Managing culture & conduct across the 3 lines of defence

There is a strong consensus amongst front line business leaders and risk professionals across the 3 lines that culture and conduct has improved significantly over the past couple of decades. We have moved a long way from Wolf of Wall Street-type behaviours. Yet proactive culture change is still not a routine, embedded aspect of risk management frameworks in our industry. We are clearly still on a journey, evidenced by the fact that more and more firms are starting to invest in reasonably sophisticated culture change capabilities and skillsets that recognise, in particular, the impact of behavioural science in this area.

In a nutshell, what behavioural science insights bring is an appreciation that the behaviours of human beings, both individually and collectively, are not predictable and based wholly on rational judgement. We are also heavily – or even mostly – influenced by unconscious and complex socio-psychological processes that involve gut feel, emotionality and an inherent lack of rationality. In behavioural science terms, one example of how this rational/irrational dynamic works is explained in Daniel Kahneman’s neatly articulated concept of System 1 and System 2 thinking (fast, unconscious thinking versus much slower, more deliberate, logic-based thinking).

There is now a very large body of similar scientific insight that informs how we behave collectively (i.e. culturally) in large, complex organisations and this is gradually making its way into mainstream risk management thinking. This influences how we approach and understand culture change in very fundamental ways. For example, if your firm still has a one-size-fits-all approach that sees culture as a single, homogeneous, corporate-wide concept that can be assessed using dashboards of predominantly HR and compliance-type data and which focuses on a tone from the top that exhorts everyone to align to the corporate values (while not understanding why people sometimes don’t), the chances are you are not managing culture effectively, or at all.

Behavioural concepts that are becoming the core of cultural understanding today involve ideas such as: the existence and interaction of many sub-cultures; the appreciation of local contexts/ environments; clarity and alignment of individual and corporate purpose; understanding of intrinsic motivators and their use in formal and informal incentives; cultural and behavioural norms; the impact of and tension between national cultures in global teams; effects of unconscious bias on decision-making; and knowledge of how culture is ‘carried’ and influenced through time. These and other examples are all important influencers of overall cultural health. They require much more sophisticated approaches to enable the identification of behavioural risk and the implementation of strengthening activities that are more likely to be effective.

Managing these aspects of culture is not yet routine, but there is a significant recent increase in interest right across the 3 lines, especially in audit. Firms are feeling regulatory and Board pressure to provide feedback on the quality of their culture, and culture audit teams are gradually establishing themselves in many firms as centres of expertise.

One sign of a growing sophistication is the ambition to develop qualitative approaches to the identification and assessment of issues. These complement the use of quantitative dashboards and provide more understanding of cause and effect – exploring why things are as they are – and acknowledging that similar symptoms (such as low psychological safety) can have very different subculture-specific causes.

Another sign is the development of multi-disciplinary teams across the 3 lines that include behavioural scientists, psychologists, data scientists and risk professionals coming together to develop more holistic methods to explore culture – using tools such as culture deep-dives and behavioural analytics to improve the quality of insights. The 2nd line developed risk management frameworks which include risk culture components that offer a capability beyond simply delivering training and education services.

So, if we are improving as an industry, where next for the near future? One thing is certain: regulators will continue to call out systemic culture failings as part of any enforcement action they make. Just witness the recent comment from the CFTC related to the use of unauthorised communication channels: “The era of evasive communications practices is over. The CFTC will hold you accountable. It’s time for Wall Street to stop waiting for an enforcement action before it changes its practices. Tone at the top must change on Wall Street. Change can only happen if the banks’ C-suite establishes a culture of compliance over evasion.” Strong words in response to findings such as traders routinely using WhatsApp for business-related conversations and then deleting messages.

This is also a wake-up call to guard against complacency or any idea that industry has done the culture and conduct work and can now focus on other priorities. There has to be a strong, ongoing commitment to improving culture in perpetuity. It is an area that is continuously evolving and changing where things can get rapidly worse as well as better, so we're never going to arrive at a final destination. Neither are we going to solve all of our problems through ever-growing layers of rules and compliance standards. Hence the need for deeper behavioural understanding, the development of behavioural guide rails that encourage empowerment and the conceiving of healthy culture as being a control in itself.