The Invisible Hand Behind Banking Successes and Failures
This month’s Newsletter is written by Guest Author Caio Banti, a close personal friend of mine who also happens to be CRO at Nubank Brazil! He’s written a cracking piece on risk culture (which ever since March 2023 is a subject dear to my heart). Thanks very much, Mr Banti for contributing to “Straight Talk.”.
Take it away Mr Banti….
One of the best ways to understand the profound and practical nature of risk culture is through the compounding effect. Just as small, consistent financial investments can grow exponentially over time, so does the impact of small, daily risk-conscious decisions within an organization.
A strong risk culture isn’t built overnight. It develops through repeated actions: leaders reinforcing ethical behavior, employees making sound risk-based decisions, and institutions embedding risk awareness into processes. It’s the "invisible hand" that guides decision-making and defines how risk is understood and acted upon across all levels of a bank.
Conversely, a poor risk culture compounds in the opposite direction; small lapses, if tolerated, can accumulate into systemic weaknesses, leading to crises that could have been prevented.
"The Board risk appetite statement is the single most important policy document in any bank and should be treated accordingly. It requires regular review and approval, generally on an annual basis, or whenever changes have been made to the business model and/or customer franchise." —Choudhry, Moorad. Asset–Liability Management I, The Principles of Banking, 2nd ed.
A strong risk culture isn’t built overnight
Risk Culture: The Most Enduring Legacy of a CRO
In the dynamic and often volatile world of financial institutions, the role of a Chief Risk Officer (CRO) is crucial in shaping and nurturing the Risk Culture of an organization. Recent banking failures have starkly highlighted that these are largely Risk Culture failures. As a CRO, fostering the right Risk Culture is not only a responsibility but also one of the most enduring legacies one can build.
Risk Culture is often formally defined as the norms and behaviors that influence how risks are identified, assessed, and managed, but it can be better defined in more practical terms: it is the way risks are managed when nobody is looking. Although terminology can often lead to an understanding of Risk Culture as something separate, the most successful organizations embed risk management into the broader Corporate Culture. It is not only about Risk, it is about Management after all.
Having the Corporate Culture as a starting point, CROs and Senior Leaders should focus on three key pillars:
Leadership
Capacity
Accountability
These pillars ensure that risk awareness is championed from the top, supported by the necessary skills and resources, and reinforced through clear responsibilities at all levels. Completing this framework is number four: measurement. As the saying goes, you can’t manage what you don’t measure. Worse still, mismeasurement leads to mismanagement, which can dominate the decision-making process when it matters most.
Make changes based on the data
Leadership: The importance of leading by example
Actions speak louder than words. As any parent will quickly discover, children often learn more by observing than by being told what to do. Similarly, in a corporate setting, role modeling can be more powerful than communication. While Risk Leadership plays a critical role in shaping the vision and expectations for Risk Management, ALL Leaders must also lead by example. Without their active involvement, the Risk Culture will never be fully embedded in the broader organization.
Risk Capacity: Resources, competencies, and systems
Building the right Risk Culture requires more than just good intentions; it requires adequate resources, skills, and systems, including processes and methodologies. Leading banks invest heavily in recruiting and training skilled risk professionals across key areas but again, it is not only about Risk. All departments need to be staffed properly if everyone has a responsibility for managing risks. Having the right number of people is essential, but equally important is ensuring they possess the skills and experience needed for their specific roles, whether as Risk Owners, Control Owners, or Risk Stewards. And last but not least, the right Systems need to be in place. This is not just IT infrastructure, but well-designed processes and methodologies. Even with skilled professionals, Risk Management efforts will fail if the systems they rely on are unreliable, excessively bureaucratic, overly complex, or nonexistent!
Risk Accountability: Transparency, decision making, and incentives
Decision-making is one of the clearest expressions of Corporate Culture in action. Risk Culture will hardly be appropriate if not embedded in decision-making. The foundation of sound decision-making is transparency, a core value in any fair and functional organization. Transparency fosters trust, and collaboration, and allows empowerment, ensuring that Risk Owners have the clarity and confidence to make informed, risk-aware decisions.
Empowering Risk Owners is key for engagement, accountability, and quality decision-making. Information can become distorted as it moves through an organization, leading to delays and suboptimal decisions. This makes it crucial to keep decision-making as close as possible to the Risk Owners. While Senior Leadership and Risk Stewards definitively play a role, their involvement should be reserved for high-value decisions, working alongside experienced Risk Owners, well-versed in managing their risks.
Not all decisions will be perfect, and organizations must create an environment that allows for honest mistakes, reinforcing psychological safety, and maintaining openness about challenges. Open communication channels with senior leadership are equally vital to prevent hidden risks or misconduct from going unnoticed.
Yet, with greater empowerment comes greater responsibility. Individuals must be held accountable, whether for exceeding quantitative risk appetite limits or for failing to meet qualitative behavioral expectations. These expectations should be clearly defined, well-communicated, and embedded in performance reviews.
Finally, incentives must be carefully structured to avoid unintended consequences! Incentives are powerful tools, and they must be designed thoughtfully to drive the right behaviors.
Thoughtful design drives the right behaviors
Measuring Risk Culture: A holistic approach
Assessing Risk Culture requires a combination of qualitative and quantitative measures. One effective approach is to use employee surveys and structured interviews to gauge attitudes, behaviors, and potential subcultures within different areas of the organization. These insights can reveal how leadership influences Risk Culture and highlight areas requiring attention.
Developing a Risk Culture dashboard can offer a visual representation of key indicators, such as employee retention rates, frequency of misconduct cases, and regulatory failures.
To ensure continuous improvement, organizations should conduct regular self-assessments and compare findings against external benchmarks to track progress and identify gaps. While measuring Risk Culture can be complex, starting with a simple framework and refining it over time is essential for long-term success.
The lasting impact of the right Risk Culture
Building the right Risk Culture isn’t just an objective; it’s the lasting legacy of a good Chief Risk Officer (CRO). Establishing a culture where Risk Management is embedded within the corporate ethos is a journey, not a destination.
While the task may seem daunting, it is essential for the long-term stability of both financial performance and market integrity. As history has shown through banking failures, if organizations fail in this pursuit, the system’s self-correcting mechanism will step in, at a far greater cost.
Disclaimer: The views and opinions expressed in this article are those of the author alone and do not reflect the views or opinions of any company. The information provided is for general informational purposes only and should not be construed as professional advice.
