into three areas as shown below. 

Figure 1: Risk management categorisation

Why storytelling? 

Storytelling has existed for generations in many cultures as a way to pass on knowledge. It is an integral part of Australian Indigenous culture and has formed the basis for many biblical lessons, as well.  

Storytelling brings emotion into learning, and I use it every week as an ethics teacher to Year 4 pupils, where volunteers are asked to bring the stories and scenarios to life and create a sense of curiosity about the questions they pose.^[2] 

While there are thousands of stories around, the approach to telling them is critical to help an audience understand the characters and circumstances, and ultimately remember and learn from these examples. 

How can storytelling help?  

Eleanor Roosevelt once said, “Learn from the mistakes of others. You can’t live long enough to make them all yourself”.

From this idea, I suggest that an improved culture can be achieved if a risk function can: 

• Promote storytelling through discussion of actual cases showing some element of failure in risk frameworks, having significant ramifications for companies and/or individuals. 

• Go “below the headline” of the situation to better understand what happened. This includes walking through the timelines of events or understanding public disclosures compared to what occurred behind the scenes.  

• Facilitate debate on whether similar risk failures could happen within their own organisation (and why/why not) and what developments should be considered for internal risk frameworks. 

Over the past few years, I’ve been able to explore and discuss many interesting “stories”, including: 

• The challenges of communication with customers when you don’t know the full situation. 

• The importance of maintaining a risk focus and the potential link between the lack of a strong risk function and the collapse of financial institutions. 

• The prevalence of a “contagion impact” – a company in the news for one risk management failure will generate additional headlines for many other behaviours.  

• That computers can, and will, make mistakes, but management actions when they emerge will determine whether the impact is managed safely or ends in catastrophic failure. 

• The impact that regulators, politicians and external parties can potentially have on the risk framework, in some cases contributing to the failures. 

In all these cases, the apparent ethics and values have shone through. Were these caused by weaknesses in individual behaviours, failures of the organisational structure and/or culture? Or was the regulatory framework part of the issue?  

Responses to storytelling 

A key advantage of going deeper into a story is an ability to allow different personality types to be grounded in the facts and events which occurred, enabling greater agreement on any steps to be taken.  

An example of this is the regular occurrence of “Sydney Shark Attack!!” headlines in the news where individual reactions can vary from: 

“I’m never going in the water again” to “It ain’t gonna happen to me! We’re in Australia, so what do you expect?”  

Below the headline

Going below the headline and exploring the risks and potential actions can align some of these natural reactions and end up with a more balanced (and likely more appropriate) course of action to decide when and where to next risk going for a surf.  

There are similar learnings possible in the financial services industry when headlines about data breaches or APRA/ASIC interventions are seen, with the risk function able to lead a discussion through what actually happened and the “risk lesson” emerging from it. This encourages all employees to think more about risk and be proactive in speaking up and interacting with the risk department. 

Reality of storytelling 

Storytelling is more than just reacting to what has gone wrong. Time is needed to research, prepare and then tell the stories, and so support is needed from the organisation for this concept to succeed. 

In addition, storytelling may not be the most natural skill set for actuaries. It is not something which is tested in exams or part of most people’s jobs. However, many actuaries already approach challenges with energy and inner confidence and engage in discussions on how to “do the right thing”. Thinking through how our moral compass will direct us, were we to be in these stories, has always been a key part of our profession. 

Therefore, I encourage others to embrace the art of storytelling. It has been a source of great pleasure for me recently and I have seen evidence that it can be successful in building trust and respect within the risk culture of an organisation. 

If you would like to hear more or have stories on risk culture that you would like to share with me, please reach out. 

 References

CPD: Actuaries Institute Members can claim two CPD points for every hour of reading articles on Actuaries Digital.