case study on risk culture

• Discover our global expertise Project services PMO & Project Delivery Project Dashboards Project Management as a Service (PMaaS) Project Portfolio Execution Strategy execution & Business Improvements Project Management Improvement Agility at scale Change Management Lean Innovation Project Portfolio Management & Optimisation Digital Solutions Digital PMO Deployment of PM Solutions Intelligent Project Prediction (IPP) Clayverest: the PMO's Copilot Case studies Discover how our expertise supports our clients
• Join our team Our company culture Empower your project experience Empower your professional experience Empower your CSR experience Empower your social experience Our job families Project Management Consultant Delivery Manager Business Manager Your profile Early Professional Experienced Professional Our job offers Discover our local and international opportunities
• The Project Management Blog PM Guides Agile Change Management Cost Management Crisis Management Digital PMO Industry Insights Lean Innovation PMaaS PMO Portfolio Management Project Management Delivery Project Managements Roles Risk Management Schedule Management Latest articles Newsroom Case studies Discover how our expertise supports our clients
• Europe France Germany Italy Portugal Romania Spain Switzerland United Kingdom North America Canada Mexico United States Asia South East Asia Oceania Australia Contact Us

Case Study: Improving Risk Culture

• 28 May 2020
• Financial Services , Change Management

Risk management is a key component of every organization’s strategy and operations. Companies make important risk-based decisions every day.  At the forefront of such risk decisions are financial institutions. Improving risk culture allows a company to both raise awareness on how to better manage risk, and also to bridge the gap between management operations and organizational values.

In brief: 5 steps to create a sustainable risk culture

The Challenge

MIGSO-PCUBED was engaged by a federally regulated Financial Services company to provide Change Management Services in support of a company-wide business transformation program.

The program began as a response to recommendations and mandates from regulators. However, risk management had become largely control-driven and lacked consistent awareness among the employee base. Compliance with aggressive regulatory timeframes, competing project scopes, and changes in leadership each contributed to poor risk management. 

The change management initiative, therefore, focused on improving the understanding of risk culture across the organization and creating a foundation for a more sustainable culture going forward.

The Solution

For a transformation initiative centered around risk culture improvement, it is important to set up an effective structure – one that successfully nurtures, builds, and supports an environment for change, which, in turn, allows the organization to see and experience long-term benefits and continuous improvement.

Working directly with the Senior Management Committee and key stakeholders, the team quickly structured the business transformation program into six corporate workstreams that would each simultaneously deliver results. Each workstream’s output provided an understanding of current capability, an assessment of gaps against benchmarks, and a clear roadmap for change. 

With a structure in place, the team next set out to determine what aspects of their risk culture the client needed to specifically address.  With that, we will take a quick detour on risk culture and risk culture measurement.

What is a Risk Culture?

“ Risk culture is the values, beliefs, knowledge, and understanding about risk, shared by a group of people with a common purpose.” – PMI, The ABC of Risk Culture . And, having a robust risk culture is important in more effectively managing risk.

"Risk culture is the values, beliefs, knowledge and understanding about risk, shared by a group of people with a common purpose." PMI - The ABC of Risk Culture

Enterprise risk management includes identifying, assessing, and mitigating risks depending on both the risk tolerance and the risk appetite of the firm.  Whereas  risk appetite  is the amount of total risk an organization is willing to accept, risk tolerance is the day to day or transactional limit.

Want to know more about

By raising risk awareness and understanding, a healthy risk culture aligns a company’s attitudes and behaviors with their business strategy. This ensures that the values and ethics of employees – around risk strategy, appetite, and tolerance – are aligned with those of the organization.

Key elements of a healthy risk culture include Knowledge and Understanding as well as Leadership, Respect, and Accountability.  To cultivate those values, you must also be able to observe the behaviors of Transparency, Communication, Awareness, and Motivation.

Bringing Risk Management into Focus

Bringing us to perhaps the most interesting aspect of this project – the focus on risk management and its integration to change management. You may wonder how an organization quantifies their risk management capabilities and overall risk awareness – basically how they conduct a risk culture assessment.

“There is no one good or model culture against which others can be measured and ranked, and no single template or checklist for firms to adopt.” - Banking Standards Board

Within the Financial Services industry, the Banking Standards Board conducts an annual assessment with its member firms.  While it does not rank their culture directly, it does provide its member firms with feedback against key elements to help them manage their culture more effectively (image below).

In the same way, risk culture itself cannot be measured. However, an organization can measure its ability to demonstrate risk-related values and meet company objectives. That means an organization must first determine what outcomes are driven by values and behaviors, and then begin to measure them.

What values and behaviors contribute to effective risk management? How can these be measured or evaluated? What actions can an organization take thereafter to establish risk awareness?

To give you an example, with a strong risk culture, employees feel more empowered to speak up and escalate issues. In turn, an organization that encourages employees to raise concerns and issues might observe a decrease in their employee turnover rate.  They may also see an increase in the number of reported issues or a decrease in the number of integrity-related risks. 

Using an anonymous forum, a company may identify sensitive issues or gauge the number and severity of integrity risks. Using this data, the company can then organize its risk indicators into a dashboard to consistently appropriate and evaluate risk culture.

Implementing a Risk Culture Approach

Adopting this approach, the MIGSO-PCUBED change management team led the client through each of the 4 steps in the graphic below.  The team leveraged core Change Management tools and techniques beginning with assessing the current climate and analyzing in comparison to organizational expectations. The team then defined a set of tangible actions mapped to a change roadmap of short, medium, and long term actions to strengthen areas falling below expectations.  

Additionally, they established a robust governance and planning structure, and tailored communications to facilitate a more sustainable business transformation initiative.

The Benefits

In the short term, the MIGSO-PCUBED team has supported the client in building a company-wide and unified understanding of their corporate risk culture. Roles and responsibilities are better understood. Moreover, the client is observing greater risk awareness and more effective risk management practices. 

The client also has the means to assess and monitor their risk culture going forward in the short, medium, and long term.  This allows them to identify gaps and take action more proactively in driving risk culture. This highlights the longevity of the business transformation initiative long after its closure, as its outputs are fully integrated into the organization.

This article was written by  Elaina Wheeler and Victoria Emslie .

You might also like:

Global Supply Chain Schedule Integration

PMO Delivery within Nuclear

Throwback to the start of our first Swiss hub with Marie Timmerman, Business Manager in Geneva

Loved what you just read? Let's stay in touch.

No spam, only great things to read in our newsletter.

We combine our expertise with a fine knowledge of the industry to deliver high-value project management services.

MIGSO-PCUBED is part of the ALTEN group.

Find us around the world

Australia  – Canada – France – Germany – Italy – Mexico – Portugal – Romania – South East Asia – Spain – Switzerland – United Kingdom – United States

Follow us here

© 2024 MIGSO-PCUBED. All rights reserved | Legal information | Privacy Policy | Cookie Settings | Intranet

Perfect jobs also result from great environments : the team, its culture and energy.  So tell us more about you : who you are, your project, your ambitions, and let’s find your next step together. 

• Netherlands

South East Asia

Switzerland

United Kingdom

United States

In accordance with the General Data Protection Regulations (GDPR), the data entered is processed for the management of recruitment and its improvement. To find out more, visit our privacy policy .

Dear candidates, please note that you will only be contacted via email from the following domain: migso-pcubed.com . Please remain vigilant and ensure that you interact exclusively with our official websites. The MIGSO-PCUBED Team

Discover our global expertise →

Project Services →

Strategy Execution & Business Improvements →

Digital Solutions →

Our case studies →

Join our team →

Company Culture →

Job Families →

Choose your language

Subscribe to our Newsletter

A monthly digest of our best articles on all things Project Management.

Subscribe to our newsletter!

Our website is not supported on this browser

The browser you are using (Internet Explorer) cannot display our content.  Please come back on a more recent browser to have the best experience possible

Browser does not support script.

• LSE Research for the World Strategy
• LSE Expertise: Global politics
• LSE Expertise: UK Economy
• Find an expert
• Research for the World magazine
• Research news
• LSE iQ podcast
• Research films
• LSE Festival
• Researcher Q&As

Impact case study

Influencing risk culture change processes in financial institutions.

  The research … put a more rigorous framework around the discussions of the implications of different organisational structures for risk-taking; in particular, more complex organisations might be driven beyond their bandwidth for risk-taking by specific hot spots in the organisation. This focused attention on the need to consider the trade-offs between risk taking and controls. Former partner at EY and senior regulator at the Bank of England

Research by

Professor Michael Power

Department of accounting.

Dr Tommaso Palermo

LSE research explored the dynamics and trade-offs involved in managing risk cultures in financial institutions, shaping how the industry understands approaches to risk-taking and control. 

What was the problem? 

Financial organisations need to take risks, but if those risks are uncontrolled or reckless, then the damage caused by very large organisations is immense. And so it matters that we understand the cultures that shape approaches to risk-taking and control in organisations, and the trade-offs involved.  

The Global Financial Crisis of 2008 to 2009 focused new attention on a perceived culture of reckless risk-taking by financial organisations, especially banks. In response, many institutions and policymakers wanted to develop a consolidated understanding of organisations’ efforts to better understand and act on their risk cultures. The financial crisis also raised questions about the influence of financial regulators and consultants on these organisational conceptions of risk culture, and the capacity for and consequences of consciously measuring, managing, changing, and auditing risk cultures. 

What did we do? 

To understand how risk cultures operate within financial institutions, Professor Michael Power and Dr Tommaso Palermo, along with Dr Simon Ashby (then at the University of Plymouth, now Vlerick Business School), engaged directly with the key actors in the financial sector charged with operationalising ways to assess, manage, and report on organisational risk cultures.  

Between 2012 and 2015, the team conducted field-based research, drawing on observations and interviews alongside surveys and documentation analysis. They conducted interviews with 61 individuals in financial institutions, professional associations, regulatory bodies, and consulting firms. They also used survey questionnaires in some participant organisations to explore relevant aspects of business operations, such as interactions between control functions and revenue-generating teams. Focus group discussions, facilitated by the researchers, allowed them to collect additional data by observing senior managers’ reactions to, and interpretation of, assessments of their organisations’ risk cultures.  

From this body of research Power, Ashby, and Palermo developed a framework that concisely models different approaches to risk culture assessment and management and their potential trade-offs. The insights, refined in a 2017 paper , make an important contribution to academic understanding of risk culture, while further research compared risk culture in the financial sector with safety culture in high-risk sectors such the airline industry .    

The research showed how good practice entails awareness of the trade-offs inherent in the different approaches to managing risk cultures, rather than being prescriptive about how much risk to take. The research also revealed how firms tend to focus for pragmatic reasons on a few key issues, rather than developing a holistic framework to risk culture assessment. They concentrate, for example, on how to foster revenue-generating units’ respect for risk and compliance functions; the creation of new risk oversight units and capabilities; and dealing with new regulatory entities such as the Financial Conduct Authority.  

In addition to documenting different approaches to risk culture assessment and management, the longitudinal field study engagement with different organisations helped the researchers to appreciate how risk culture has become more “auditable” over time, with a shift towards organisations adopting formal toolkits and oversight structures. This has significant managerial implications, since it frames corporate risk culture as something that can be inspected and validated by boards of directors and regulators, despite initial scepticism about formal diagnostic toolkits and measurable performance indicators. 

The research team used these insights to develop a suite of “smart questions” about risk culture for companies to use either as a stand-alone set or as a follow-up to diagnostic tools such as surveys. The answers to these “smart questions” are specific and targeted, raising awareness about key cultural hotspots to address, but together they provide a useful snapshot of organisational risk culture. 

What happened? 

These insights on risk cultures have influenced how financial services organisations around the world understand their own practices. Although the aim was not to develop a new tool to measure risk culture, it has supported industry efforts to do so.  

The initial report was shared widely among financial organisations, including banks, insurance companies, and industry regulators. It has, along with subsequent publications, become a reference point in the risk culture debate within the sector. Its reach is evident in the wide range of regulators, professional bodies, and advisory firms that cite it in policy and guidance documents and in the invitations the researchers have received to present their evidence to senior staff in regulatory authorities, along with professional bodies, banks, and within academia.  

The research has informed new industry guidance aimed at improving understanding, monitoring, and development of risk cultures. In 2014, the Financial Stability Board (FSB), an international body that monitors and makes recommendations about the global financial system, cited the research in their report on assessing risk culture. This new guidance was intended to help supervisors assess the soundness and efficacy of a financial institution’s risk culture. As with other FSB publications, its intended users are the financial institutions of the world’s largest economies, international financial institutions, and international standard-setting organisations. The FSB report has become a central reference point for corporate and regulatory initiatives on risk culture.  

Professor Power and Dr Palermo’s work has also been cited in several other policy and guidance documents, such as ones published by the CRO Forum , a group of Chief Risk Officers from multinational insurance companies; the Chartered Institute of Internal Auditors (CIIA); and the Australian Prudential Regulation Authority (APRA), an independent statutory authority supervising banking, insurance, and superannuation institutions.    

The collaborative nature of the research has also helped to deliver direct impacts within participating organisations, and organisations that have contacted the research team subsequently to learn about the report findings and to share the results of their own internal risk culture workstreams. One indicative example is a major insurance company, which contacted the researchers in September 2017 leading to an ongoing collaboration with direct impact on corporate practice. Dr Palermo worked with senior members of the company’s internal audit function to develop and refine its method of assessing risk and control culture as part of the audit process.

Related content

Article: investigating risk cultures in financial institutions, counterparty credit risk management at barclays: estimating extreme quantiles, analysing and learning from healthcare complaints, more by michael power, rejection sampling and agent-based models for data limited fisheries.

Author(s) Michael Power

How culture displaced structural reform: problem definition, marketization, and neoliberal myths in bank regulation

Memories lost: a history of accounting records as forms of projection, the firm that would not die: post-death organizing, alumni events, and organization ghosts, more by tommaso palermo, the value of research activities “other than” publishing articles: reflections on an experimental workshop series.

Author(s) Tommaso Palermo

How accounting ends: self-undermining repetition in accounting lifecycles

How do accounts pass a discussion of vollmer’s “accounting for tacit coordination”, how to improve the risk cultures of financial institutions.

Banks’ risk culture and management control systems: A systematic literature review

• Original Paper
• Open access
• Published: 13 August 2021
• Volume 32 , pages 439–493, ( 2021 )

Cite this article

You have full access to this open access article

• Jennifer Kunz   ORCID: orcid.org/0000-0003-4843-824X 1 &
• Mathias Heitz 1  

11k Accesses

9 Citations

1 Altmetric

Explore all metrics

Over ten years of a debate about the best ways to make banks safer have led to the conclusion that improving their risk culture is one venue to achieve this goal. Consequently, different disciplines discuss topics related to risk culture from varying methodological angles. This effort of many scholars provides a rich basis of theoretical and empirical evidence to guide business practice and improve regulation. However, the application of many approaches and methods can result in fragmentation and loss of a comprehensive perspective. This paper strives to counteract this fragmentation by providing a comprehensive perspective focusing particularly on the embeddedness of risk culture into banks’ management control systems. In order to achieve this goal, we apply a systematic literature review and interpret the identified findings through the theoretical lens of management control research. This review identifies 103 articles, which can be structured along three categories: Assessment of risk culture , relation between risk culture and management controls (with the subcategories embeddedness of risk culture in overall management control packages, risk culture and cultural controls, risk culture and action controls, risk culture and results controls, as well as risk culture and personnel controls) and development of banks’ risk culture over time . Along these categories the identified findings are interpreted and synthesized to a comprehensive model and consequences for theory, business practice and regulation are derived.

Similar content being viewed by others

Corporate Social Responsibility (CSR) Implementation: A Review and a Research Agenda Towards an Integrative Framework

Tahniyath Fatima & Said Elbanna

Meta-analyses on Corporate Social Responsibility (CSR): a literature review

Patrick Velte

A literature review of the history and evolution of corporate social responsibility

Mauricio Andrés Latapí Agudelo, Lára Jóhannsdóttir & Brynhildur Davídsdóttir

Avoid common mistakes on your manuscript.

1 Introduction

The banking and economic crisis of 2007/8 resulted in the call for a fundamental change of banks’ professional norms (e.g., Cohn et al., 2017 ; Palermo et al., 2017 ; Pan et al., 2017 ; Power et al., 2013 ) and regulators started to emphasize the concept of risk culture in their standard setting (e.g., Carretta et al., 2017 ; European Banking Authority (EBA), 2017 ; Financial Stability Board (FSB), 2014 ).

As risk culture is part of qualitative regulation, those standards considering this topic provide a wide range of qualitative recommendations, covering internal controls, like remuneration, but also soft factors, like open communication (e.g., FSB, 2014 ). This qualitative character of risk culture and the related recommendations to establish it in a reasonable way, constitute a major challenge for banks: As literature on management controls stresses, corporate culture – and thus also a firm’s risk culture as part of this corporate culture – constitutes a socially constructed management control system (Bedford & Malmi, 2015 ; Malmi & Brown, 2008 ; Merchant & Van der Stede, 2017 ), and it is embedded into a whole set of further management controls (Merchant & Van der Stede, 2017 ). Thus, when trying to develop an appropriate risk culture, banks have to cope with the need to change socially constructed entities and they have to consider and understand the mentioned embeddedness in whole sets or packages of management controls. Moreover, banks are confronted with partly contradicting external requirements, e.g., there is a strong tension between market and regulatory demands (Lim et al., 2017 ), which in turn result in contradicting demands with respect to risk behavior. If such complexities are neglected, the application of particular instruments to establish a reasonable risk culture might miss the intended effect (Power et al., 2013 ).

Due to this need for deeper insights into how risk culture can be implemented and managed successfully and sustainably in banks, since the last financial crisis scholars devoted increasing attention to this topic. For example, they discussed issues as diverse as the impact of incentive systems (Gande & Kalpathy, 2017 ; Iqbal & Vähämaa, 2019 ; Schnatterly et al., 2019 ) or the way to measure risk culture (e.g., Sheedy, 2016 ; Sheedy et al., 2017 ). Within these emerging research fields different methods and theoretical perspectives are applied. This differentiation fosters a pluralistic perspective on banks’ risk culture and thereby provides the possibility to develop a broad set of recommendations for business practice and regulation. However, it also bears the risk of fragmentation and mitigates the development of a comprehensive view on banks’ risk culture. Particularly, as different authors stress different building blocks to achieve a proper risk culture, it is difficult to select and prioritize the relevant building blocks. This is all the more true since regulators do not show causal relationships between individual building blocks in their papers, but rather list them individually. Moreover, scholars disagree on the relation between certain instruments and risk culture. For example, Stulz ( 2016 ) discusses incentives and culture as two distinct measures to influence prudent risk-taking, while McConnell ( 2013 ) mentions remuneration as integral component of risk culture. Finally, in the wake of the last financial crisis, the discussion on risk culture became ethically inflated, as an inadequate risk culture is seen as an important reason for misconduct. In summary, there are many reasonable views on risk culture in banks, but they need to be integrated to develop a more coherent understanding that allows banks to develop their risk culture in an appropriate direction.

The present paper aims to provide insights for such a coherent understanding by focusing particularly on the embeddedness of risk culture into banks’ management control systems. In order to achieve this goal, we apply a systematic literature review and interpret the identified findings through the theoretical lens of management control research. When defining a clear-cut inclusion criterion for the considered articles in this review, we have to consider that this field of research is still under development. In order to cover the relevant literature, we selected those articles which simultaneously deal with risk culture and management control systems or particular elements of these systems both in the sense of explicitly combining them but also in the sense of discussing them in a less related way. Thus, we consider both articles which explicitly strive to understand risk culture in relation to management control systems and articles which at least point to the fact, that risk culture has to be understood in the broader context of (elements of) management control systems, without necessarily providing the precise relations between them. The application of this systematic literature review allows the structured discussion of recommendations for business practice and regulation as well as the derivation of promising paths for future research. Thereby, the analysis mitigates increasing fragmentation and helps to direct future research effort to existing blind spots.

