Risk culture: The gap between what we say and what actually happens

Having spent much of my career investigating issues after they had already occurred, I noticed something interesting: the problem was rarely a missing policy. More often, it was a behaviour that had become normal.

Because culture is not what is written – it is what is repeated.

In my experience, culture is best understood not through documents, but through patterns:

• What gets escalated and what does not
• What gets challenged and what is left unspoken
• What gets rewarded and what is quietly tolerated

Risk culture becomes most visible not when things are going well, but when there is commericial, time and leadership pressure. That is when the gap between intent and behaviour becomes difficult to ignore.

What you see differently in forensic work

One of the unique aspects of forensic work is that you often see organisations at a very specific point in time – after something has already gone wrong.

• Facts are being reconstructed
• Decisions are being examined
• Timelines are being rebuilt

But what is often most revealing is not simply what happened – it is how it happened.

Patterns tend to emerge:

• Concerns had been identified, but not escalated early
• Individuals hesitated to challenge decisions
• Controls were bypassed, often gradually rather than suddenly
• There was excessive reliance on individuals rather than systems

In more than one investigation, the warning signs had been visible months earlier. People recognised that something did not feel right. The concern may have been discussed informally, but it was never elevated through the appropriate channels. 

By the time it became a formal issue, the consequences had become far more significant.

In many cases, there were no major gaps in policy or governance frameworks. The issue lay in how they were applied – or not applied – in practice.

Why this gap exists

Most organisations do not set out to create poor risk culture.

In fact, many invest heavily in building the right structures:

• Clear policies
• Defined processes
• Governance frameworks

But culture does not live in frameworks – it lives in everyday decisions.

Over time, a few things tend to happen.

Growth outpaces alignment

As organisations expand, behaviours become less consistent across teams, functions and geographies.

Incentives send mixed signals

Most organisations say risk matters, but people pay close attention to what actually gets rewarded. When commercial outcomes are consistently celebrated and risk management is treated as secondary, behaviour will naturally follow the reward.

Silence becomes easier than challenge

Issues are often recognised long before they become problems. The challenge is that speaking up can feel uncomfortable, particularly when consequences are uncertain or when a decision has already gained momentum. Most people do not remain silent because they lack awareness; they do so because challenge is harder than consensus.

None of these dynamics are unusual. But together, they shape behaviour in ways that are often unintended.

What good looks like in practice

Strong risk culture is not about eliminating risk, it is about how people respond to it.

In organisations where culture is working well, a number of characteristics are consistently present:

• Clarity – people understand what is expected beyond what is written in policies.
• Consistency – leadership actions align with leadership messaging.
• Challenge – differing views are surfaced rather than avoided.
• Learning – issues are identified early and used to strengthen future decision-making.

Importantly, none of these are driven primarily by documents. They are reinforced through everyday actions – often small, but repeated.

Where it usually breaks down

One pattern appears repeatedly: Issues are not raised early – not because they are not seen, but because they are not surfaced.

The signals are often there, the questions have often been asked, the concerns have often been recognised. But action does not always follow awareness.

From a forensic perspective, this is rarely surprising. By the time an organisation is dealing with a significant issue, the earliest indicators were often visible long before the event itself. They were simply not acted upon at the right time.

What organisations can do without overcomplicating it

Improving risk culture does not require a complete overhaul. In many cases, the most effective changes are straightforward.

Be explicit about expected behaviours

Not just organisational values, but what good judgement and good behaviour look like in day-to-day situations.

Align leadership messaging and actions

People observe behaviour far more closely than they listen to messaging.

Review incentives honestly

Where behaviour and reward are misaligned, behaviour will almost always follow the reward.

Create space for early escalation

Make it normal to raise concerns before they become issues.

Focus on learning, not just accountability

The objective should be to improve future decision-making, not simply assign responsibility after the fact.

None of these are new ideas. The challenge lies in applying them consistently.

Final thought

Risk culture is often treated as something intangible. In reality, it is highly observable.

In forensic work, you see the outcomes. In leadership, you have the opportunity to shape the behaviours before those outcomes occur.

The earliest warning signs of a risk event are often visible long before the event itself. The difference between strong and weak risk cultures is whether somebody feels able to act on them.

Because ultimately, culture is not what an organisation intends. It is what people choose to do when the pressure is on.