‘Box ticking’ prevalent in risk culture, ACCA study finds

A new study by the ACCA, the Association of Insurance and Risk Managers, and PRMIA has revealed that while “box ticking” is prevalent, there is growing interest in risk culture to cope with disconnected organisational cultures and hard-to-detect breadth of risks. 

The new study is a collaboration between the separate bodies that gauges how risk and financial leaders are dealing with risk culture and to what extent they understand its effect on organisations’ broader strategies. 

The research is based on an online global survey complemented by a mix of interactive engagements with the three professional bodies’ respective members, gathering views from thousands of risk and financial professionals around the world. 

‘Regulatory, compliance and legal’ risk was the top or close to top risk priority overall, except for North America respondents who ranked “technology, data and cybersecurity” significantly higher than the rest. 

Meanwhile, African respondents were more likely to be concerned about “misconduct, fraud and reputational damage” issues, something that was not a major concern for those in Western Europe.

In addition, ‘Economic inflation and recession’ topped the list of risk priorities for UK respondents.

The survey also asked about “comfort with using a whistleblowing platform” not just whether respondents were aware of wrongdoing, but also whether it had been investigated and resolved. The Caribbean scored lowest here.

Rachel Johnson, head of risk management and corporate governance at ACCA, said: “Recent corporate collapses remind us of how inadequate and siloed risk governance can be, regardless of what is said in their financial statements. 

“As our research shows, it is not only the regulators who are asking questions. In today’s highly interconnected, digital world, even a weak risk culture is better than none.” 

Julia Graham, CEO of AIRMIC, said: “In an increasingly high velocity, complex and connected world, tensions can be created between managing performance, innovation, controls, and assurance.  

“This report addresses how risk culture can contribute towards managing these tensions as part of good governance and concludes that managing risk dynamically and building resilience collaboratively are changing risk culture for the better.”