On the one hand, our study extends the mainly interpretative research in management control literature that aims to foster the understanding of effective practices to achieve an appropriate risk culture (e.g., Mikes, 2009 , 2011 ; Power, 2009 ). By combining evidence from this literature with further insights from other research streams on risk culture, we broaden the perspective and provide a comprehensive view on risk culture as management control system and its embeddedness within other management control systems. This makes our study one of the few analyses that deal explicitly with the relationship between risk culture and management control systems. On the other hand, we provide evidence to enhance theory and business practice on risk culture in banks by compiling the current state of research, bringing together the most important findings and highlighting existing research gaps. Particularly, we discuss in detail issues related to the assessment of risk culture, the relation between risk culture and other management controls and the possibility to change risk culture. Moreover, we provide a comprehensive model relating risk culture to other management control systems in order to disentangle their complex relationships. From these insights, we draw recommendations for business practice, regulators, education and research.

The remaining paper is structured as follows: To lay the ground for the following analysis, in Sect.  2 we derive a definition of risk culture within banks and relate it to management control research. Based on this combination we elaborate on the relevant categories to be analyzed in order to derive the intended comprehensive view. Section  3 provides detailed information regarding the procedure to identify the relevant literature for the systematic literature review. Section  4 covers the results of the systematic review and in Sect.  5 we discuss these results. Section 6 contains concluding remarks and the discussion of the limitations.

2 Risk culture and management controls

According to Schein ( 1990 ) organizational culture is the derivative of organizational learning processes through which particular norms and behavioral patterns have evolved that served to solve problems in the past. It “may be defined as the shared basic assumptions, values, and beliefs that characterize a setting and are taught to newcomers as the proper way to think and feel, communicated by the myths and stories people tell about how the organization came to be the way it is as it solved problems associated with external adaptation and internal integration” (Schneider et al., 2013 , p. 362). As a consequence, organizational culture is a dynamic organizational phenomenon whose content can change over time dependent on organizational learning within changing environments due to external pressure und internal processes. Risk culture forms part of the overall organizational culture and describes the way an organization takes and manages risk (e.g., Australian Prudential Regulation Authority (APRA), 2016 ). Similar as overall organizational culture, also risk culture develops according to learning processes related to external and internal determinants, as exhibited by relevant definitions.

One frequently cited definition is applied by the Institute of International Finance (IIF) ( 2009 ), which is also used by the FSB ( 2014 ) and the APRA ( 2016 ). They define risk culture as “the norms and traditions of behavior of individuals and of groups within an organization that determine the way in which they identify, understand, discuss and act on the risks the organization confronts and the risks it takes” (IIF 2009 , p. 35). According to the Institute of Risk Management (IRM) ( 2012 , p. 7) risk culture comprises “the values, beliefs, knowledge and understanding about risk, shared by a group of people with a common intended purpose, in particular the leadership and employees of an organization.” Another well-known definition of risk culture as “bank’s norms, attitudes and behaviors related to risk awareness, risk-taking and risk management and controls that shape decisions on risk” is provided by the Basel Committee for Banking Supervision (BCBS) ( 2015 , p. 2). Overall, these definitions stress the importance of individual perceptional and cognitive processes in combination with social interactions for the evolution of a bank’s risk culture.

The literature further states that different organizations also can have different risk cultures (IRM 2012 ). Moreover, as the norms and traditions related to risk culture are formed via shared experiences over time, and these experiences are driven by various external factors, also various sets of shared norms and traditions within organizations are possible.

However, despite the possible differences between risk culture across and within banks, the FSB ( 2014 ) suggests four core elements that support a sound risk culture in each bank: tone from the top , accountability of employees , adequate incentives and effective communication and challenge . The IRM ( 2012 ) adds further aspects, like the commitment to ethical principles or risk event reporting. These aspects are part of an overarching management concept that is anchored in the bank’s internal management control systems. Thus, as also outlined by the APRA ( 2016 ) in addition to the less formal psychological and social processes mentioned above, formalized systems also have an influence on the orientation of risk culture.

Finally, the adequacy of a particular risk culture must always be assessed in the light of a bank’s business model. Regulators expect banks to implement a prudent risk culture, which does not necessarily mean that banks should be as risk-averse as possible. Rather, it is intended to promote a risk behavior that only allows the bank to take acceptable risks, so that it can prosper sustainably and does not get into financial difficulties (e.g., FSB, 2014 ).

Overall, the mentioned definitions stress that risk culture refers to a general organizational attitude towards risk and its handling. It constitutes the shared experiences of individuals and comprises norms, values, traditions, and attitudes, which lead to particular activities related to the handling of risk and its consideration in decision processes. It is formed through the interaction between informal psychological and social processes , formal instruments, like reward systems, and external circumstances, like regulation . Risk culture is therefore an elusive phenomenon, the development of which is difficult to predict. Nevertheless, regulators expect banks to exert a targeted influence on their risk culture and to develop it in an appropriate direction, i.e. in a manner that fits to their business model and does not result in financial distress.

Management control systems can be defined as a collection of practices that are intended to align staff’s decision-making and action taking with overall organizational goals (e.g., Anthony, 1965 ; Berry et al., 1995 ; Chenhall, 2003 ; Gooneratne & Hoque, 2013 ). While in older research a more objective perspective on management controls can be observed, more recently scholars stress that management control systems “are also viewed as socially constructed phenomena within the particular context in which they operate; being subjected to wider social, economic and political pressures” (Gooneratne & Hoque, 2013 , p. 147). Given this definition, on the one hand, it becomes clear that literature of management controls can help to make sense of banks’ risk culture and its relation to the mentioned instruments as well as to foster its active development into an adequate direction. On the other hand, according to this literature, culture is its own management control system (Malmi & Brown, 2008 ; Merchant & Van der Stede, 2017 ). Thus, a deeper understanding of risk culture, as a particular part of culture, also can inform management control research. Especially it can add insights to the growing research stream on management control systems in banks (Gooneratne & Hoque, 2013 ). In order to achieve both goals, we derive three issues, which are to be clarified by the systematic literature review.

First, the idea of management controls is closely related to the idea of making issues relevant to organizational goal achievement assessable. At first glance, this statement seems to be at odds with the previously derived definition of risk culture and the conclusion that it is an elusive phenomenon. Moreover, particularly authors from the field of management controls, like Power ( 2009 ) and Mikes ( 2009 ), are rather critical regarding a culture of assessment or even precise measurement in the context of risk culture. However, in order to embed the active management of risk culture within banks, this management process has to be conceptualized in a way that fits to the general thinking within this industry. The banking industry not only has to cope with qualitative but also with quantitative regulation, which still results in a clear focus on measurable aspects. Moreover, in order to learn about possible progress made in developing an adequate risk culture (i.e. a risk culture that fits the selected business model), banks need clear benchmarks. Consequently, possible ways of assessing risk culture constitute the first category of the following systematic literature review. In detail, we elaborate on existing assessment instruments in extant literature and on the need for future research.

Second, as previously discussed, to achieve a risk culture that fits to the selected business model, regulators as well as recent literature propose to implement certain instruments, like appropriate incentive systems, adequate communication structures and suited leadership. Thus, the understanding of the relation between particular instruments as part of management control systems and banks’ risk culture constitutes a second important issue. Management control research provides frameworks to foster this analysis. Based on previous research (e.g., Galbraith, 1973 ; Lawrence & Lorsch, 1967 ; Perrow, 1970 ; Thompson, 1967 ), Chenhall ( 2003 ) classifies management controls in the two broad categories of organic, less standardized and mechanistic, formalized management controls. Merchant and Van der Stede ( 2017 ) provide a more nuanced categorization by differentiating results controls (focusing on the outcomes of employees’ work activities), action controls (setting decision frames within that decision makers can operate), personnel controls (ensuring a good fit between the recruited employees and the job requirements) and cultural controls (norms, traditions and organizational values). Malmi and Brown ( 2008 ) separate five types of management controls: Planning controls are dedicated to the definition of targets of different business units and their coordination. Cybernetic controls constitute activities that ensure goal achievement through for example budgets and performance measures. Reward and compensation controls comprise incentive systems to motivate employees to behave in accordance with organizational goals. Administrative goals consist of organizational structures, procedures and routines. Cultural controls focus on the application of organizational norms and values to influence employees’ behavior.

Banks’ risk culture is part of cultural controls and as such, forms part of organic, less standardized management controls. In contrast, those aspects that are discussed in literature as important to reach a risk culture that fits the business model form part of other management controls, like results/rewards and compensation controls. The systematic literature review builds on this observation and serves to identify these aspects discussed to date and their relation to risk culture. To assure a structured discussion of the articles assigned to this category, we apply the framework designed by Merchant and Van der Stede ( 2017 ), that provides the subcategories cultural, action, personnel and results controls. In the first subcategory, cultural controls , we present articles that for example deal with different manifestations of risk culture as one form of cultural controls, that emphasize ethical aspects as another part of cultural controls or that indicate an impact of national culture in this context. Further three subcategories deal with articles which provide insights regarding one of the relations between banks’ risk culture and action, personnel and results controls. Additionally, we identified articles which deal with more comprehensive frameworks related to banks’ risk culture comprising issues considering all kinds of management controls. These articles are discussed in one further subcategory.

Third, management control systems are not static, but they develop over time, the same holds for banks’ risk culture and its embeddedness in banks’ overall management control systems. This observation leads to a third important issue which is related to the nature of the change and the changeability of risk culture in banks and its relation to management controls.

To get a comprehensive overview of the recent developments in risk culture research we performed a systematic literature review (Tranfield et al., 2003 ). The previous discussion on risk culture in Sect.  2 indicates, that risk culture, as an immaterial, organizational and social phenomenon, is difficult to delimit, which complicates the design of a systematic literature review, as many aspects can affect it, which in turn become important for management control systems to manage it. In order to do justice to this problem and the continuous progress of research in this rapidly growing field, we have conducted multi-phase research. The starting point here was a broad view on the topic.

As adequate risk culture is reflected in risk taking behavior that fits to the selected business model, in the first phase we focused on both, articles that explicitly cover the topic banks’ risk culture and papers that deal with risk taking in banks. However, with respect to the latter topic we concentrated on papers that are related to qualitative regulation, i.e. aspects of quantitative regulation like proper risk measurement tools, capital requirements, credit regulation regimes and similar aspects were not considered. In order to achieve a broad perspective on the topic, in this first phase we included peer reviewed articles from two different sources. Furthermore, as we deemed risk culture as a more recent concept in the area of bank regulation, we restricted this first search phase to the time period of January 1997 to the beginning of November 2019.

First, we performed a comprehensive database research of articles in the Abi Inform Complete database (only peer reviewed articles, English language) with the keywords risk culture, risk climate, risk management and risk taking as part of the title, abstract or keywords in the articles. This search was intended to provide a broad overview of relevant articles across all levels of peer-reviewed journals without any restrictions in terms of ranking levels. Due to the great amount of unfitting search results, we had to narrow, where appropriate, the thematic scope by applying by the database provided pre-set filters to exclude articles focusing on other research topics, such as for example public health. This search procedure provided in a first step the results illustrated in Table 1 , where the first row shows the results without the pre-set filters and the second row those results applying the pre-set filters, respectively.

However, despite the application of the pre-set filters, the received hits still contained a large number of articles, which were not in the focus of the present study, as they did not deal with risk culture in the banking industry, but e.g. risk taking related to sexual behavior or risks related to climate change. A research fellow (master level) knowledgeable in the field of risk management scanned these articles for their relation to risk culture in terms of a general organizational attitude towards risk and its handling in banks. This procedure resulted in 95 articles, which he considered as potentially relevant.

Second, in this first phase we in parallel performed an additional in-depth search in several premium journals to additionally identify those articles which were not listed in the database or which were related to our topic but could not be identified via the keywords within the database. We decided to perform this step, although it might result in a certain bias as here we explicitly focus on highly ranked journals, as we consider articles in these journals to be the most impactful, whose neglect in an overview would result in considerable restrictions. By pursuing this double strategy (database search and journal search) we try to do justice to the tension between breadth and depth of a literature review as mentioned by Tranfield et al. ( 2003 ), which arises especially in a still young and self-defining field.

As we focus on both risk culture in banks, i.e. a finance topic, and management control systems, i.e. a management control topic, we selected journals from two disciplines: On the one hand, as we focus on risk culture in banks, we considered financial premier journals. We identified the following journals using journal ranking and bibliometric studies (e.g., García-Romero et al., 2016 ; Ritzberger, 2008 ; Schäffer et al., 2011 ) and a range of journal rankings compiled and updated regularly by Anne Will Harzing (available at: https://harzing.com/resources/journal-quality-list ): Journal of Finance; Journal of Financial Economics; Journal of Banking & Finance; Journal of Economic Dynamics & Control; Review of Finance; Review of Financial Studies; Journal of Financial Intermediation; Journal of Money, Credit & Banking. On the other hand, as risk culture is part of banks’ management controls, we additionally searched within premier journals that cover management control research. We selected Journal of Accounting and Economics, Journal of Accounting Research, The Accounting Review, Contemporary Accounting Research, Management Accounting Research and Accounting, Organizations and Society as premier accounting journals based on Bonner et al. ( 2006 ) and Balstad and Berg ( 2019 ). The search, which was performed by reading the title and the abstract, in these premier journals lead to 310 potentially relevant articles.

The search in the journals was conducted independently by one of the two authors and partly by a research fellow (master level) knowledgeable in the field of risk management.

In the further process the authors once again read the abstracts or, if necessary, the complete texts of the articles so far identified in the database and the premier journals as potentially relevant. During this process further articles were identified which, in contrast to our or the research fellow’s initial judgement, did not provide insights directly related to risk culture as a qualitative aspect of regulation, but 1) focused mainly on aspects related to quantitative regulation like risk measurement or capital requirements, 2) covered a much broader perspective, like risk management or risk taking in banks in general or 3) dealt with risk management in general independently of the industry. Therefore, further articles, which were initially considered as potentially relevant by one of the authors or the research fellow, were excluded from our sample after debating it with the other author. Moreover, those articles which focused on risk culture in the sense of the present paper were further analyzed whether they also contained a relation to management control systems as defined in the present paper. This procedure reduced our sample from initially 405 potentially relevant articles to 37 articles. One further article was eliminated due to a reviewer recommendation during the revision process leading to a sample of 36 relevant articles. To assure completeness of our sample, we hereafter executed a backward search, i.e. we analyzed the literature of our sample and identified 15 additional articles that we considered in our further analysis. Finally, we retained 51 articles in our sample.

However, as research on risk culture is conducted with growing interest and published in a broad range of journals apart from premium journals and potentially not listed in the ABI Inform Complete database, we decided to execute a second search phase in June 2020. During this search, we did not focus on a pre-set period of time to additionally also cover literature, which was overlooked during the first phase as it was published before the pre-set time frame. We decided to make this change to the search framework because when we read the articles already identified we noticed that some older sources were indeed cited. We searched the following databases: Abi Inform Complete (226 hits), Business Source Premier/EconLit (111 hits), Ingenta (225 hits) and Science Direct (114 hits) with the search strings “risk culture AND bank” and “risk climate AND bank” in title , abstract or keywords . It has to be mentioned, that due to this more focused search strategy in terms of the search string, this second search provided a much lower number of initial hits, while yielding a number of additional articles almost comparable to the outcome of the first search phase. Additionally, we searched the first 200 hits of Google Scholar applying these search strings. The total amount of hits contained 148 duplicates. After reading the abstracts and partly the papers, we identified 32 articles additionally to the previously selected papers. These articles also were subject to a backward search, which yielded 20 further papers. Thus, in total we identified 103 relevant articles.

The identified literature is structured along those categories that are derived in Sect.  2 : The first category focuses on the assessment of risk culture. The second category deals with the relation between risk culture and particular management controls or packages of them. We differentiate five subcategories: The first subcategory contains articles dealing with more holistic aspects regarding the embeddedness of risk culture in overall management control packages. They mention several management controls simultaneously. The remaining four subcategories are dedicated to articles which focus on one of the four management control types introduced by Merchant and Van der Stede ( 2017 ), i.e. cultural, action, results and personnel controls. In the third category we elaborate on issues related to the development of banks’ risk culture over time.

Table 2 provides an overview of the papers, the applied method and the sample, where applicable. Table 3 constitutes the concept matrix resulting from categorizing the content of the identified articles (Webster & Watson, 2002 ).

4.1 Assessment of risk culture

Literature regarding the assessment of risk culture still is scarce. We identified two validated scales and one framework. Sheedy et al. ( 2017 ) present a scale of 16 items (structured along four factors) to measure the perception of risk culture, which they call risk climate. The scale comprises the following dimensions: “Valued: Staff perceive that risk management is genuinely valued within the organization […] Proactive: Staff perceive that (in the local business unit) risk issues and events are proactively identified and addressed […] Avoidance: Staff perceive that risk issues and policy breaches are ignored, downplayed or excused in the organization […] Manager: Staff perceive that their (local) manager is an effective role model for desirable risk management behaviours” (Sheedy, 2016 , p. 6). Sheedy ( 2016 ) uses this scale to investigate the relation between risk climate and banks’ size. Sheedy and Griffin ( 2018 ) apply this scale to analyze staff’s perception of risk culture and its relation with risk structures and risk behavior, i.e. in this recent publication, they switch from their previous term risk climate to risk culture. The data (30,126 responses by staff of banks in Australia and Canada in the period of 2014 to 2015) provides evidence for varying perceptions with regard to the quality of risk culture between business units and business lines and a rather complex relation between risk structures, risk culture and risk behavior.

Muñiz et al. ( 2020 ) present another 18-item scale to assess risk culture in banks considering the four building blocks according to the FSB (tone from the top, accountability, effective communication and challenges, incentives), i.e. they more closely follow regulators’ specifications, but also focus on staff’s perceptions.

Thakor ( 2016 ) transfers the Competing Value Framework to banks’ credit culture to create an instrument, which allows banks to assess their culture. The original framework differentiates the four corporate culture orientations compete, create, control and collaborate, which are related to different leader styles, value drivers and basic assumptions about the means to effectively achieve goals (Quinn & Rohrbaugh, 1983 ). Thakor ( 2016 ) adapts this framework to assess credit culture and differentiates competitive individual culture (compete), product-innovation-focused culture (create), risk-minimization-focused culture (control) and partnership culture (collaborate). Banks act differently in the context of credit risk management depending on the particular culture type. In contrast to the two previously mentioned assessment instruments, Thakor ( 2016 ) does not provide a validated scale, but rather points to a more subjective self-assessment process.

4.2 Relation between risk culture and management controls

4.2.1 embeddedness of risk culture in overall management control packages.

On a conceptually basis, several scholars develop and discuss comprehensive frameworks to foster banks’ risk culture, which highlight learning from failure, organizational resilience and corporate governance as more general aspects, but also individual responsibility and supervision (which are related to action controls), remuneration systems (which constitute results controls) as well as training, recruitment and knowledgeable leaders (which are components of personnel controls) (Bott & Milkau, 2018 ; Cordery, 2007 ; Drennan, 2004 ; Drummond, 2002 ; Gontarek, 2016 ; Jackson, 2015 ; McConnell, 2013 ; Srivastav & Hagendorff, 2016 ; Wood & Lewis, 2018 ). Young ( 2011 ) adds the concept of high-reliability organizations to the discussion. They offer the possibility to establish more stable banks in terms of risk taking due to high levels of resilience and responsiveness, exemplary leadership and customer-centric objectives. Fritz-Morgenthal et al. ( 2016 ) and Yusuf et al. ( 2020 ) add to this further insights regarding the positive effects of an adequate risk culture on risk management.

These concepts promote a holistic perspective on risk culture or as Stulz ( 2008 , p. 47) stresses: “If risk is everybody’s business, it is harder for major risks to go undetected and unmanaged.” This view underpins the importance not only of individual management controls in the context of risk culture, but also and especially of the importance of embedding risk culture in an overarching concept for entire management control systems. The following articles add to this perspective further insights.

Cordery ( 2007 , p. 64) elaborates on the severe foreign exchange loss announced by the National Australian Bank in January 2004 and identifies problems applying “behavioural controls, such as supervision and security restrictions, attitudinal controls affecting hiring procedures and corporate cultural development, and accountability controls consisting of budgets, targets, incentives and reporting” as instruments to attenuate dysfunctional behavior in this context. According to the author, particularly, incentive systems motivated dealers to break trading limits and to work around established control systems. Moreover, dealers did not exhibit proper attitudes to behave in an ethical way. Although the bank applied codes of conduct signed by each employee, they were not trained to fill this declaration of intent with life and there was no exchange between the board members to develop systems implementing the declaration in daily business. Furthermore, due to a focus on profit only good news was passed to the top management. Additionally, board members did not have a full understanding of the business model and particularly the risk underlying it. Dellaportas et al. ( 2007 ) discuss the same case study, i.e. the National Australian Bank. They also highlight detrimental effects of incentive systems. Moreover, they stress that management followed a profit-oriented perspective, neglecting ethical aspects and that the organization operated in a bureaucratic manner, where top management focused on processes, documentation and procedure manuals instead of really understanding the issues. This points to dysfunctional communication structures. Furthermore, management also did not take on responsibility, personal and professional attacks were observed towards market risk and internal audit staff by traders and traders were selected only according to their ability to make profits irrespectively of how they achieved them.

Barings Bank is another prominent example of failing to embed a proper risk culture in an overarching set of management controls (Stonham, 1996a , 1996b ). Drennan ( 2004 ) particularly points to missing personnel and action controls in this context. The author provides evidence that the recruitment of extreme risk takers in reaction to the de-regulation of the UK financial services market and dysfunctional supervision processes allowed Nick Leeson, a trader on the Singapore International Monetary Exchange (SIMEX), to continue fraudulent activities. He was not only Chief Trader but also Head of Settlements. Moreover, his local supervisor did not monitor him and his manager in London left the monitoring to the local supervisor. Drummond ( 2002 ) adds to the discussion that Leeson’s supervisors were not knowledgeable enough to supervise his activities and operated in a state of “groupthink”. Stein ( 2000 ) discusses the case of Barings Bank from a psychoanalytical point of view. He also identifies the deregulation of the UK banking sector as one major factor that enhanced the dysfunctional structures, which allowed Leeson to act without proper supervision.

Lehman Brothers constitutes a third example of failure, which is explicitly discussed in extant literature. Based on Schein’s ( 2010 ) organizational culture framework Ganon et al. ( 2017 ) identify the behavior of Richard Fulder, the final CEO of Lehman Brothers, and the culture installed by him as major drivers for the bank’s collapse, i.e. in this context the authors particularly stress the absence of proper personnel and cultural controls.

Literature dealing with the reasons behind the last financial crisis as well points to missing relations between risk culture and other management controls. Jackson ( 2015 ) highlights (among other aspects) inadequate incentives, poor information flows, poor leadership and no clear accountability as reasons for inadequate risk taking resulting in the financial crisis. Furlong et al. ( 2017 ) argue that misconduct, which also led to the financial crisis in 2007/2008, is rooted in poor judgements resulting from underdeveloped character dimensions and organizational culture which does not mitigate them. Thus, the authors focus on both personnel and cultural controls. They explicitly stress that poor conduct not only is an ethical or moral issue. This perspective has the advantage that “[v]iewing misconduct as a judgement issue instead of a moral issue engages audiences who want to improve decision-making but without the judging that is typically associated with moral agendas. Discussions can be had more dispassionately and rationally, and the audience does not feel themselves under attack” (Furlong et al., 2017 , p. 208). The authors develop a Leader Character Framework that comprises those characteristics relevant for leaders to behave adequately. Hashagen et al. ( 2009 ) present a study with more than 400 participants (senior managers involved in risk management of banks) carried out by KPMG and the Economist Intelligence Unit. The participants were asked to name the weaknesses in risk management in banks that fostered the recent financial crisis and the measures that banks take to prevent such a crisis from occurring again. The participants stress the importance of risk culture and highlight the relevance of senior managers’ leadership to implement a prudent risk culture, i.e. 77% of the participants stress tone from the top as one important issue to develop an appropriate risk culture. Also, proper remuneration and a strengthening of risk professionals’ role is mentioned. However, as many as 45% of the banks surveyed also admit that their management boards do not have sufficient knowledge about risks.

4.2.2 Risk culture and cultural controls

The present section is dedicated to the relation between risk culture and banks’ overarching cultural controls. Rad ( 2016 ) provides a particular perspective on this issue. The author focuses on the interplay between risk management and management control systems. Thus, he does not refer to risk culture, but rather to a concept which is related to it. However, by drawing on Simons’ Levers of Control Framework to analyze this relation in two case studies, he identifies belief systems to be of high relevance in this context. Thus, although he does not focus on risk culture in particular, his analysis stresses the importance of cultural components, when analyzing the relation between risk management and management controls. Similarly, Stulz ( 2016 ) highlights culture as an important factor to mitigate the limitations of risk management.

While risk culture as such is by definition one component of cultural controls, it is also related to other aspects linked to this control type. One important aspect in this context are ethical issues . For example, Lui ( 2015 ) investigates five British banks and finds evidence that these banks have undergone a transformation from a customer-driven culture to a sales-oriented culture, which resulted in a greedy, reckless and dishonest behavior. Llewellyn ( 2014 ) discusses detrimental effects of banks’ culture in the context of the last financial crisis. The author does not explicitly state risk culture, but rather refers to banks’ culture in general and their effect on consumers. Nevertheless, it is clear from this discussion that risks relating to financial products must be clearly recognizable to customers in order to maintain a lasting basis of trust. In addition, he sees the establishment of cooperative banks as an opportunity to establish prudent risk behavior. Consequently, ethical behavior in terms of consumer-oriented and sustainable decision making can be related to prudent risk taking, which in turn is related to an adequate risk culture that mitigates systemic collapses of financial systems. Accordingly, Minto ( 2016 ) discusses the specific values of cooperative banks as reasons for these banks to cope much better with the financial crisis in 2007/2008 than commercial banks. The author specifically highlights trust and reciprocity, solidarity, mutualism, proximity and “relationship banking” via local presence, heterogeneity through member ownership as well as social commitment and the “cooperative spirit”. In their conceptual paper, also Awrey et al. ( 2013 ) debate how to achieve a more ethical culture in the financial service industry. According to them, especially process-oriented regulation “backed by a credible threat of both public enforcement and reputational sanctions” (Awrey et al., 2013 , p. 191) can help to establish a more ethical organizational culture in banks by reshaping individual ethical choices. Thus, they argue for stronger regulation and societal sanctioning via reputational losses in case of unethical behavior. Complementary to this discussion, Fichter ( 2018 ) elaborates on how ethical issues are solved in the daily decision processes within the financial industry and provides several suggestions for how financial institutions can translate formal ethical standards into decision making practice. The author stresses challenging authority, creating opportunities for discourse, valuing positive emotion or making time for reflection. Overall, this literature stresses the link between prudent risk raking, (risk) culture and ethical decision making. Thus, for a risk culture to be effective in terms of the overall financial system and to help to prevent systemic collapses, it must be embedded in an overarching cultural context of the bank that follows clear ethical standards.

Another component of cultural controls is the organizational handling of failure . In this context, Gendron et al. ( 2016 ) add to the discussion a perspective on stabilizing processes, which restore risk management credibility after failures and thereby inhibit a fundamental change in approaching risk management in banks. The authors find that failure of risk management is attributed to external factors like implementation failures rather than to failures within the core ideas behind the implemented instruments. Thus, a particular culture of handling failure can affect or inhibit the development of risk culture, in terms of how to manage risks reasonably, into an appropriate direction.

Other scholars focus more on the antecedents and components of risk culture . They particularly discuss the relation between values, norms and risk culture. Lo ( 2016 ) mention different sources of such values . They can be derived top-down (through leadership and authority) and bottom-up (merging form individual behavior) and they are influenced by incentives and environmental factors. By applying Schein’s model of organizational culture Kane ( 2016 ) identifies particular norms in financial institutions and central banks, which foster destructive risk taking. The author argues for a fundamental change of norms within this industry, as the implementation of mechanisms just to constrain the resulting behavior will not effectively mitigate it. In line with this argumentation, Cohn et al. ( 2017 ) expected that professional norms in the financial industry in combination with the salience of the staff’s professional identity foster risk taking. However, in an experimental setting with 128 employees of a large, international bank they find evidence that participants took fewer risks. The authors conclude that their results “contradict the conventional thinking that the professional norms in the banking industry make the employees in that industry less risk averse” (Cohn et al., 2017 , p. 3803). However, this finding has to be put in a broader perspective. The identification of an adequate risk culture for a particular bank does not mean that the bank has to become risk averse, but instead the risk culture has to fit to the bank’s business model and to induce in this sense prudent risk taking. In this context, further findings by Cohn et al. ( 2014 ) are more informative, as the authors find evidence, that the salience of bankers’ professional identity fosters their dishonest behavior, which points to a fundamental problem when establishing an adequate risk culture, as according to the previous discussion such a culture depends on transparent, responsible and honest behavior.

Further scholars consider different manifestations of risk culture to be the condensate of the mentioned values and norms: In order to analyze, whether the growing and in literature criticized focus on quantitative risk management is inevitable, Mikes ( 2009 ) discusses two different risk cultures. Mikes ( 2011 ) further elaborates on these different manifestations and investigates the perspectives on risk measurement within two case studies and 53 further interviews with risk management staff in the period of 2001 to 2010. Some organizations have a culture of quantitative enthusiasm , i.e. they believe in the power of risk measurement, while others follow a culture of quantitative skepticism , which results in risk envisionment by providing alternative future scenarios. The two cultures lead to different behavior of risk officers and their boundary work. A culture of quantitative enthusiasm fosters risk control through the implementation of measurement instruments and the emphasis of independent and scientific risk control. In contrast, in a culture of calculative skepticism, “controllers in this camp lacked the analytical mystique wielded by those with quantitative enthusiasm and they appeared to have deliberately left the boundaries between themselves and the rest of the organization blurred and porous in order to influence decision makers in the business lines” (Mikes, 2011 , p. 241). Lim et al. ( 2017 ) add to this further evidence. Based on qualitative data, they argue that banks are confronted with “a core paradox of market versus regulatory demands and an accompanying variety of performance, learning and belonging paradoxes” (Lim et al., 2017 , p. 75), which are so far resolved by inappropriate measures, as a power imbalance between front and back office remains. The authors suggest that this problem only can be resolved if risk management is less defined by normative, standard based rules but considers a behavioral dimension. Thus, they argue for a shift from quantitative enthusiasm to quantitative skepticism. Stulz ( 2015 ) also contrasts a behavioral perspective with a statistical, calculative orientation in risk management. The author states that “it’s important to keep in mind that companies in the financial industry differ considerably from non-financial firms in the extent to which employees are empowered to make decisions that affect risk” (Stulz, 2015 , p. 16) and stresses adequate risk culture as a way to increase flexibility which is mitigated by statistical risk management. Based on the notion that the application of quantitative models increases the perception of decreasing uncertainty and increasing manageability of risk, LaBriola ( 2019 ) analyzes a possible positive relation between the relative level (1) of securities and (2) of trading securities and levels of leverage. The data (bank-years for large U.S. commercial banks over the period of 1996 to 2016) supports the second hypothesis, whereas it does not lend any support to the first one. However, the support of the second hypothesis does not indicate that actually the application of quantitative models as such results in imprudent risk taking, as the author does not test this relation. Yet, the results point to a possible relation, which again favors calculative skepticism over quantitative enthusiasm. Based on the Competing Value Framework, which comprises the four corporate culture dimensions compete, create, control and collaborate (cf. Sect.  4.1 ) developed by Quinn and Rohrbaugh ( 1983 ), Nguyen et al. ( 2019 ) add to these results by differentiating two foci of risk culture: compete and create cultures are related to a growth focus, while collaborate and control cultures pertain a safety focus. The authors find that banks following the earlier focus incur greater loan losses than banks applying the later focus. In sum, besides categorizing risk culture into different categories the mentioned authors also evaluate the identified types. Risk cultures stressing on collaboration, trust, solidarity and a healthy critical distance to mathematical risk management approaches seem to be favored over competitive, aggressive and quantitatively enthusiastic cultures, as the former result in more resilient banks.

Additionally, scholars find evidence that the conceptualization of an adequate risk culture might vary between organizational units within one single bank depending on the units’ tasks: Based on semi-structured interviews Wahlström ( 2009 ) finds differences with respect to the acceptance of the approaches of risk measurement by Basel II between the operational staff and staff working with risk measurement. The author explains this observation with differences in the frames of reference, which can be interpreted as parts of the risk culture prevailing within each unit. While such differences can result in conflicts, Bruce ( 2014 ) provides evidence that different perspectives on risk culture within one bank also can be advantageous. The author presents four worldviews, which can be interpreted as antecedents of risk culture and which result from a combination between grid and group: Grid refers to the extent to which the social context expects people to behave in a particular way dependent on their role, i.e. the military is a high grid-context, as the hierarchical position clearly determines how a person can act. In contrast, “[g]roup measures both how strongly an individual associates with the organization or collective, and how strongly the organization or collective exerts influence over the individual” (Bruce, 2014 , p. 552). Each dimension can have two levels (high and low). Therefore, the combination of the dimensions results in four worldviews, which in turn guide human behavior differently and, thus, also the interpretation of the reasons behind the recent financial crisis. Based on this analysis, the author argues that diversity and the joint incorporation of different worldviews can improve risk management. Consequently, the implementation of an adequate risk culture that fits the selected business model also comprises the acceptance of different worldviews.

National culture constitutes another source of norm-based influence. It forms part of cultural controls, but it is less changeable by firms as such. It rather constitutes a pre-set condition, in which other cultural controls are embedded. Scholars actually find evidence that it exerts an important impact on banks’ risk taking. For example, based on a sample of 65 to 70 countries in the period of 2000 to 2006, Kanagaretnam et al. ( 2014 ) find lower risk taking in banks in low individualism and high uncertainty avoidance cultures. Similarly, in a sample of 75 countries Ashraf et al. ( 2016 ) observe that cultures characterized by high individualism and low uncertainty avoidance (as well as low power distance) foster risk taking in banks. Findings by Mihet ( 2013 ) support this evidence regarding a positive relation between high individualism and risk taking. Mourouzidou-Damtsa et al. ( 2019 ) as well observe this relation, but not for globally operating banks. In contrast, in a global sample of 467 commercial listed banks from 56 countries, Illiashenko and Laidroo ( 2020 ) find evidence of a negative relation between individualism and banks’ risk taking. The authors explain this observation by the cushioning hypothesis, i.e. decision makers in collectivist cultures receive more support if they make a mistake and are therefore more willing to take risks. Kanagaretnam et al. ( 2019 ) add to these observations evidence of a relation between societal trust and banks’ risk taking: Banks located in high-trust countries exhibit lower levels of risk taking than banks located in low-trust countries. The authors further provide first evidence that this attenuating effect is channeled via greater accounting transparency, higher scores in social CSR and lower CEO equity incentive compensation, i.e. in the study societal trust is related to these aspects in the mentioned direction and they attenuate imprudent risk taking. In sum, these results suggest that the basic attitudes towards risk behavior within a national culture have an important impact on banks’ risk taking and thus supplement and influence the risk culture of a particular bank.

Finally, also different stakeholders can exert an impact on risk culture, because they can have more or less influence depending on their position of power by communicating corresponding expectations and setting certain regulatory standards. Also in this context only some scholars explicitly discuss risk culture, while others rather provide indirect insights with respect to risk culture, as they focus on risk taking. However, as risk taking also is an expression of the prevailing risk culture and the investigated stakeholders have the power to set norms and values and thereby to transport their worldview into the banks and to influence the manifestation of cultural controls, we consider also this part of literature as insightful for the present topic. Several scholars focus on the impact of regulators on risk culture as particularly powerful stakeholders (Cohen, 2015 ; Mongiardino & Plath, 2010 ; Rattaggi, 2017 ; Walter & Narring, 2020 ). For example, Schnatterly et al. ( 2019 ) investigate the implications of the selection of one of three possible regulators by the initial board of directors within new U.S. banks for the banks’ future risk taking. Their results point to a joint effect of board independence and the selected regulator on the banks’ risk. The analysis is based on a sample of 140 new banks from the population of 1,367 U.S. banks chartered between 1992 and 1998. Carretta et al. ( 2017 ) observe differences between national supervisors’ conceptualization of risk culture as well as their substantial distance to the ECB’s risk culture in the period of 1999 to 2012. These differences complicate the development of an adequate risk culture within European banks, particularly the ones that operate internationally, because they are confronted with different requirements. Sinha and Arena ( 2018 ) investigate the viewpoints of regulators as well as normalizers, consultants, and implementers on risk culture. Their sample consists of 20 interviews and 295 documents. They find two distinct interpretations. While the first interpretation concentrates on the control of risk culture via verification, the second interpretation focuses on the control of risk culture through internal audits and the empowerment of employees through training. Regulators and implementers promote the first interpretation, while consultants and normalizers foster the second one. In order to fully satisfy the different stakeholders’ demands, banks have to set up a process, which discloses these viewpoints and integrates them into a comprehensive approach related to the management of risk culture.

Bank founders and owners constitute another important group of stakeholders which exerts an impact on banks’ risk culture. Almandoz ( 2014 ) finds that bank founders’ institutional logic influences those banks’ risk taking, at least in banks with larger founder teams. Based on archival data from 225 local banks founded between 2006 and 2009 and interviews with 73 bank founders, he observes that banks, whose founder team adheres to a financial logic, define the bank as an investment and profit-maximization vehicle and increasingly use risky deposit instruments. In contrast, the dominance of a community logic stresses the relevance of the bank to meet community needs and leads to a lower utilization of such instruments. According to Saunders et al. ( 1990 ) stockholder held banks exhibit a higher level of risk taking than managerial controlled banks. Sullivan and Spong ( 2007 ) observe that hired managers’ stock ownership increases risk taking. Kwan ( 2004 ) finds moderate evidence of a lower level of risk taking in publicly held banks than in private owned banks. Iannotta et al. ( 2007 ) as well find differences regarding risk taking across banks with different ownership structures. The findings in a sample of European banks by Barry et al. ( 2011 ) indicate that difference in risk taking induced by different owners rather occurs in privately owned banks than in publicly held banks. Additionally, applying a panel of commercial banks from 17 European countries containing 1,237 banks with ownership information within the period of 1998 to 2011 Barry et al. ( 2019 ) observe an effect of the acquirer type on the level of risk (and profitability). Institutional investors, the state or non-financial companies lead to increasing risk, while profitability remains the same. In contrast, banks and families as acquirer have no significant effect on risk.

4.2.3 Risk culture and action controls

There is very little literature on the link between risk culture and action controls. Apart from the literature discussed in Sect.  4.2.1 , which, among other aspects, mentions the importance of supervision and accountability, we identified one article, which deals indepth with one particular aspect related to action controls. Again, this article discusses the effect on risk taking and thus only indirectly provides evidence regarding risk culture.

In a conceptual paper applying the theoretical lens of principal-agent theory, i.e. aspects like moral hazard, conflict of interest and adverse selection, Roy ( 2008 ) investigates the impact of different organizational structures (functional versus divisional hierarchy) on banks’ risk taking. According to the author, functional hierarchy inhibits the application of soft information and the transfer of information in time to the relevant place within the organization, which for example can mitigate the proper examination of a loan. In contrast, divisional hierarchies foster the individualization of risk choices without considering the whole risk portfolio of the bank. However, the author concludes that after considering the pros and cons of both structures, the divisional structure is superior to the functional one in terms of fostering an adequate risk taking behavior. As previously mentioned, this paper does not deal explicitly with risk culture. However, it provides evidence of how organizational structure can shape risk taking. Through this framing process, organizational structure on the one hand can inhibit or foster risk taking which is in line with a particular risk culture, and thereby influence risk culture’s impact. On the other hand, it also can shape risk culture as such as it fosters the acceptance of particular risk taking as inevitable (within the given structures), which is translated into organizational believes about how risk taking should take place.

4.2.4 Risk culture and results controls

A very broad stream of literature discusses incentive systems, i.e. results controls, as they focus decision makers’ attention towards certain aspects and thereby directly influence their risk taking. Thus, many scholars in this context rather discuss risk taking than risk culture. However, we also consider this literature as valuable for the present research focus because it illustrates, how certain incentive systems as manifestation of a particular risk culture can induce certain risk taking. Thereby they can further stabilize this risk taking behavior and strengthen underlying norms related to risk behavior, i.e. risk culture. The identified literature discusses aspects both on the top and on the operational level. Moreover, scholars apply both mathematical and empirical methodologies in this research field.

Two articles provide evidence regarding normative results with respect to variable compensation at the top-management level. They mathematically analyze possibilities to influence the way of how decision makers evaluate and take risks and to curb a culture of excessive risk taking by aligning investor interests and executive interests via compensation. By applying a principal agent-based methodology, John et al. ( 2000 ) explore the possibility to influence bank risk taking through the incorporation of incentive features of top-management compensation in the FDIC (Federal Deposit Insurance Corporation) insurance premium scheme. Such schemes should induce bank owners to design optimal incentive schemes for top managers. Additionally, based on the results of their principal agent-model, Bolton et al. ( 2015 ) suggest to mitigate excessive risk taking by relating compensation to stock prices and credit default swaps.

However, while the previously mentioned research based on mathematical modelling identifies a positive relation between the alignment of investors’ and top managers’ interests via variable compensation components, empirical evidence and conceptual discussion is somewhat contrary. Zalewska ( 2016 , p. 331) questions the suitability of transferring insights from literature on principal-agent conflicts in general, as “in the case of the banking sector, remuneration may be a source of type III agency conflict, i.e., the conflict between shareholders and other stakeholders, and as such cannot be left in the hands of shareholders or even financial institution-related stakeholders (e.g., employees)“. Thus, the author argues that regulators should also be actively involved in setting the remuneration to achieve a comprehensive approach in regulation and to calibrate incentives in a way that fits to the desired risk level and thereby fosters an adequate risk culture. Accordingly, Fahlenbrach and Stulz ( 2011 ) find, based on a sample of 95 banks extracted from Standard and Poor’s Execucomp database, no evidence that a better alignment of CEOs’ compensation with shareholders’ interests leads to a better performance of banks during the last crisis. They rather argue that banks following this path even might have performed worse with respect to stock returns and accounting return on equity. Thus, their findings do not indicate any positive impact of compensation schemes related to investor interests on prudent risk taking leading to superior performance. Bebchuk et al. ( 2010 ) analyze the effects of compensation structures in Bear Stearns and Lehman Brothers in the period of 2000 to 2008 and argue for a detrimental effect of short-term variable compensation components. Based on the analysis of 14 financial institutes in the period of 2000 to 2008, Bhagat and Bolton ( 2014 ) also find negative impacts of executive compensation programs and suggest Restricted Equity , i.e. executive compensation that contains restricted stock and stock options, which can be sold only after a certain period of time after leaving the firm. Bhagat et al. ( 2014 ) pick up this discussion and elaborate further on this concept. Also, Gande and Kalpathy ( 2017 ) observe detrimental effects of CEO equity incentives, as they foster solvency problems related to risk taking behavior. Their results are based on a sample of 69 financial firms in the period of 2007 to 2010. These findings are further corroborated by the results of Hagendorff and Vallascas ( 2011 ), who identify in a sample of 172 bank acquisitions between 1993 and 2007 a positive relation between variable incentives and risky mergers undertaken by bank CEOs. Moreover, also other compensation components can have a detrimental impact: Brown et al. ( 2015 ) examine the effect of 533 severance contracts for financial service firms in the period of 1997 to 2007 and find a positive relation between the amount stated in these contracts and risk taking.

Further scholars observe a relation between option-based compensation and a detrimental degree of risk taking, particular in the run-up of the last financial crisis: By investigating a sample during the period of 1992 to 2000 with 591 bank-CEO-year observations Chen et al. ( 2006 ) find a positive relation between the application of option-based compensation and the risk taking of commercial banks. A similar result is observed by Minhat and Abdullah ( 2016 ), who apply a balanced panel of 240 bank-year-observations in the period of 2005 to 2008. Fortin et al. ( 2010 ) as well identify positive effects of stock options on banks’ risk taking by investigating 83 large U.S. bank holding companies in the period of 2005 to 2006.

In sum, this stream of literature stresses negative effects of particularly option-based and other variable incentives on prudent risk taking. These incentive systems foster a culture of excessive risk taking, which is detrimental to the banks’ performance and thus does not fit to any viable business model, be it rather risk averse or risk seeking. Thus, they transport a kind of risk culture into the banks which is detrimental and not in the sense of regulation which attaches great importance to minimizing unnecessary risks (e.g., FSB, 2014 ).

Yet, Iqbal and Vähämaa ( 2019 ) find ambiguous evidence for a clear relation between incentive systems and banks’ systemic risk. Data obtained from 71 large U.S. financial institutions on CEO and CFO compensation over the period of 2005 to 2010 with 332 firm-year observations points to a negative relation between systemic risk and the sensitivities of CEO and CFO compensation to stock return volatility. In contrast, the data also provides evidence that “financial institutions with greater managerial risk-taking incentives were associated with significantly higher levels of systemic risk during the peak of the financial crisis in 2008” (Iqbal & Vähämaa, 2019 , p. 1229). Acrey et al. ( 2011 ) as well do not find a clear indication for detrimental effects of options and bonuses. In their study, based on a sample of the largest U.S. banks in the period of 2004 to 2008 (dependent on the analysis the sample size varies between 35 and 85), these compensation components are either insignificantly related to risk variables or exhibit a negative correlation with them. Moreover, Houston and James ( 1995 ) do not find evidence that compensation is structured in a way that fosters more risk taking in banks than in other industries within a sample from 1980 to 1990. Applying a sample of bank-years for large U.S. commercial banks over the period of 1996 to 2016 LaBriola ( 2019 ) tests the relation between the sensitivity of compensation of CEOs to gains in the bank’s stock price and levels of leverage but does not find any significant effect. Moreover, Guo et al. ( 2015 ) observe a positive relation between short- and long-term variable compensation components and particular risk measures, i.e. a positive relation between these incentives and risk taking, but also a negative relation between the proportion of variable incentives and the likelihood of a bank to fail (data was taken form 134 bank holding companies during the period of 1992 to 2008). According to Cheng et al. ( 2015 ) variable pay does not lead to increased risk taking but high-risk jobs, like activities in the banking sector, require firms to provide employees with high-powered, variable payment to recruit suitable staff: “Career rewards for working at high-risk firms are turbulent, and so risk and pay are correlated not because pay causes risk but because risk-averse managers require pay to keep them working at firms with higher risk. According to this view, the management teams of Bear Stearns, Lehman Brothers, Countrywide, and AIG were paid more than management at other firms as the strategies demanded by shareholders were fundamentally riskier” (Cheng et al., 2015 , p. 842).

This stream of research puts the previously mentioned findings into a broader perspective and points to the important differentiation between risk taking as such and risk culture. Although, particular kinds of incentive systems induce a higher propensity to take risks, this risk seeking behavior might not be detrimental in all instances. An adequate risk culture does not necessarily have to be risk-averse. It only has to match the level of risk that a bank wants to and, above all, can hold (e.g., FSB, 2014 ). Consequently, regulators’ increased focus on adequate incentives after the last financial crisis seems to be warranted, but the relation between compensation and risk behavior on the higher organizational levels is more complex than expected, as the following discussion also shows.

Several articles provide evidence that the relation between incentives and risk taking is further affected by various factors. Based on a principal-agent model Kolm et al. ( 2016 ) derive a complex relation between regulation, CEO compensation and active boards. According to their model in the presence of active boards “[c]ompensation regulation prevents overinvestment in strategies that increase risk, but it is ineffective in preventing underinvestment in strategies that reduce risk” (Kolm et al., 2016 , p. 1901). Consequently, these results indicate that regulation targeting risk taking by regulating compensation only has limited effect. Cerasi and Oliviero ( 2015 ) further qualify these results. Based on a mathematical model which is tested with an empirical sample of 116 banks (data taken in the period of 2007 to 2008), they find that “greater sensitivity of CEOs’ equity portfolios to stock prices and volatility is associated with poorer performance and greater risk at the banks where shareholder control is weaker and in countries with explicit deposit insurance” (Cerasi & Oliviero, 2015 , p. 242). Consequently, the detrimental impact of particular compensation components on risk taking is affected by further situational factors. Accordingly, it can also be assumed that the strength with which incentive systems transport a certain risk culture into a bank and stabilize it is also affected by such factors. This conclusion is further corroborated by Bannier et al. ( 2013 ). By applying a principal-agent framework they find a positive relation between banks’ competition for talent, their incentives to offer bonuses and risk taking. The mathematical model by Thanassoulis ( 2012 ) leads to similar observations. Consequently, limited human resources can result in excess risk taking via compensation structures that are implemented to recruit the most talented staff. This result points to external impact factors on the design of incentive systems which could counteract the intended manifestation of risk culture, because the structure of these incentives makes a certain risk behavior appear desirable even though it deviates from a risk behavior that is appropriate for the bank’s business model and thus runs counter to an adequate risk culture. It also reveals that banks can get under strong tension while they try to cope simultaneously with regulatory and market requirements.

Further articles deal with the impact of variable compensation on the behavior of staff on the lower levels . Berger et al. ( 2016 ) show different effects of lower-level and higher-level managers’ shareholdings on risk taking based on a sample of 85 U.S.-based and held failed commercial banks and a control sample of 256 U.S.-based and held non-failed commercial banks (both over the period of the first quarter of 2007 to the third quarter of 2010). In case of non-CEO executives and lower level managers, high shareholdings are related to higher failure risk, while CEOs’ high shareholdings are not related to failure risk. Consequently, the former seems to be induced to take higher risk by their high stakes, while the latter are not. On the other hand, based on experimental evidence with commercial bank loan officers Cole et al. ( 2015 ) find that high-powered incentives foster screening effort and profitable lending decisions, while deferred compensation and limited liability mute this effect. These results point to the importance of a strong and timely relation between incentives and job-performance for staff engaged into the operational activities. In contrast, by applying a lab-in-the-field experiment with 269 finance professionals, Sheedy et al. ( 2019 ) find evidence that fixed compensation (as compared to variable compensation) and risk-focused (as compared to profit-focused) work culture increase the proportion of people exhibiting risk compliance. Overall, this research exhibits partly different effects of variable compensation on different organizational levels. Moreover, findings are ambiguous, e.g., Sheedy et al. ( 2019 ) observe results in favor of fixed compensation on the operational level, while Cole et al.’s ( 2015 ) findings point to a superiority of high-powered incentives. Both studies refer to different activities on the operation level, which might explain the different outcomes. However, these ambiguous observations indicate that the call for a change of compensation schemes and the reduction of variable pay to implement an adequate risk culture and thereby more prudent risk taking in banks also on the operational level only is partly warranted.

Finally, one empirical paper is rather descriptive : Based on a sample of regional U.S. bank CEOs between the years of 2007 and 2012, Handorf ( 2015 ) investigates the changes made by banks to compensation after the recent financial crisis. The author finds that banks have changed their compensation structures and now reward high capitalization and low-risk loan portfolios. Consequently, banks have reacted to the changing requirements and adapt their compensation schemes accordingly. The focus here is on steering incentives in the direction of risk-averse behavior, which also fosters a risk culture comprising risk-averse norms.

4.2.5 Risk culture and personnel controls

Articles considering the relation between risk culture and personnel controls provide particularly evidence regarding the impact of CEOs’ traits on risk taking. Thus, again this research stream does not directly focus on risk culture. However, as risk culture constitutes norms, values and general believes about appropriate risk handling condensed from the individual believes and perceptions, this literature can be considered as valuable to understand the development of risk culture. This is all the more true as CEOs, due to their prominent position in companies, have a particular influence on the establishment of certain behavioral norms and thus also on risk culture, which is also stressed by the emphasis on the tone from the top in the context of risk culture (FSB, 2014 ). Consequently, the application of personnel controls, specifically the recruitment of CEOs with particular characteristics, can significantly affect risk culture. Bushman et al. ( 2018 ) investigate the impact of CEO’s materialism, measured via a revealed preferences approach, on, among other things, banks’ risk taking, and find a positive relation with risk taking and a weaker risk management. Their sample consisted of 284 firms and 445 CEOs in the period of 1992 to 2013. Based on a sample of 92 CEOs and data from 2006 to 2014, Buyl et al. ( 2019 ) investigate the relation between CEO narcissism, banks’ risk taking and their resilience to environmental conditions. The authors identify a positive relation between pre-crisis CEO narcissism and risk taking. This effect is fostered by stock options and mitigated by strong boards, i.e. boards including knowledgeable external directors.

A gender-effect can also be observed in the literature: Results by Palvia et al. ( 2015 ) indicate more conservative levels of capital in commercial banks with female CEOs, where the sample contains 6,729 commercial banks and an unbalanced panel of 22,978 bank-year observations in the period of 2007 to 2010.

Holland ( 2010 ) identifies missing knowledge regarding risks and value drivers as important factor determining the extent of individual bank failure during the financial crisis of 2007/2008. Similarly, in the context of the last financial crisis, Holland ( 2019 ) identifies a knowledge gap between analysts and shareholders on the one hand and bank managers on the other hand and the problems to communicate the relevant knowledge as reason that the former expected more return than possible with reasonable activities. This asymmetrical distribution of knowledge was exploited by certain insiders in the bank to create structures that benefited them but passed on possible losses to others. While some banks established high risk cultures, others tried to keep with their more conservative activities, but had increasingly problems to do so.

By applying a questionnaire filled out by 151 U.S. community banks, Eastburn and Sharland ( 2017 ) investigate why banks fail to recognize risk in a timely manner. In detail, they analyze the antecedents of risk tolerance in terms of behavioral traits and regulatory and performance criteria, the effect of risk tolerance on risk propensity, the joint effect of risk tolerance and propensity on risk practice and the relation between risk practice and performance. Their findings indicate the importance to consider a joint effect of external factors and behavioral aspects to establish a risk culture that fits to the selected business model.

4.3 Development of banks’ risk culture over time

Power ( 2009 ) focusses on the general direction that a recalibration of risk culture should take. Based on a conceptual discussion, he criticizes the concept of risk appetite as inadequate to understand and to develop a proper risk management within banks. According to this author, the concept of risk appetite is based on a view that conceptualizes banks as machines that can be controlled by defining one adequate amount of risk to take. In contrast, he suggests focusing rather on human behavior than on capital to establish an effective risk management in the future. This suggestion also affects the perspective on risk culture. The FSB ( 2014 , p. 1) stresses the importance that “institution’s risk culture supports adherence to the board-approved risk appetite”. If the concept of risk appetite is considered as inappropriate, the development of an adequate risk culture needs another anchor to be assessable as adequate.

Other scholars investigate particular recalibration processes . Palermo et al. ( 2017 ) analyze, by applying a qualitative research methodology in the UK financial sector, the reconsideration of risk culture within financial institutions after the last financial crisis as a way to cope with organizational complexity. They conceptualize this recalibration processes as an answer to the pressure to redefine the ends of financial institutions. Further, this redefinition of ends leads to uncertainty and conflict about the means how to achieve theses ends. The paper demonstrates that the implementation of a reasonable risk culture is a complex process that contains reconstruction processes of different actors, which are difficult to manage. This discussion can be further related to the findings by McConnell ( 2014 ). The author investigates two cases, Deutsche Bank and Barclays, with respect to their strategic changes announced in 2012, which also encompass new ways of dealing with strategic risks. The author identifies two different approaches in dealing with these recalibration processes and their outcomes, i.e. although confronted with the same external requirements, the analyzed financial institutions have chosen very different ways to cope with them.

Two articles add more detailed evidence of how recalibration best can be achieved . Cox and Soobiah ( 2018 ) analyze the different outcomes of cultural changes in UK banks initiated and managed either top down or bottom up. Based on qualitative data derived from 30 semi-structured interviews they conclude that approaches starting on the middle and grassroots level lead to better results than approaches from the organizational top. They argue that these findings are in sharp contrast to regulators’ recommendations. Liff and Wahlström ( 2018 ) observe different trajectories from how banks initially judge risk management to how their judgement develops over time dependent on their management control systems. Particularly, organizational structure and strategic alignment have an impact on the possibility to integrate risk management ideas into the overall organization.

5 Discussion

5.1 broadening the perspective on assessing risk culture.

In the following sections, we further elaborate on the identified findings and derive insights for business practice, research, education and regulators. In the present section we concentrate on the need for a broader perspective on assessing risk culture. Section  5.2 is dedicated to the discussion regarding the insights on the relations between risk culture and management controls. Section  5.3 elaborates on consequences drawn from the literature on the possibility to change risk culture and establishing the most appropriate risk culture. In Sect.  5.4 we integrate the major findings into a comprehensive model. To the best of our knowledge this is the first attempt to generate such a comprehensive perspective.

As discussed in Sect.  2 , effective management of risk culture requires an appropriate evaluation tool so that decision makers can determine whether the prevailing risk culture is adequate and in line with regulatory requirements. However, care must be taken not to fall into the unreflective use of number-based control systems criticized in the management control literature (e.g., Mikes, 2011 ; Power, 2009 ).

The identified literature provides three evaluation approaches, which constitute a starting point for such a management process. However, they are not yet the final solution for the following reasons. First, they are designed to be applied across a broad range of different institutes. Yet, due to its elusive character, the characteristics of risk culture in detail within an individual bank are very specific. Second, regulators do not require developing a particular risk culture, but only an adequate risk culture fitting to the particular business model. Finally, parts of risk management, as asked for in the scale by Sheedy et al. ( 2017 ) are also subject to regulatory requirements, i.e. here banks might not have any scope of action.

Banks need assessment tools that take into account the specifics of their business model and clearly differentiate between issues related to risk culture that are subject to clear regulatory requirements and aspects with more scope of action. Thus, the provided tools have to be tailored to the applying bank to better fit its peculiar needs. Moreover, in order to avoid the mentioned unreflective use, banks have to embed the application of such assessment systems into a broader process of regularly reviewing the current risk culture, setting targets to improve it and relating it to other management controls. This is similar to the design, implementation, monitoring, and embedding of performance measurement systems discussed in management control research in general (e.g., Chenhall, 2005 ; Chenhall et al., 2017 ; Kaplan & Norton, 1992 ). For example, a successful implementation of a Balanced Scorecard requires its development from within the company, the adaptation of the basic structure to the business model, e.g., through the introduction of further perspectives, and its embedding in an overall management process.

Additionally, to foster the possibility to assess risk culture, regulators have to strengthen their case regarding risk culture. On the one hand, regulators demand a targeted development of risk culture, but on the other hand, they emphasize its elusive character and the difficulties to evaluate and interpret it (e.g., FSB, 2014 ). This is of little help to foster banks’ understanding of what is expected from them when dealing with risk culture. Without such an understanding, the development of measurement tools is a difficult venture. This holds even more so, as different national supervisors seem to follow different conceptualizations of risk culture (Carretta et al., 2017 ). One way to clarify the prevailing concept of risk culture is the involvement of regulators in the process of designing instruments to measure risk culture. This involvement in turn fosters their understanding of practical problems when trying to assess and manage risk culture, which in turn can help to improve regulatory guidelines.

5.2 Embedding risk culture in a comprehensive set of management controls

Large parts of the identified literature indicate the importance of embedding risk culture into an overarching perspective regarding cultural controls. This perspective comprises aspects like ethical standards (Awrey et al., 2013 ; Fichter, 2018 ; Llewellyn, 2014 ; Minto, 2016 ), organizational norms regarding the handling of failures (Gendron et al., 2016 ) and the cultural context in terms of nationality (e.g., Ashraf et al., 2016 ; Kanagaretnam et al., 2014 ; Mihet, 2013 ). While regulators admit the importance of adequately handling failures and conforming to ethical standards in the context of risk culture (e.g., FSB, 2014 ), the impact of national culture so far does not play an important role in the debate. Yet, as it can exert an impact on the general perspective on risk taking, it also forms the ground for the development of norms regarding adequate risk handling. These norms, if not made explicit, can affect the concrete manifestation of a particular risk culture and mitigate the further development of this risk culture in an undetected manner. Consequently, the relation between banks’ risk culture and the cultural context, in which they are embedded, should be taken more into account by regulators.

Furthermore, articles related to cultural controls point both to different perspectives regarding an adequate risk culture across banks but also across departments within banks. For example, Mikes ( 2011 ) differentiates a culture of quantitative enthusiasm from a culture of quantitative skepticism , with different views on how to approach the management and the handling of risks adequately. Bruce ( 2014 ) points to the positive effect of different worldviews on risk handling within an organization, while Wahlström ( 2009 ) identifies potential for conflict, if such different views meet within one organization. These observations emphasize the importance of transparency between different perspectives on how risks are handled in order to develop a common risk culture appropriate to the business model. This underscores the importance of transparency and open communication culture required by prevailing regulations, which promote such disclosure (e.g., FSB, 2014 ).

So far, only few articles address the relation between action controls and risk culture. In line with regulation (e.g., FSB, 2014 ), several scholars stress accountability and adequate supervision as important (Cordery, 2007 ; Drennan, 2004 ; Drummond, 2002 ; Jackson, 2015 ). However, so far the question of how exactly accountability can be achieved and which measures to hold staff accountable for their risk behavior work best to bring an adequate risk culture into an organization is still unanswered. Roy ( 2008 ) investigates the impact of functional versus divisional hierarchy on risk taking and thereby points to organizational structure as an important means to support a certain risk culture. The author’s discussion provides a starting point for further investigations into this topic.

The area of remuneration is the most mature within the identified literature. Scholars provide a broad range of findings with respect to the impact of compensation schemes on risk taking. As discussed in Sect. 4.3.4 these findings are also related to risk culture, as incentive systems are an expression of the prevailing risk culture on the one hand and stabilize it on the other. Large parts of particularly empirical research are critical with respect to the application of variable, option and stock-based incentives for decision makers on the top-management level (e.g., Bhagat & Bolton, 2014 ; Chen et al., 2006 ; Minhat & Abdullah, 2016 ). Additionally, other compensation components, like severance contracts, are criticized (Brown et al., 2015 ). Thus, particularly empirical evidence is critical regarding short-term, variable incentives. However, empirical results are not unambiguous. Several scholars did not find detrimental effects of the mentioned components on risk taking or bank failure (e.g., Acrey et al., 2011 ; Iqbal & Vähämaa, 2019 ). Other findings indicate rather complex relations between compensation, risk taking and further factors (e.g., Cerasi & Oliviero, 2015 ). Especially, on the operational level, positive effects of variable incentives on certain tasks can also be observed (Cole et al., 2015 ). Irrespective of these individual results in detail, incentive systems have increasingly become the focus of regulation following the financial crisis and variable short-term incentives have come under criticism. This debate led to changes in regulation, like the implementation of the “Institutsvergütungsverordnung” in Germany (first version 2010), which provide detailed guidelines to set up feasible incentive systems. Accordingly, the area of results controls can be regarded as well researched and firmly established in the prevailing regulation.

In contrast, only a few scholars investigate the impact of core decision makers’ personal traits (as outcome of personnel controls) on banks’ risk culture. Findings indicate a detrimental effect of characteristics related to CEOs’ “self-preoccupation “, like narcissism and materialism (Bushman et al., 2018 ; Buyl et al., 2019 ) on risk taking. As outlined by the upper echelon theory (e.g., Hambrick, 2007 ), CEOs have the power to significantly shape organizations, and thus also determine organizational norms and values. Therefore, they also should exert a sustainable impact on banks’ risk culture. Accordingly, the identified observations in relation to risk taking also point to the development of a risk favoring culture. Regulators have understood these relations and mention the major impact that executives exert on the development of an adequate risk culture by stressing the “tone from the top”. However, while in other research areas the impact of particular CEO characteristics are well investigated, e.g. the impact of managerial overconfidence (e.g., Griffin & Varey, 1996 ; Hirshleifer et al., 2012 ), with regard to a deeper understanding of the relation between CEO characteristics and risk culture there are still large gaps. For example, further investigations regarding the impact of other traits, like overconfidence, machiavellianism or the big five, on risk culture and analyses of how these characteristics can sustainably shape risk culture promise valuable insights. Additionally, a link between this research stream and research on personality traits in the context of risk taking in general seems warranted. The mentioned research on managerial overconfidence (e.g., Griffin & Varey, 1996 ; Hirshleifer et al., 2012 ), but also on escalation of commitment (e.g., Sleesman et al., 2012 , 2018 ; Staw, 1976 , 1981 ; Staw & Fox, 1977 ) constitute two very promising candidates for such a link, as they provide rich evidence on impacts of personality traits in the context of risk taking in general.

5.3 Changing and establishing the most appropriate risk culture

Several scholars evaluate a risk culture characterized by collaboration, trust, solidarity, and a healthy critical distance to mathematical risk management approaches as more appropriate (e.g., Mikes, 2011 ; Minto, 2016 ; Nguyen et al., 2019 ; Power, 2009 ). Therefore, this literature argues for a shift in risk culture into this direction, irrespectively of the particular business model, as it mitigates excessive risk taking and unethical behavior, which in turn endangers the business model of any bank. In business practice, this recommendation can be seen as a call to question both the way risks are dealt with and the basic business conduct in order to develop an adequate risk culture embedded in an ethical background.

However, as indicated by the literature discussed in Sect. 4.4 changing risk culture depends on the configuration of the other management controls surrounding it. Particularly, the introduction of healthy skepticism regarding mathematical risk management approaches requires a fundamental change in an industry that is guided by mathematical models. Moreover, as illustrated by Gendron et al. ( 2016 ), prevailing risk management practices and thus also risk culture as such are stabilized by strong mechanisms, fostered by board members and consultancies, which inhibit a fundamental reflection on the appropriateness of the existing risk culture. Consequently, the required change is difficult to achieve with long-serving employees and business partners from the consulting industry. Yet, it can be enhanced by changes in educating future banks’ staff into the desired direction. Accordingly, recommendations made by regulators and the identified literature with regard to the vocational training of bank employees should be extended to junior employees and explicitly include teaching content at universities. Education in management control comprises both a number-driven management accounting-oriented perspective and a broader behavioral-oriented management control perspective (Gooneratne & Hoque, 2013 ). Insights gained from this multi-perspectivity also can help to enrich the education of future banks’ staff. Therefore, a closer link between management control and financial education should be sought.

Additionally, as stressed by the findings discussed in Sect.  4.2.2 , risk culture does not only vary across banks but also within banks, particularly Wahlström ( 2009 ) observes differences between operational staff and risk management staff, i.e. front and back office. Thus, in banks, different tasks are accompanied by a different view on risks. Bruce ( 2014 ) adds to this discussion that banks should incorporate different worldviews, as a pluralistic view strengthens risk management and risk culture, and Sinha and Arena ( 2018 ) show that different stakeholders also have various perspectives, which need integration. To accomplish this goal instruments are needed that can bridge the gap between these different views and that promote a common goal-setting process with regard to risk orientation. Management control research has put forth instruments that help to promote a common goal formation of differently socialized parties. Target Costing is a prominent example here, which brings together representatives from the fields of marketing, R&D, production, and management accounting and directs them towards a common goal. Similar instruments are needed to foster a common perspective on risk culture within a single bank.

Finally, as already previously mentioned, the identified literature indicates an impact of national culture on banks’ risk taking and risk culture. For example, Carretta et al. ( 2017 ) find that European supervisory regulators differ regarding their conceptualization of risk culture. However, evidence is ambiguous, i.e. especially individualism seems to either foster (Ashraf et al., 2016 ; Kanagaretnam et al., 2014 ) or attenuate risk taking (Illiashenko & Laidroo, 2020 ). Either way, national culture seems to exert an impact on the conceptualization of an adequate risk culture for a particular business model. This observation underscores the previous statement that banks must resort to individual concepts to establish a suitable risk culture, both in terms of assessment and in terms of the concrete design of the individual management controls to achieve it.

5.4 A comprehensive framework

To cease dysfunctional developments with respect to risk culture, scholars stress the importance of embedding risk culture in an overall fitting organizational context (e.g., Bott & Milkau, 2018 ; Gontarek, 2016 ; McConnell, 2013 ; Wood & Lewis, 2018 ). In order to achieve this goal, literature provides many instruments which can be categorized into one of the discussed management control categories, e.g. ethical standards as part of cultural controls, incentive systems as results controls, training, recruitment, leadership, and communication as personnel controls as well as organizational structure, accountability and supervision as action controls.

This discussion can be related to the frequent call for a more thorough understanding of the combination of different management controls (Bisbe & Otley, 2004 ; Cardinal et al., 2010 ; Grabner & Moers, 2013 ; Mundy, 2010 ). The identified literature allows drawing conclusions regarding the combined effect of such management controls in relation to risk culture and individual risk taking. To structure this discussion, we follow the categorization in cultural, action, results, and personnel controls (Merchant & Van der Stede, 2017 ). Moreover, we focus on the main trajectories drawn from the identified literature to elaborate on the most important dependency paths. The resulting model is depicted in Fig.  1 . The arrows indicate the assumed direction of influence.

Risk culture and management control systems

Within the discussed literature beside risk culture six factors are related to cultural controls : Professional norms (e.g., Cohn et al., 2017 ), national culture (e.g., Illiashenko & Laidroo, 2020 ; Kanagaretnam et al., 2014 ), market and regulatory demands (Lim et al., 2017 ), ethical standards (e.g. Awrey et al., 2013 ; Fichter, 2018 ), and organizational norms regarding the handling of failure (Gendron et al., 2016 ). Professional norms and market demands affect risk taking across all banks similarly, while national culture only exerts the same impact on all banks within a cultural area. Also, regulatory demands can differ, as national regulators have different conceptualizations of risk culture (Carretta et al., 2017 ). Either way, these factors are externally given. In contrast, banks develop their own norms regarding the handling of failure. Consequently, this aspect can be classified as an internal impact factor which constitutes one further element of cultural controls. Ethical standards comprise both, an external component shaped by the society and an internal component developed within an organization, i.e. partly they are also elements of cultural controls. These components affect the development of a common understanding about adequate and ethically acceptable risk taking, i.e. risk culture. This risk culture affects individual risk taking, i.e. decision makers’ decisions which influence the bank’s risk level. In turn, these individual decisions and their outcomes form a further basis to develop a common understanding of the risk-taking behavior that is accepted within the bank and thus in turn also affect risk culture as the manifestation of this common understanding, as e.g. indicated by Drennan ( 2004 ).

Moreover, based on the previous discussion we posit that risk culture exerts an effect on personnel controls. For example, literature discussing the failure of Barings Bank illustrates how the desired risk culture (high risk – high return) lead to the recruitment of extreme risk takers (Drennan, 2004 ), which in turn again affected risk culture through their individual decisions. In this context, scholars further discuss the following aspects: First, authors focus on individual characteristics particularly regarding CEOs (Bushman et al., 2018 ; Buyl et al., 2019 ; Ganon et al., 2017 ; Palvia et al., 2015 ). Second, literature analyzing case studies of banks’ failure and dysfunctional risk culture points to the importance of knowledge (e.g., Drummond, 2002 ; Holland, 2010 ). Both aspects are closely related to hiring and training. Third, the discussion of failing banks due to excessive risk-taking highlights the detrimental effects of dysfunctional communication structures (Dellaportas et al., 2007 ), which are related to leadership as another component of personnel controls. McConnell ( 2013 ) and Muñiz et al. ( 2020 ) also point to the importance of effective communication structures. While external factors exert an indirect effect on individual decisions, outcomes of personnel controls, like personality characteristics (related to hiring), knowledge (related to training) and communication structures (related to leadership) more directly affect individual behavior. Moreover, while external factors affecting cultural controls and thus the establishment of a particular risk culture are very stable and difficult to change, personnel controls, especially hiring and training, can provide the ground for a fundamental recalibration process, as they can be changed from within the bank in a more flexible way. Yet, as indicated by literature, in case of a lack of willingness to change, they also can exert a stabilizing effect on dysfunctional risk culture (e.g., Gendron et al., 2016 ). For this reason, when seeking to change risk culture, special attention should be paid to the personnel controls, as they can be directly influenced and at the same time have a direct influence on individual behavior, which in turn has a repercussion on risk culture.

As previously mentioned, a very broad literature exists that deals with the impact of various kinds of incentive systems, i.e. results controls . We assume that these incentive systems are an expression of the prevailing risk culture. However, in the course of a self-stabilizing processes, they determine individual risk taking, whose outcomes form the basis to develop a common understanding regarding reasonable risk handling and thus affect risk culture. Accordingly, also results controls not only are affected by risk culture but provide the input to shape risk culture.

Regarding action controls , within the discussed literature three factors can be identified: First, several scholars stress the importance of individual accountability to induce adequate risk taking (Cordery, 2007 ; Jackson, 2015 ), i.e. decision makers have to take responsibility for the outcomes of their decisions. If decision makers are accountable for their actions, they will think in more detail about their consequences and weigh up the appropriateness more thoroughly. Thus, accountability is a viable means to induce staff to act in accordance with the banks’ risk culture, while a lack of it undermines an alignment of employee behavior with it, i.e. risk culture affects individual risk taking through the implementation of accountability and accountability is an expression of a certain risk culture. Second, many authors in the context of dysfunctional risk culture and bank failure highlight the lack of clear supervision as antecedent of these failures (e.g., Cordery, 2007 ; Drennan, 2004 ; Drummond, 2002 ). Accordingly, like accountability or incentive systems, supervision directs employees’ attention towards a risk-taking behavior which is in accordance with the bank’s risk culture. Thus, risk culture can influence risk taking through the prevailing supervision processes. Third, Roy ( 2008 ) discusses how organizational structure can affect the application of relevant information in daily risk-taking decisions and thereby points to a possible relation between structure, risk taking and risk culture. However, while supervision and accountability with a focus on risk taking are an expression of the prevailing risk culture, organizational structure serves many purposes. Therefore, it is not reasonable to assume a direct effect of risk culture on the selection of the overall organizational structure. We rather posit an effect of structure on individual risk taking, as discussed by Roy ( 2008 ), which in turn then can, as outlined for the other aspects, influence risk culture.

This comprehensive overview of the in the identified literature most cited issues related to management control systems illustrates the complex relations between various components and the self-stabilizing effects within this system of effects. In order to effectively develop an adequate risk culture, banks have to elaborate on all components simultaneously, regulators have to become aware of their and the markets’ impact on risk culture and all parties have to understand detrimental effects of professional norms. Finally, so far, literature lacks deep insights regarding the exact relations between the identified components, i.e. which components exert which exact impact. Large parts of the findings are gained through single case studies, which do not allow for drawing causal conclusions. Therefore, more research is needed that elaborates on these causal relations.

6 Conclusion

The present paper provides the results of a systematic literature review focusing on risk culture in banks and their relation to management control systems. The identified articles were structured along three categories, i.e. assessment of risk culture , relation between risk culture and management controls (with the subcategories embeddedness of risk culture in overall management control packages, risk culture and cultural controls, risk culture and action controls, risk culture and results controls, as well as risk culture and personnel controls) and development of banks’ risk culture over time . Based on the discussion of insights gained along these categories, we finally derived a comprehensive framework that illustrates the embeddedness of banks’ risk culture within a broader set of further management controls and several external factors.

Thereby, we provide a broad overview about extant literature related to banks’ risk culture. However, it also suffers from several limitations. First, we focus on research published in peer reviewed journals in English. Consequently, we abstract from research output that is provided in other languages and in other outlets. We decided to apply these selection criteria on the one hand to keep the discussed literature within a manageable range. On the other hand, we focus on this literature, as it can be perceived internationally and thus should have the strongest impact on further research. Nevertheless, an investigation of country-specific debates or publications that are oriented towards practitioners would provide additional valuable insights. Second, risk culture is a soft, partly vague phenomenon with unclear boundaries. Therefore, it is difficult to define clear selection criteria for the relevant literature. For instance, research of overconfidence or escalation of commitment provides valuable insights into psychological and structural determinants of decisions in risky contexts. Thus, also these fields of research – as only two examples of a broad range of literature – deserve further attention in order to understand the relation between individual and structural antecedents of risk culture. Similarly, the particular elements of management control systems are difficult to delimit, i.e. there is no clear-cut decision criterion definable that states which elements in the management process are part of a management control system and which are not. This might result in a somewhat arbitrary selection of papers which do not focus explicitly on management control systems. Third, the selection process as such contains choices which results in a limited perspective on the literature, i.e. the chosen databases.

However, despite these limitations, the present literature overview provides a broad perspective on extant research related to risk culture in banks. It summarizes and interprets this literature, synthesizes its findings, shows relations between risk culture and management controls and highlights promising paths for future research.

Acrey, J. C., McCumber, W. R., & Nguyen, T. H. T. (2011). CEO incentives and bank risk. Journal of Economics and Business, 63 (5), 456–471.

Google Scholar  

Almandoz, J. (2014). Founding teams as carriers of competing logics: When institutional forces predict banks’ risk exposure. Administrative Science Quarterly, 59 (3), 442–473.

Anthony, R. N. (1965). Planning and control systems: A framework for analysis . Harvard University.

Ashraf, B. N., Zheng, C., & Arshad, S. (2016). Effects of national culture on bank risk-taking behavior. Research in International Business and Finance, 37 , 309–326.

Australian Prudential Regulation Authority (APRA) (2016). Risk culture. Information paper.

Awrey, D., Blair, W., & Kershaw, D. (2013). Between law and markets: Is there a role for culture and ethics in financial regulation. Delaware Journal Corporate Law, 38 , 191.

Balstad, M. T., & Berg, T. (2019). A long-term bibliometric analysis of journals influencing management accounting and control research. Journal of Management Control , 1–24.

Bannier, C. E., Feess, E., & Packham, N. (2013). Competition, bonuses, and risk-taking in the banking industry. Review of Finance, 17 (2), 653–690.

Barry, T. A., Lepetit, L., & Tarazi, A. (2011). Ownership structure and risk in publicly held and privately owned banks. Journal of Banking & Finance, 35 (5), 1327–1340.

Barry, T. A., Tarazi, A., & Wachtel, P. (2019). Falling under the control of a different type of owner: Risk-taking implications for Banks. Applied Economics, 51 (8), 831–847.

Basel Committee for Banking Supervision [BCBS] (2015). Corporate governance principles for banks. Bank for International Settlement. http://www.bis.org/bcbs/publ/d328.htm . Accessed 17 August 2018.

Bebchuk, L. A., Cohen, A., & Spamann, H. (2010). The wages of failure: Executive compensation at Bear Stearns and Lehman 2000–2008. Yale Journal on Regulation, 27 , 257.

Bedford, D. S., & Malmi, T. (2015). Configurations of control: An exploratory analysis. Management Accounting Research, 27 , 2–26.

Berger, A. N., Imbierowicz, B., & Rauch, C. (2016). The roles of corporate governance in bank failures during the recent financial crisis. Journal of Money, Credit and Banking, 48 (4), 729–770.

Berry, A. J., Broadbent, J., & Otley, D. (1995). Approaches to control in the organizational literature. In: Berry, A. J., Broadbent, J., & Otley, D. (eds.). Management Control - Theories, Issues and Practices , Chapter 2, 17–26.

Bhagat, S., & Bolton, B. (2014). Financial crisis and bank executive incentive compensation. Journal of Corporate Finance, 25 , 313–341.

Bhagat, S., Bolton, B., & Romano, R. (2014). Getting incentives right: Is deferred bank executive compensation sufficient? Yale Journal on Regulation, 31 , 523.

Bisbe, J., & Otley, D. (2004). The effects of the interactive use of management control systems on product innovation. Accounting, Organizations and Society, 29 (8), 709–737.

Bolton, P., Mehran, H., & Shapiro, J. (2015). Executive compensation and risk taking. Review of Finance, 19 (6), 2139–2181.

Bonner, S. E., Hesford, J. W., Van der Stede, W. A., & Young, S. M. (2006). The most influential journals in academic accounting. Accounting, Organizations and Society, 31 (7), 663–685.

Bott, J., & Milkau, U. (2018). Risk culture and the role model of the honorable merchant. Journal of Risk and Financial Management, 11 (40), 1–11.

Brown, K., Jha, R., & Pacharn, P. (2015). Ex ante CEO severance pay and risk-taking in the financial services sector. Journal of Banking & Finance, 59 , 111–126.

Bruce, J. R. (2014). Risky business: How social psychology can help improve corporate risk management. Business Horizons, 57 (4), 551–557.

Bushman, R. M., Davidson, R. H., Dey, A., & Smith, A. (2018). Bank CEO materialism: Risk controls, culture and tail risk. Journal of Accounting and Economics, 65 (1), 191–220.

Buyl, T., Boone, C., & Wade, J. B. (2019). CEO narcissism, risk-taking, and resilience: An empirical analysis in US commercial banks. Journal of Management, 45 (4), 1372–1400.

Cardinal, L. B., Sitkin, S. B., & Long, C. P. (2010). A configurational theory of control. In S. B. Sitkin, L. B. Cardinal, & K. M. Bijlsma-Frankema (Eds.), Organizational control (pp. 51–79). Cambridge University Press.

Carretta, A., Farina, V., & Schwizer, P. (2017). Risk culture and banking supervision. Journal of Financial Regulation and Compliance, 25 (2), 209–226.

Cerasi, V., & Oliviero, T. (2015). CEO compensation, regulation, and risk in banks: Theory and evidence from the financial crisis. International Journal of Central Banking, 11 (3), 241–297.

Chen, C. R., Steiner, T. L., & Whyte, A. M. (2006). Does stock option-based executive compensation induce risk-taking? An analysis of the banking industry. Journal of Banking & Finance, 30 (3), 915–945.

Cheng, I.-H., & HongScheinkman, H. J. A. (2015). Yesterday´s heroes: Compensation and risk at financial firms. The Journal of Finance, 70 (2), 839–879.

Chenhall, R. H. (2003). Management control system design within its organizational context: Findings from contingency-based research and directions for the future. Accounting, Organizations and Society, 28 (2–3), 127–168.

Chenhall, R. H. (2005). Integrative strategic performance measurement systems, strategic alignment of manufacturing, learning and strategic outcomes: An exploratory study. Accounting, Organizations and Society, 30 (5), 395–422.

Chenhall, R. H., Hall, M., & Smith, D. (2017). The expressive role of performance measurement systems: A field study of a mental health development project. Accounting, Organizations and Society, 63 , 60–75.

Cohen, M. S. (2015). Governance as the driver of culture change and risk management. Journal of Risk Management in Financial Institutions, 8 (4), 347–357.

Cohn, A., Fehr, E., & Maréchal, M. A. (2014). Business culture and dishonesty in the banking industry. Nature, 516 , 86–89.

Cohn, A., Fehr, E., & Maréchal, M. A. (2017). Do professional norms in the banking industry favor risk-taking? The Review of Financial Studies, 30 (11), 3801–3823.

Cole, S., Kanz, M., & Klapper, L. (2015). Incentivizing calculated risk-taking: Evidence from an experiment with commercial bank loan officers. Journal of Finance, 70 (2), 537–575.

Cordery, C. (2007). NAB´s ‘Annus Horribilis’: Fraud and corporate governance. Australian Accounting Review, 17 (2), 62–70.

Cox, P., & Soobiah, D. (2018). An empirical investigation into the corporate culture of UK listed banks. Journal of Financial Regulation and Compliance, 26 (1), 120–134.

Dellaportas, S., Cooper, B. J., & Braica, P. (2007). Leadership, culture and employee deceit: The case of the National Australia Bank. Corporate Governance: An International Review, 15 (6), 1442–1452.

Drennan, L. T. (2004). Ethics, governance and risk management: Lessons from Mirror Group Newspapers and Barings Bank. Journal of Business Ethics, 52 , 257–266.

Drummond, H. (2002). Living in a fool´s paradise: The collapse of Barings Bank. Management Decision, 40 (3), 232–238.

Eastburn, R. W., & Sharland, A. (2017). Risk management and managerial mindset. The Journal of Risk Finance, 18 (1), 21–47.

European Banking Autority [EBA] (2017). Final Report: Guidelines on internal governance under directive 2013/36/ EU. https://www.eba.europa.eu/documents/10180/1972987/Final+Guidelines+on+Internal+Governance+%28EBA-GL-2017-11%29.pdf . Accessed 24 April 2018.

Fahlenbrach, R., & Stulz, R. M. (2011). Bank CEO incentives and the credit crisis. Journal of Financial Economics, 99 (1), 11–26.

Fichter, R. (2018). Do the right thing! Developing ethical behavior in financial institutions. Journal of Business Ethics, 151 (1), 69–84.

Financial Stability Board [FSB] (2014). Guidance on supervisory interaction with financial institutions on risk culture. A Framework for Assessing Risk Culture. http://www.fsb.org/2014/04/140407/ . Accessed 26 April 2018.

Fortin, R., Goldberg, G. M., & Roth, G. (2010). Bank risk taking at the onset of the current banking crisis. Financial Review, 45 (4), 891–913.

Fritz-Morgenthal, S., Hellmuth, J., & Packham, N. (2016). Does risk culture matter? The relationship between risk culture indicators and stress test results. Journal of Risk Management in Financial Institutions, 9 (1), 71–84.

Furlong, W., Crossan, M., Gandz, J., & Crossan, L. (2017). Character’s essential role in addressing misconduct in financial institutions. Business Law International, 18 (3), 199–223.

Galbraith, J. R. (1973). Designing complex organizations . Addison Wesley.

Gande, A., & Kalpathy, S. (2017). CEO compensation and risk-taking at financial firms: Evidence from U.S. federal loan assistance. Journal of Corporate Finance, 47 , 131–150.

Ganon, M. W., Donegan, J., & Rotondo, G. (2017). Embedding values in corporate culture: Applying Schein´s organizational theory to Lehman Brothers. International Journal of Business & Applied Sciences, 6 (1), 20–33.

García-Romero, A., Santín, D., & Sicilia, G. (2016). Another brick in the wall: A new ranking of academic journals in Economics using FDH. Scientometrics, 107 (1), 91–101.

Gendron, Y., Brivot, M., & Guénin-Paracini, H. (2016). The construction of risk management credibility within corporate boardrooms. European Accounting Review, 25 (3), 549–578.

Gontarek, W. (2016). Risk governance of financial institutions: The growing importance of risk appetite and culture. Journal of Risk Management in Financial Institutions, 9 (2), 120–129.

Gooneratne, T. N., & Hoque, Z. (2013). Management control research in the banking sector: A critical review and directions for future research. Qualitative Research in Accounting & Management, 10 (2), 144–171.

Grabner, I., & Moers, F. (2013). Management control as a system or a package? Conceptual and empirical issues. Accounting, Organizations and Society, 38 (6–7), 407–419.

Griffin, D., & Varey, C. A. (1996). Towards a consensus on overconfidence. Organizational Behavior and Human Decision Processes, 65 (3), 227–231.

Guo, L., Jalal, A., & Khaksari, S. (2015). Bank executive compensation structure, risk taking and the financial crisis. Review of Quantitative Finance and Accounting, 45 (3), 609–639.

Hagendorff, J., & Vallascas, F. (2011). CEO pay incentives and risk-taking: Evidence from bank acquisitions. Journal of Corporate Finance, 17 (4), 1078–1095.

Hambrick, D. C. (2007). Upper Echelons Theory: An update. The Academy of Management Review, 32 (2), 334–343.

Handorf, W. C. (2015). Bank risk management, regulation and CEO compensation after the Panic of 2008. Journal of Banking Regulation, 16 (1), 39–50.

Harzing, A. W. (2018). Journal quality list. https://harzing.com/resources/journal-quality-list . Accessed 24 January 2018.

Hashagen, J., Harman, N., Conover, M., & Sharma, J. (2009). Risk management in banking: Beyond the credit crisis. The Journal of Structured Finance, 15 (1), 92–103.

Hirshleifer, D., Low, A., & Teoh, S. H. (2012). Are overconfident CEOs better innovators? The Journal of Finance, 67 (4), 1457–1498.

Holland, J. (2010). Banks, knowledge and crisis: A case of knowledge and learning failure. Journal of Financial Regulation and Compliance, 18 (2), 87–105.

Holland, J. (2019). Bank top management teams, disclosure, learning, survival and failure – 1990–2017. Qualitative Research in Financial Markets, 11 (1), 31–59.

Houston, J. F., & James, C. (1995). CEO compensation and bank risk: Is compensation in banking structured to promote risk taking? Journal of Monetary Economics, 36 (2), 405–431.

Iannotta, G., Nocera, G., & Sironi, A. (2007). Ownership structure, risk and performance in the European banking industry. Journal of Banking & Finance, 31 (7), 2127–2149.

Illiashenko, P., & Laidroo, L. (2020). National culture and bank risk-taking: Contradictory case of individualism. Research in International Business and Finance . https://doi.org/10.1016/j.ribaf.2019.101069

Article   Google Scholar  

Institute of International Finance [IIF] (2009). Reform in the financial services industry: Strengthening practices for a more stable system: The report of the IIF steering committee on implementation.

Institute of Risk Management [IRM] (2012). Risk culture. Under the microscope. Guidance for boards.

Iqbal, J., & Vähämaa, S. (2019). Managerial risk-taking incentives and the systemic risk of financial institutions. Review of Quantitative Finance and Accounting, 53 (4), 1229–1258.

Jackson, P. (2015). Understanding risk culture and its challenges. Banking Perspective, 2 , 48–54.

John, K., Saunders, A., & Senbet, L. W. (2000). A theory of bank regulation and management compensation. The Review of Financial Studies, 13 (1), 95–125.

Kanagaretnam, K., Lim, C. Y., & Lobo, G. J. (2014). Influence of national culture on accounting conservatism and risk-taking in the banking industry. The Accounting Review, 89 (3), 1115–1149.

Kanagaretnam, K., Lobo, G. J., Wang, C., & Whalen, D. J. (2019). Cross-country evidence on the relationship between societal trust and risk-taking by banks. Journal of Financial and Quantitative Analysis , 3 , 54 (1), 275–301.

Kane, E. J. (2016). A theory of how and why Central-Bank culture supports predatory risk-taking at megabanks. Atlantic Economic Journal, 44 (1), 51–71.

Kaplan, R. S., & Norton, D. P. (1992). The balanced scorecard – Measures that drive performance. Harvard Business Review, 70 (1), 71–79.

Kolm, J., Laux, C., & Lóránth, G. (2016). Bank regulation, CEO compensation, and boards. Review of Finance, 21 (5), 1901–1932.

Kwan, S. H. (2004). Risk and return of publicly held versus privately owned banks. Economic Policy Review, 10 (2), 97–107.

LaBriola, J. (2019). Risky Business: Institutional logics and risk taking at large U.S. commercial banks. Social Science Quarterly , 100 (1), 389–404.

Lawrence, P. R., & Lorsch, J. W. (1967). Organization and environment . Harvard University.

Liff, R., & Wahlström, G. (2018). Usefulness of enterprise risk management in two banks. Quantitative Research in Accounting & Management, 15 (1), 124–150.

Lim, C. Y., Woods, M., Humphrey, C., & Seow, J. L. (2017). The paradoxes of risk management in the banking sector. The British Accounting Review, 49 (1), 75–90.

Llewellyn, D. T. (2014). Reforming the culture of banking: Restoring trust and confidence in banking. Journal of Financial Management, Markets and Institutions, 2 (2), 221–235.

Lo, A. W. (2016). The Gordon Gekko Effect: The role of culture in the financial industry. Economic Policy Review, 22 (1), 17–42.

Lui, A. (2015). Greed, recklessness and/or dishonesty? An investigation into the culture of five UK banks between 2004 and 2009. Journal of Banking Regulation, 16 (2), 106–129.

Malmi, T., & Brown, D. A. (2008). Management control systems as a package – Opportunities, challenges and research directions. Management Accounting Research, 19 (4), 287–300.

McConnell, P. J. (2013). A risk culture framework for systemically important banks. Journal of Risk and Governance, 3 (1), 24–68.

McConnell, P. J. (2014). Strategic risk management – A tale of two strategies. Journal of Risk and Governance, 3 (2), 1–11.

Merchant, K. A., & Van der Stede, W. A. (2017). Management control systems: Performance measurement, evaluation and incentives . (4th), FT Prentice Hall, Harlow.

Mihet, R. (2013). Effects of culture on firm risk-taking: A cross-country and cross-industry analysis. Journal of Cultural Economics, 37 (1), 109–151.

Mikes, A. (2009). Risk management and calculative cultures. Management Accounting Research, 20 (1), 18–40.

Mikes, A. (2011). From counting risk to making risk count: Boundary-work in risk management. Accounting, Organizations and Society, 36 (4–5), 226–245.

Minhat, M., & Abdullah, M. (2016). Bankers’ stock options, risk-taking and the financial crisis. Journal of Financial Stability, 22 , 121–128.

Minto, A. (2016). The spirit of the law over its letter: The role of culture and social norms in shielding cooperative banks from systemic shocks. Law and Financial Markets Review, 10 (1), 16–26.

Mongiardino, A., & Plath, C. (2010). Risk governance at large banks: Have any lessons been learned? Journal of Risk Management in Financial Institutions, 3 (2), 116–123.

Mourouzidou-Damtsa, S., Milidonis, A., & Stathopoulos, K. (2019). National culture and bank risk-taking. Journal of Financial Stability, 40 , 132–143.

Mundy, J. (2010). Creating dynamic tensions through a balanced use of management control systems. Accounting, Organizations and Society, 35 (5), 499–523.

Muñiz, B. F., Montes Peón, J. M., & Vázquez Ordás, C. J. (2020). Misconduct and risk climate in banking: Development of a multidimensional measurement scale. Global Policy, 11 (1), 73–83.

Nguyen, D. D., Nguyen, L., & Sila, V. (2019). Does corporate culture affect bank risk-taking? Evidence from loan-level data. British Journal of Management, 30 , 106–133.

Palermo, T., Power, M., & Ashby, S. (2017). Navigating institutional complexity: The production of risk culture in the financial sector. Journal of Management Studies, 54 (2), 154–181.

Palvia, A., Vähämaa, E., & Vähämaa, S. (2015). Are female CEOs and chairwomen more conservative and risk averse? Evidence from the banking industry during the financial crisis. Journal of Business Ethics, 131 (3), 577–594.

Pan, Y., Siegel, S., & Wang, T. Y. (2017). Corporate risk culture. Journal of Financial and Quantitative Analysis, 52 (6), 2327–2367.

Perrow, C. B. (1970). Organizational analysis: A sociological view . Tavistock.

Power, M. (2009). The risk management of nothing. Accounting, Organizations and Society, 34 (6–7), 849–855.

Power, M., Ashby, S., & Palermo, T. (2013). Risk culture in financial organisations: CARR-analysis of risk and regulation. A research report. London School of Economics, London.

Quinn, R. E., & Rohrbaugh, J. (1983). A spatial model of effectiveness criteria: Towards a competing values approach to organizational analysis. Management Science, 29 (3), 363–377.

Rad, A. (2016). Risk management-control system interplay: Case studies of two banks. Journal of Accounting & Organizational Change, 12 (4), 522–546.

Rattaggi, M. L. (2017). Regulatory reform in banking 10 years after the financial crisis. Journal of Risk Management in Financial Institutions, 10 (3), 296–302.

Ritzberger, K. (2008). A ranking of journals in economics and related fields. German Economic Review, 9 (4), 402–430.

Roy, A. (2008). Organization structure and risk taking in banking. Risk Management, 10 (2), 122–134.

Saunders, A., Strock, E., & Travlos, N. G. (1990). Ownership structure, deregulation, and bank risk taking. The Journal of Finance, 45 (2), 643–654.

Schäffer, U., Nevries, P., Fikus, C., & Meyer, M. (2011). Is finance research a “normal science”? A bibliometric study of the structure and development of finance research from 1988 to 2007. Schmalenbach Business Review, 63 (2), 189–225.

Schein, E. H. (1990). Organizational culture. American Psychologist, 45 (2), 109–119.

Schein, E. H. (2010). Organizational culture and leadership . Jossey-Bass.

Schnatterly, K., Clark, B. B., Howe, J., & DeVaughn, M. L. (2019). Regulatory and governance impacts on bank risk-taking. Risk Management, 21 (2), 99–122.

Schneider, B., Ehrhart, M. G., & Macey, W. H. (2013). Organizational climate and culture. Annual Review of Psychology, 64 , 361–388.

Sheedy, E. (2016). Risk culture in Australian banks: Does size matter? JASSA, 4 , 4–10.

Sheedy, E., & Griffin, B. (2018). Risk governance, structures, culture, and behavior: A view from the inside. Corporate Governance: An International Review, 26 (1), 4–22.

Sheedy, E. A., Griffin, B., & Barbour, J. P. (2017). A framework and measure for examining risk climate in financial institutions. Journal of Business and Psychology, 32 (1), 101–116.

Sheedy, E., Zhang, L., & Tam, K. C. H. (2019). Incentives and culture in risk compliance. Journal of Banking & Finance . https://doi.org/10.1016/j.jbankfin.2019.105611

Sinha, V. K., & Arena, M. (2018). Manifold conceptions of the internal auditing of risk culture in the financial sector. Journal of Business Ethics , 1–22.

Sleesman, D. J., Conlon, D. E., McNamara, G., & Miles, J. E. (2012). Cleaning up the big muddy: A meta-analytic review of the determinants of escalation of commitment. Academy of Management Journal, 55 (3), 541–562.

Sleesman, D. J., Lennard, A. C., McNamara, G., & Conlon, D. E. (2018). Putting escalation of commitment in a context: A multilevel review and analysis. Academy of Management Annals, 12 (1), 178–207.

Srivastav, A., & Hagendorff, J. (2016). Corporate governance and bank risk-taking. Corporate Governance: An International Review, 24 (3), 334–345.

Staw, B. M. (1976). Knee-deep in the big muddy: A study of escalating commitment to a chosen course of action. Organizational Behavior and Human Performance, 16 (1), 27–44.

Staw, B. M. (1981). The escalation of commitment to a course of action. Academy of Management Review, 6 (4), 577–587.

Staw, B. M., & Fox, F. V. (1977). Escalation: The determinants of commitment to a chosen course of action. Human Relations, 30 (5), 431–450.

Stein, M. (2000). The risk taker as shadow: A psychoanalytic view of the collapse of Barings Bank. Journal of Management Studies, 37 (8), 1215–1229.

Stonham, P. (1996a). Whatever happened at Barings? Part one: The lure of derivatives and collapse. European Management Journal, 14 (2), 167–175.

Stonham, P. (1996b). Whatever happened at Barings? Part two: Unauthorised trading and the failure of controls. European Management Journal, 14 (3), 269–278.

Stulz, R. M. (2008). Risk management failures: What are they and when do they happen? Journal of Applied Corporate Finance, 20 (4), 39–48.

Stulz, R. M. (2015). Risk-taking and risk management by banks. Journal of Applied Corporate Finance, 27 (1), 8–18.

Stulz, R. M. (2016). Risk management, governance, culture, and risk taking in banks. Economic Policy Review, 22 (1), 43–59.

Sullivan, R. J., & Spong, K. R. (2007). Manager wealth concentration, ownership structure, and risk in commercial banks. Journal of Financial Intermediation, 16 (2), 229–248.

Thakor, A. (2016). Corporate culture in banking. Economic Policy Review, 22 (1), 5–16.

Thanassoulis, J. (2012). The case for intervening in bankers’ pay. The Journal of Finance, 67 (3), 849–895.

Thompson, J. D. (1967). Organizations in action: Social science bases of administrative theory . McGraw-Hill.

Tranfield, D., Denyer, D., & Smart, P. (2003). Towards a methodology for developing evidence-informed management knowledge by means of systematic review. British Journal of Management, 14 (3), 207–222.

Wahlström, G. (2009). Risk management versus operational action: Basel II in a Swedish context. Management Accounting Research, 20 (1), 53–68.

Walter, S., & Narring, F. (2020). How can supervisors and banks promote a culture of strong governance and ethical behavior? Journal of Risk Management in Financial Institutions, 13 (2), 145–154.

Webster, J., & Watson, R. T. (2002). Analysing the past to prepare for the future: Writing a literature review. MIS Quarterly 26 (2), xiii-xxiii.

Wood, A., & Lewis, A. (2018). Risk culture development and its impact: The case of the Caribbean Development Bank. International Journal of Business and Economic Development, 6 (1), 18–37.

Young, B. (2011). Leadership and high-reliability organizations: Why banks fail. The Journal of Operational Risk, 6 (4), 67–87.

Yusuf, I. A., Amadi, A. N., & Salaudeen, M. B. (2020). Effects of risk culture and appetite on effective risk management in Nigerian banks: Case study of United Bank for Africa Plc. Academic Journal of Economic Studies, 6 (2), 81–87.

Zalewska, A. (2016). A new look at regulating bankers’ remuneration. Corporate Governance: An International Review, 24 (3), 322–333.

Download references

Acknowledgements

We thank Stefan Linder and two reviewers for their very constructive comments over several revision rounds, Mark Frost for his professional linguistic proofreading and our research fellow Christopher Gutting for his help particularly in the first search phase.

Open Access funding enabled and organized by Projekt DEAL. This research did not receive any specific grant from funding agencies in the public, commercial, or not-for-profit sectors.

Author information

Authors and affiliations.

Chair for Controlling, Augsburg University, Universitätsstraße 16, 86159, Augsburg, Germany

Jennifer Kunz & Mathias Heitz

You can also search for this author in PubMed   Google Scholar

Corresponding author

Correspondence to Jennifer Kunz .

Additional information

Publisher's note.

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Rights and permissions

Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article's Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article's Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/ .

Reprints and permissions

About this article

Kunz, J., Heitz, M. Banks’ risk culture and management control systems: A systematic literature review. J Manag Control 32 , 439–493 (2021). https://doi.org/10.1007/s00187-021-00325-4

Download citation

Accepted : 12 July 2021

Published : 13 August 2021

Issue Date : December 2021

DOI : https://doi.org/10.1007/s00187-021-00325-4

Share this article

Anyone you share the following link with will be able to read this content:

Sorry, a shareable link is not currently available for this article.

Provided by the Springer Nature SharedIt content-sharing initiative

• Management control systems
• Risk culture
• Risk climate
• Systematic literature review

JEL Classification

• Find a journal
• Publish with us
• Track your research

To read this content please select one of the options below:

Please note you do not have access to teaching notes, cognitive risk culture and advanced roles of actors in risk governance: a case study.

Journal of Risk Finance

ISSN : 1526-5943

Article publication date: 20 August 2018

The purpose of this study is to explore the best practices for improving risk culture and defining the role of actors in risk governance.

Design/methodology/approach

This paper presents an exemplar case of a British insurance company by using a qualitative case research approach.

The case study shows how the company was successful in changing from a compliance-based and defensive risk culture to a cognitive risk culture by using a systems thinking approach. Cognitive risk culture ensures that everybody understands risks and their own roles in risk governance. The change was accomplished by adding an operational layer between the first and second lines of defense and developing tools to better communicate risks throughout the organization.

Practical implications

Practitioners can potentially improve risk governance by using the company’s approach. The UK regulator’s initiative to improve risk culture can potentially be followed by other regulators.

Originality/value

This is among the few studies that describe actual examples of how a company can improve risk culture using the systems approach and how systems thinking simultaneously resolves several other issues such as poor risk reporting and lack of clarity in roles and responsibilities.

• Corporate governance
• Enterprise risk management
• Risk reporting
• System theory
• Three lines of Defense model

Agarwal, R. and Kallapur, S. (2018), "Cognitive risk culture and advanced roles of actors in risk governance: a case study", Journal of Risk Finance , Vol. 19 No. 4, pp. 327-342. https://doi.org/10.1108/JRF-11-2017-0189

Emerald Publishing Limited

Copyright © 2018, Emerald Publishing Limited

Related articles

We’re listening — tell us what you think, something didn’t work….

Report bugs here

All feedback is valuable

Please share your general feedback

Join us on our journey

Platform update page.

Visit emeraldpublishing.com/platformupdate to discover the latest news and updates

Questions & More Information

Answers to the most commonly asked questions here

ConnectedGRC

Drive a Connected GRC Program for Improved Agility, Performance, and Resilience

BusinessGRC

Power Business Performance and Resilience

• Enterprise Risk
• Operational Risk
• Operational Resilience
• Business Continuity
• Observation
• Regulatory Change
• Regulatory Engagement
• Case and Incident
• Compliance Advisory
• Internal Audit
• SOX Compliance
• Third-Party Risk

Manage IT and Cyber Risk Proactively

• IT & Cyber Risk
• IT & Cyber Compliance
• IT & Cyber Policy
• IT Vendor Risk

Enable Growth with Purpose

AI-based Knowledge Centric GRC

• Integration
• Marketplace
• Developer Portal

Latest Release

Explore the right questions to ask before buying a Cyber Governance, Risk & Compliance solution.

Discover ConnectedGRC Solutions for Enterprise and Operational Resilience

• Enterprise GRC
• Integrated Risk Management
• CyberSecurity
• Corporate Compliance
• Supplier Risk and Performance
• Digital Risk
• IT and Security Compliance, Policy and Risk
• UK SOX Compliance
• Privacy Compliance
• IDW PS 340 n.F.
• Banking and Financial Services
• Life Sciences

Learn about the EU’s Digital Operational Resilience Act (DORA) and how you can prepare for it.

Explore What Makes MetricStream the Right Choice for Our Customers

Customer Stories

• GRC Journey
• Training & Certification
• Compliance Online

Robert Taylor from LSEG shares his experience on implementing an integrated GRC program with MetricStream

Discover How Our Collaborative Partnerships Drive Innovation and Success

• Our Partners
• Want to become a Partner?

Watch Lucia Roncakova from Deloitte Central Europe, speak on how the partnership with MetricStream provides collaborative GRC solutions

Find Everything You Need to Build Your GRC Journey and Thrive on Risk

Featured Resources

• Analyst Reports
• Case Studies
• Infographics
• Product Overviews
• Solution Briefs
• Whitepapers

Download this report to explore why cyber risk is rising in significance as a business risk.

Learn about our mission, vision, and core values

Gurjeev Sanghera from Shell explains why they chose MetricStream to advance on the GRC journey

Looking to Build a Strong Risk-Aware Culture? Equip and Empower the Front Line to Own Risk

• Risk Management
• 16 September 21
• Sumith Sagar

Introduction

“Culture eats strategy for breakfast.” The popular phrase attributed to celebrated management guru Peter Drucker holds true not just for organizational culture but for risk culture as well. Drucker was not dismissing the importance of strategy, but rather emphasizing the role of culture in executing strategy. Similarly, a strong risk-aware culture plays an equally crucial role in effective risk management.

An effective risk-aware culture—determined by the awareness, attitudes, and behaviors of individuals and groups inside an organization—supports an organization’s risk strategy and risk management approach. It works to strengthen the core of an organization’s operations. This includes compliance with regulatory and statutory requirements, financial performance, and reputation in the market. Furthermore, building a strong risk-aware culture equips organizations to drive strategy. Whether it is entering a new market, negotiating mergers and acquisitions or investing in organic growth, companies are empowered to make take the right decisions.

Organizations are now ranking risk culture as one of their top ERM priorities. As per Deloitte’s recent Global Risk Management Survey , more than half (55%) of financial institutions are actively building a risk culture across the enterprise. The ongoing pandemic, as discussed in our earlier blog , has further added a sense of urgency in establishing and embedding a strong risk-aware culture.

Engaging the Front Line in your Risk Management to Implement a Positive Risk Culture

Faced with the complex challenges in today’s business risk environment, organizations across the globe have moved from a position of protective and reactive risk management to a proactive and strategic stance. They are increasingly acknowledging the risk accountability role played by the front line in developing an integrated and agile approach to risk management. They understand that risk management must be owned and led by the entire business—making it imperative for a strong risk awareness to be embedded in the front lines.

The nurse at the hospital, the teller at the bank, and the customer services executive at the telecom retail outlet all constitute frontline workers. They make up of individuals whose job roles involve engaging with external stakeholders, customers, and partners. Being the first to hold these interactions, they hold the unique position of being valuable sources of risk-related information for the company. However, unless there is a deeply embedded risk culture, they may not even be aware that they hold critical intelligence as they go about their daily operations. It is hence important to involve and empower your front line as they make key risk and compliance decisions every day protecting from or exposing your organization to various risks.

For example, a single suspicious transaction report (STR) filed by a frontline bank executive can actively stop the flow of illegal money and the associated financial crime. But very often, an unsupportive culture or even the lack of reporting tools can work as a stumbling block. Conversely, a strong risk-aware culture would empower this employee with the right awareness levels and tools to act proactively.

Today, with the pandemic causing en masse work from home, every employee is a frontline worker and by extension a risk manager. They will have to be equipped with the right training and reporting systems which will help them identify and report a malicious attack—making it even more important for organizations to actively embed a risk-aware culture.

Equipping the Front Line—Vital to Embedding a Risk-Aware Culture

Strengthening an organization’s risk culture is a continuous process. And when it comes to frontline workers, faster adoption of a risk-aware culture will depend on:

• The ease of capturing and reporting of business anomalies as well as the tracking of reported anomalies
• The efficient use of frontline workers time, including the time spent in training
• The availability of psychological and physical safety around risk reporting pertaining to sensitive issues
• The effective uses of technology such as AI-powered tools to simplify reporting of observations, issues, or any anomalies

This is where leveraging the right tools and technologies can play a key role in equipping your front line—leading to the building of a strong risk culture across the organization.

MetricStream Observation Management , built on the MetricStream Platform, makes it simple for your frontline employees to capture and report business anomalies. Your employees can report observations discreetly and anonymously (in case they feel it is a sensitive issue). The AI-powered interactive tool which includes widgets for third-party applications, browser plugins, conversational interfaces, chatbots, and intuitive web forms makes it easy for your frontline workers to flag potential risks and report any anomalies and deviations. The AI/ML capabilities provide insights into similar issues or observations raised previously to avoid any duplication of data and efforts. Once an incident or anomaly is reported, the employee can track and view the status of the observation. Finally, as an organization seeking to build a risk-aware culture, you save on training time while gaining the benefit of simplified adoption of GRC across the front line.

Additionally, the MetricStream Integrated Risk Management solution can effectively unify and streamline risk management activities across all business functions—making it easier to instill a risk-aware culture. By cutting across organizational silos, standardizing risk and control taxonomies, and enabling stakeholders to effectively coordinate, the solution can improve risk reporting visibility and efficiency for the executive management and board.

Contact us to know more about how our Observation Management and Integrated Risk Management solutions can help you build a strong risk-aware culture.

Sumith Sagar Associate Director, Product Marketing

Sumith Sagar is a proven product marketing professional, specializing in software product positioning, product-led growth marketing, presales and sales enablement. With over 12 years of risk management solutioning experience raging from Governance, Risk and Compliance (GRC), Commodity Trading & Risk Management (CTRM) and cybersecurity, she has been instrumental in driving BusinessGRC product marketing at MetricStream.

Sign up for our monthly newsletter

Related Resources

• eBook Implementing Enterprise Risk Management Program: A Step-by-Step Guide for Energy and Utilities Organizations
• Analyst Report Chartis Research Report 2019
• Infographics Get Future-Ready Now: 10 GRC Trends for 2023
• Case Study Oil and Gas Giant Strengthens Stakeholder Trust with a Holistic Approach to Assurance

Subscribe for Latest Updates

Ready to get started?

Introducing risk culture to the board: turning theory into practice case study

The head of risk at a large not-for-profit insurance and employee benefits provider explains how the organisation introduced risk culture to the board by adapting IRM materials.

There are lots of helpful risk management guides produced by organisations such as the Institute of Risk Management (IRM) and the Financial Stability Board (FSB). But risk managers need to be able to adapt these to use them successfully within their organisations. This case study shows how one CRO used the materials available to him and adopted a survey-led approach to engage the board with risk management and start introducing risk culture.

This paper was taken from Risk Leadership Network’s Intelligence platform – the network's searchable database of peer-contributed case studies, tools and templates.

Please complete the form to access this content

• Study Guides
• Homework Questions

Case Studies on Ethical Culture

• Open access
• Published: 09 April 2024

Creating culturally-informed protocols for a stunting intervention using a situated values-based approach ( WeValue InSitu ): a double case study in Indonesia and Senegal

• Annabel J. Chapman 1 ,
• Chike C. Ebido 2 , 3 ,
• Rahel Neh Tening 2 ,
• Yanyan Huang 2 ,
• Ndèye Marème Sougou 4 ,
• Risatianti Kolopaking 5 , 6 ,
• Amadou H. Diallo 7 ,
• Rita Anggorowati 6 , 8 ,
• Fatou B. Dial 9 ,
• Jessica Massonnié 10 , 11 ,
• Mahsa Firoozmand 1 ,
• Cheikh El Hadji Abdoulaye Niang 9 &
• Marie K. Harder 1 , 2  

BMC Public Health volume  24 , Article number:  987 ( 2024 ) Cite this article

184 Accesses

Metrics details

International development work involves external partners bringing expertise, resources, and management for local interventions in LMICs, but there is often a gap in understandings of relevant local shared values. There is a widespread need to better design interventions which accommodate relevant elements of local culture, as emphasised by recent discussions in global health research regarding neo-colonialism. One recent innovation is the concept of producing ‘cultural protocols’ to precede and guide community engagement or intervention design, but without suggestions for generating them. This study explores and demonstrates the potential of an approach taken from another field, named WeValue InSitu , to generate local culturally-informed protocols. WeValue InSitu engages stakeholder groups in meaning-making processes which ‘crystallize’ their envelope of local shared values, making them communicable to outsiders.

Our research context is understanding and reducing child stunting, including developing interventions, carried out at the Senegal and Indonesia sites of the UKRI GCRF Action Against Stunting Hub. Each national research team involves eight health disciplines from micro-nutrition to epigenetics, and extensive collection of samples and questionnaires. Local culturally-informed protocols would be generally valuable to pre-inform engagement and intervention designs. Here we explore generating them by immediately following the group WeValue InSitu crystallization process with specialised focus group discussions exploring: what local life practices potentially have significant influence on the environments affecting child stunting, and which cultural elements do they highlight as relevant. The discussions will be framed by the shared values, and reveal linkages to them. In this study, stakeholder groups like fathers, mothers, teachers, market traders, administrators, farmers and health workers were recruited, totalling 83 participants across 20 groups. Themes found relevant for a culturally-informed protocol for locally-acceptable food interventions included: specific gender roles; social hierarchies; health service access challenges; traditional beliefs around malnutrition; and attitudes to accepting outside help. The concept of a grounded culturally-informed protocol, and the use of WeValue InSitu to generate it, has thus been demonstrated here. Future work to scope out the advantages and limitations compared to deductive culture studies, and to using other formative research methods would now be useful.

Peer Review reports

Although progress has been made towards the SDG of ‘Zero Hunger by 2025’, the global rates of malnutrition and stunting are still high [ 1 ]. Over the past 20 years, researchers have implemented interventions to reduce undernutrition, specifically focussing on the first 1000 days of life, from conception to 24 months [ 2 ]. However, due to both differing determinants between countries [ 3 , 4 ] as well as varying contextual factors, it is clear that no single fixed approach or combination of approaches can be relied on when implementing stunting interventions [ 5 , 6 , 7 ]. Furthermore, when external researchers design interventions for local areas in Low- and Middle-Income Countries (LMICs) they can often overlook relevant local cultural factors that consequently act as barriers to intervention uptake and reduce their effectiveness, such as geographical factors and the levels of migration in certain populations [ 8 , 9 ], or social norms or perceptions relating to accepting outside help, and power dynamics related to gender [ 10 , 11 , 12 ]. The inclusion of cultural level factors in behaviour change interventions has been proposed as a requirement for effective interventions [ 13 ]. However, despite the breadth of literature highlighting the negative impacts from failing to do this, the lack of integration or even regard of local culture remains a persistent problem in Global Health Research [ 14 ], possibly hindering progress towards the SDGs. Thus, there is a need for approaches to integrate local cultural elements into intervention design.

This lack of understanding of relevant local culture, social norms and shared values also has ethical implications. The field of Global Health Ethics was predominantly developed in the Global North, in High Income Countries (HICs), embedding values common in those countries such as the prominence of individual autonomy [ 15 , 16 ]. Researchers from HICs carrying out research in LMICs may wrongly assume that values held in the Global North are universal [ 14 ] and disregard some local values, such as those related to family and collective decision making, which are core to many communities in LMICs. It is therefore important for outside researchers to have an understanding of relevant local values, culture and social norms before conducting research in LMICs so as not to impose values that do not align with local culture and inadvertently cause harm or offence [ 16 , 17 ]. The importance of this is compounded by the colonial history that is often present in relationships between research communities in HICs and LMICs, and the fact that the majority of the funding and leading institutions are still located in the Global North [ 18 , 19 ]. Thus, conscious steps must be taken to avoid neo-colonialism in Global Health Research [ 20 ]. From a health-equity perspective, it is essential to ensure that those in vulnerable communities are not hindered from involvement in interventions to improve nutrition. Encouraging uptake by such communities could be provided if salient local shared values, norms and culture were taken into account [ 21 ].

In a recent paper, Memon et al., (2021) highlight the usefulness of first creating a cultural protocol that can precede and guide subsequent stages of community engagement or intervention design to ensure that salient local values are known to external researchers coming into the community [ 16 ]. We adopt the use of the concept of a cultural protocol, referring to locally-generated guidance about key values, norms, behaviours and customs relevant to working with the local community. However, we prefer the term, ‘culturally-informed protocol’ since this relates to only cultural elements deemed salient by the researchers, and locally, rather than any comprehensive notion of culture, nor extending beyond the research context.

Memon et al. (2021), point out links between the creation of such a protocol and existing codes of practice that have already been created for some cultures such as the Te Ara Tika, a Guideline for Māori Research Ethics [ 22 ]. Currently, research and interventions in Global Health can be informed by a stage of formative research involving one-to-one interviews, focus groups or direct observations, which can sometimes be ethnographic in nature such as within Focussed Ethnographic Studies or Rapid Assessment Procedures [ 23 , 24 , 25 ]. Although these methods can be effective to inform intervention designs, they have disadvantages like: can take long periods to complete [ 26 ], can be resource intensive [ 26 ] and can lack cultural acceptability [ 27 ]. These limitations may account for the frequent neglect of their use generally, highlighted by Aubel and Chibanda (2022) [ 14 ]. Additionally, none of these methods work towards making explicit local values, or towards the creation of a culturally-informed protocol. In brief, the literature suggests a need to develop alternative methods of Formative Research for understanding locally relevant cultural elements, that are less time-consuming and can generate data that is more easily translatable to intervention design. In addition, these approaches must be applicable in different cultures. Additionally, the protocols produced must be actionable and practical not only for guiding interactions between research teams but also for guiding the initial stages of intervention design.

The work presented here aims to address several of these needs. It includes an exploration of the usefulness of the WeValue InSitu ( WVIS ) approach because that has previously been shown, in environmental management domains, to offer a way to gather in-depth values-based perspectives from a target population [ 28 , 29 ] It was first created through action research, and co-designed to enable civil society organisations to better understand and measure the values-based aspects of their work [ 30 ]. The core WeValue InSitu process (detailed in Table 1 ) involves the crystallization of shared values, with a facilitator guiding a group of participants with shared experiences, through cycles of tacit meaning-making (using a stage of photo-elicitation and triggering) [ 31 ], until they can articulate more explicitly their shared values, in concise and precise statements. These statements are then linked together in a framework by the participants. In an example case in Nigeria, the results of the WVIS approach hinted at the creation of a culturally-informed protocol through an analysis of the shared values frameworks to find cultural themes for the creation of an indicator tool that was used to evaluate several development scenarios based on their social acceptability [ 29 ].

Furthermore, it has been found that if a group of WVIS participants take part in a specialised focus group discussion (FGD), named Perspectives EXploration (PEX:FGD) immediately afterward the main workshop, then they easily and articulately express their perspectives on the topics raised for discussion - and with allusions to the shared values they had crystallised just prior. In an example from Shanghai, the PEX:FGDs focussed on eliciting perspectives on climate change, which were shown to be closely linked with the cultural themes existing within the shared values frameworks produced immediately prior [ 32 ]. In that case, the PEX:FGDs allowed the cultural themes generated during the main WVIS workshop to be linked more closely to the research question. Those results suggested that the WVIS plus PEX:FGD approach could be used to create a specialised culturally-informed protocol for improved intervention design.

In the study presented here, the WVIS approach was explored for the purpose of creating culturally-informed protocols to inform the planning of interventions within two localities of the UKRI GCRF Action Against Stunting Hub [ 33 ]. The work was carried out in two parts. Firstly, the WVIS main workshop was used to elicit cultural themes within the target communities, indicating key elements to consider to ensure ethical engagement. Secondly, the PEX focus group discussions focussed on life practices related to stunting which we explored for the purpose of tailoring the culturally-informed protocols to the specific purpose of improving the design of an example intervention. The Action Against Stunting Hub works across three sites where stunting is highly prevalent but via different determinants: East Lombok in Indonesia (estimated 36% of under-fives stunted), Kaffrine in Senegal (estimated 16% of under-fives stunted) and Hyderabad in India (estimated 48% of under-fives stunted) [ 34 ]. We propose that, the information about local shared values in a given site could be used to inform the design of several interventions, but for our specific exploration the focus here is a proposed ‘egg intervention’, in which pregnant women would be provided with an egg three times per week as supplement to their diet. This study proposes that identifying shared values within a community, alongside information about local life practices, provides critical cultural information on the potential acceptability and uptake of this intervention which can be used to generate culturally-informed protocols consisting of recommendations for improved intervention design.

In this paper we aim to explore the use of the WVIS approach to create culturally-informed protocols to guide engagement and inform the design of localised egg interventions to alleviate stunting in East Lombok, Indonesia and Kaffrine, Senegal. We do this by analysing data about local shared values that are crystallized using the WeValue InSitu ( WVIS ) process to provide clear articulation of local values, followed by an analysis of life practices discussed during PEX:FGD to tailor the culturally-informed protocols for the specific intervention design.

Study setting

This research was exploratory rather than explanatory in nature. The emphasis was on demonstrating the usefulness of the WeValue InSitu ( WVIS ) approach to develop culturally-informed protocols of practical use in intervention design, in different cultural sites. This study was set within a broader shared-values workstream within the UKRI GCRF Action Against Stunting Hub project [ 33 ]. The Hub project, which was co-designed and co-researched by researchers from UK, Indonesia, Senegal and India, involves cohorts of 500 women and their babies in each site through pregnancy to 24 months old, using cross-disciplinary studies across gut health, nutrition, food systems, micro-nutrition, home environment, WASH, epigenetics and child development to develop a typology of stunting. Alongside these health studies are studies of the shared values of the communities, obtained via the WVIS approach described here, to understand the cultural contexts of that diverse health data. In this study the data from East Lombok, Indonesia and Kaffrine, Senegal were used: India’s data were not yet ready, and these two countries were deemed sufficient for this exploratory investigation.

The WVIS approach

The WVIS approach is a grounded scaffolding process which facilitates groups of people to make explicit their shared values in their own vocabulary and within their own frames (details in Fig. 1 and activities in Table 1 ). The first stage of the WVIS is Contextualisation, whereby the group identifies themselves and set the context of their shared experiences, for example, as ‘mothers in East Lombok, Indonesia’. Subsequently, there is a stage of Photo Elicitation, in which the group are first asked to consider what is important, meaningful or worthwhile to them about their context (e.g., ‘being mothers in East Lombok, Indonesia’) and then asked to choose photos from a localised set that they can use as props to help describe their answer to the group [ 29 ]. After this, a localised Trigger List is used. This Trigger List consists of 109 values statements that act as prompts for the group. Examples of these values statements are included below but all the statements begin with “it is important to me/us that…”. The group are asked to choose which statements within the trigger list resonate with them, and those are taken forward for group intersubjective discussion. After a topic of their shared values has been explored, the group begin to articulate and write down their own unique statements of them. These also all begin with “It is important to me/us that…”. After discussing all pressing topics, the group links the written statements on the table into a unique Framework, and one member provides a narrative to communicate it to ‘outsiders’. The WVIS provides a lens of each group’s local shared values, and it is through this lens that they view the topics in the focus group discussions which immediately follow, termed Perspectives EXplorations (PEX:FGDs).

Schematic of the macro-level activities carried out during the WeValue InSitu ( WVIS ) main workshop session

This results in very grounded perspectives being offered, of a different nature to those obtained in questionnaires or using external frameworks [ 31 ]. The specific PEX:FGD topics are chosen as pertinent to stunting contextual issues, including eating habits, food systems and environments, early educational environments, and perceptions of stunting. The local researchers ensured that all topics were handled sensitively, with none that could cause distress to the participants. The data for this study were collected over 2 weeks within December 2019–January 2020 in workshops in East Lombok, Indonesia, and 2 weeks within December 2020 in Kaffrine, Senegal.

The PEX:FGDs were kept open-ended so that participants could dictate the direction of the discussion, which allowed for topics that may not have been pre-considered by the facilitators to arise. Sessions were facilitated by local indigenous researchers, guided in process by researchers more experienced in the approach, and were carried out in the local languages, Bahasa in East Lombok, Indonesia and French or Wolof in Kaffrine, Senegal.

Development of localised WVIS materials

Important to the WVIS approach is the development of localised materials (Table 1 ). The main trigger list has been found applicable in globalised places where English is the first language, but otherwise the trigger lists are locally generated in the local language, incorporating local vocabulary and ways of thinking. To generate these, 5–8 specific interviews are taken with local community members, by indigenous university researchers, eliciting local phrases and ways of thinking. This is a necessary step because shared tacit values cannot be easily accessed without using local language. Examples of localised Trigger Statements produced this way are given below: (they all start with: “It is important to me/us that…”):

…there is solidarity and mutual aid between the people

…I can still be in communication with my children, even if far away

…husbands are responsible for the care of their wives and family

…the town council fulfils its responsibility to meet our needs

…people are not afraid of hard, and even manual work

Study participants

The group participants targeted for recruitment, were selected by local country Hub co-researchers to meet two sets of requirements. For suitability for the WVIS approach they should be between 3 and 12 in number; belong to naturally existing groups that have some history of shared experiences; are over 18 years old; do not include members holding significantly more power than others; and speak the same native language. For suitability in the PEX:FGD to offer life practices with relevance to the research topic of stunting, the groups were chosen to represent stakeholders with connections to the food or learning environment of children (which the Action Against Stunting Hub refer to as the Whole Child approach) [ 33 ]. The university researchers specialising in shared values from the UK, and Senegal and Indonesia respectively, discussed together which stakeholder groups might be appropriate to recruit. The local researchers made the final decisions. Each group was taken through both a WVIS workshop and the immediately-subsequent PEX:FGD.

Data collection and analysis

Standard data output from the WeValue session includes i) the jointly-negotiated bespoke Statements of shared values, linked together in their unique Framework, and ii) an oral recording of a descriptive Narrative of it, given by the group. These were digitized to produce a single presentation for each group as in Fig. 2 . It represents the synthesised culmination of the crystallisation process: a portrait of what was ‘important’ to each stakeholder group. Separately, statements from the group about the authenticity/ownership of the statements are collected.

An illustrative example of one digitized Shared Values Framework and accompanying Narrative from a teacher’s group in East Lombok, Indonesia. The “…” refers to each statement being preceded by “It is important to us that…”

When these Frameworks of ‘Statements of Shared Values’ are viewed across all the groups from one locality (Locality Shared Values Statements), they provide portraits of ‘what is important’ to people living there, often in intimate detail and language. They can be used to communicate to ‘outsiders’ what the general cultural shared values are. In this work the researchers thematically coded them using Charmaz constructionist grounded theory coding [ 35 ] to find broad Major Cultural Themes within each separate locality.

The second area of data collection was in the post- WVIS event: the PEX:FGD for each group. A translator/interpreter provided a running commentary during these discussions, which was audio recorded and then transcribed. The specific topics raised for each group to discuss varied depending on their local expertise. This required completely separate workstreams of coding of the dataset with respect to each topic. This was carried out independently by two researchers: one from UK (using NVivo software (Release 1.3.1)) and one from the local country, who resolved any small differences. All the transcripts were then collated and inductively, interpretively analysed to draw out insights that should be relayed back to the Action Against Stunting Hub teams as contextual material.

The extracts of discussion which were identified as relevant within a particular Hub theme (e.g. hygiene) were then meta-ethnographically synthesised [ 36 ] into ‘Hub Theme Statements’ on each topic, which became the core data for later communication and interrogation by other researchers within the Action Against Stunting Hub. These statements are interpretations of participants’ intended meanings, and links from each of them to data quotes were maintained, enabling future interpretations to refer to them for consistency checks between received and intended meaning.

In this investigation, those Hub Theme Statements (derived from PEX:FGD transcripts) were then deductively coded with respect to any topics with potential implications of the egg intervention. Literature regarding barriers and facilitators to nutrition interventions indicated the following topics could be relevant: attitudes to accepting help; community interactions; cooking and eating habits; traditional beliefs about malnutrition; sharing; social hierarchies [ 12 , 37 , 38 ] to which we added anything related to pregnancy or eggs. This analysis produced our Egg Intervention Themes from the data.

The Major Cultural Themes and Egg Intervention Themes were then used to create a set of culture-based recommendations and intervention specific recommendations respectively for each locality. These recommendations were then combined to form specialized culturally-informed protocols for the egg intervention in each locality: East Lombok, Indonesia and Kaffrine, Senegal. The process is displayed schematically in Fig.  3 .

Schematic representation of the method of production of the culturally-informed protocol for each locality

The preparation of the localised WVIS materials at each site took 6 hours of interview field work, and 40 person hours for analysis. The 10 workshops and data summaries were concluded within 10 workdays by two people (80 person hours). The analysis of the PEX:FGD data took a further 80 person hours. Thus, the total research time was approximately 200 person hours.

The stakeholder group types are summarised in Table 2 . The data is presented in three parts. Firstly, the Major Cultural Themes found in East Lombok, Indonesia and in Kaffrine, Senegal are described – the ones most heavily emphasised by participants. Then, the Egg Intervention Themes and finally, the combined set of Recommendations to comprise a culturally-informed protocol for intervention design for each location. Quotations are labelled INDO or SEN for East Lombok, Indonesia and Kaffrine, Senegal, respectively.

Major cultural themes from frameworks and narratives

These were derived from the Locality Shared Values Statements produced in the WVIS .

East Lombok, Indonesia

Religious values.

Islamic values were crucially important for participants from East Lombok, Indonesia and to their way of life. Through living by the Quran, participating in Islamic community practices, and teaching Islamic values to their children, participants felt they develop their spirituality and guarantee a better afterlife for themselves and their children. Participants stated the Quran tells them to breastfeed their children for 2 years, so they do. Despite no explicit religious official curriculum in Kindergarten, the teachers stated that it was important to incorporate religious teaching.

“East Lombok people always uphold the religious values of all aspects of social life.”

“It is important for me to still teach religious values even though they are not clearly stated in the curriculum.” – Workshop 1 INDO (teachers).

“In Quran for instance, we are told to breastfeed our kids for 2 years. We can even learn about that ” – Workshop 3 INDO (mothers).

Related to this was the importance of teaching manners to children and preventing them from saying harsh words. Teachers stated that it was important to create a happy environment for the children and to ensure that they are polite and well-behaved. Similarly, mothers emphasised the need to teach their children good religious values to ensure they will be polite and helpful to their elders.

“Children don’t speak harsh words.”

“My children can help me like what I did to my parents”.

– Workshop 8 INDO (mothers).

Togetherness within families and the community

The Locality Shared Values Frameworks stressed the importance of togetherness, both within family and community. Comments mentioned it being important that people rely heavily on their family and come together in times of need to support each other and provide motivation. This was also important more broadly, in that people in society should support each other, and that children grow up to contribute to society. This was also reflected in comments around roles within the family. Despite women being primary care givers, and men working to finance the family, participants stated that they follow a process of consultation to make decisions, and when facing hardships.

“that we have the sense of kinship throughout our society”.

“We have togetherness as mothers”.

“For the family side, whatever happens we need to be able to be united as a whole family. We need to have the [sense of] forgiveness for the sake of the children” – Workshop 2 INDO (mothers).

Attitudes about extra-marital pregnancy

In East Lombok, Indonesia, it was essential to both mothers and fathers that pregnancy happened within a marriage, this was to ensure that the honour of the family was upheld and that the lineage of the child was clear. The potential danger to health that early pregnancies can cause was also acknowledged.

“If they don’t listen to parents’ advice, there will be the possibility of pre-marital pregnancy happening, which will affect the family [so much].

The affect is going to be ruining the good name, honour and family dignity. When the children [are] born outside [of] marriage, she or he will have many difficulties like getting a birth certificate [and] having a hard time when registering to school or family” - Workshop 4 INDO (mothers).

“ To make sure that our children avoid getting married at a very young age and moreover [avoid] having free sex so that they will not get pregnant before the marriage” - Workshop 9 INDO (fathers).

Kaffrine, Senegal

The Major Cultural Themes which emerged from the Kaffrine data are described below. As these are grounded themes, they are different than those seen in East Lombok, Indonesia.

Access to healthcare

A recurring theme amongst the groups in Kaffrine were aspirations of affordable and easy-to-access healthcare. Community health workers stated the importance of encouraging women to give birth in hospitals and spoke of the importance of preventing early pregnancy which result from early marriages. Giving birth in hospitals was also a concern for Public Office Administrators who highlighted that this leads to subsequent issues with registering children for school. Mothers and fathers stated the importance of being able to afford health insurance and access healthcare so that they could take care of themselves.

“That the women give birth in the hospital” – Workshop 11 SEN (CHWS).

“To have affordable health insurance ” – Workshop 10 SEN (mothers).

“To have access to health care ” – Workshop 3 SEN (fathers).

“It is important that women give birth in the hospital in order to be able to have a certificate that allows us to establish the civil status” – Workshop 9 SEN (administrators).

Additionally, Community health workers spoke of their aspiration to have enough supplements to provide to their community so as to avoid frustration at the lack of supply, and mothers spoke of their desire to be provided with supplements.

“To have dietary supplements in large quantities to give them to all those who need them, so as not to create frustration” – Workshop 11 SEN (CHWS).

Another aspect of access to healthcare, was mistrust between fathers and community health workers. Community health workers explained that sometimes men can blame them when things go wrong in a pregnancy or consider their ideas to be too progressive. Thus, to these community health workers the quality of endurance was very important.

“Endurance (Sometimes men can accuse us of influencing their wives when they have difficulties in conceiving)” – Workshop 5 SEN (CHWs).

Another recurring theme was the importance of having secure employment and a means to support themselves; that there were also jobs available for young people, and that women had opportunities to make money to help support the family. This included preventing early marriages so girls could stay in school. Having jobs was stated as essential for survival and important to enable being useful to the community and society.

“To have more means of survival (subsistence) to be able to feed our families”.

“To have a regular and permanent job”.

“We assure a good training and education for our children so that they will become useful to us and the community”.

“ Our women should have access to activities that will support us and lessen our burden” – Workshop 3 SEN (fathers).

It was considered very important to have a religious education and respect for religious elders. Moreover, living by, and teaching, religious values such as being hard working, humble and offering mutual aid to others, was significant for people in Kaffrine.

“Have an education in the Islamic Culture (Education that aligns with the culture of Islam)”.

“Respect toward religious leaders” – Workshop 3 SEN (fathers).

“ To organize religious discussions to develop our knowledge about Islam ” - Workshop 10 SEN (mothers).

“ Have belief and be prayerful and give good counselling to people ” - Workshop 4 SEN (grandmothers).

Egg intervention themes from each country from perspectives EXplorations focus group discussion data

Below are results of analyses of comments made during the PEX:FGDs in East Lombok, Indonesia and Kaffrine, Senegal. The following codes were used deductively: attitudes to accepting outside help, traditional gender roles, food sharing, traditional beliefs, social hierarchies and understanding of stunting and Other. These topics were spoken about during open discussion and were not the subject of direct questions. For example, topics relating to traditional gender roles came up in East Lombok, during conversations around the daily routine. Thus, in order to more accurately reflect the intended meaning of the participants, these were labelled food practices, under the “Other” theme. If any of the themes were not present in the discussion, they are not shown below.

Attitudes to accepting outside help

Few mentions were made that focussed on participants attitudes to accepting outside help, but participants were sure that they would not make changes to their menus based on the advice of outside experts. Additionally, teachers mentioned that they are used to accepting help from local organisations that could to help them to identify under-developed children.

“ We don’t believe that [the outsiders are] going to change our eating habits or our various menus ” – Workshop 3 INDO (Mothers).

Traditional gender roles

In East Lombok, mothers spoke about how their husbands go to work and then provide them with daily money to buy the food for the day. However, this was discussed in relation to why food is bought daily and is thus discussed below in the topics Other – Food practices.

Food sharing

In East Lombok, Indonesia, in times when they have extra food, they share it with neighbours, in the hope that when they face times of hardship, their neighbours will share with them. Within the household, they mentioned sharing food from their plate with infants and encouraging children to share. Some mothers mentioned the importance of weekly meetings with other mothers to share food and sharing food during celebrations.

“ Sometimes we share our food with our family. So, when we cook extra food, we will probably send over the food to our neighbour, to our families. So, sometimes, with the hope that when we don’t have anything to eat, our neighbour will pay for it and will [share with] us.” – Workshop 3 INDO (Mothers).

“Even they serve food for the kids who come along to the house. So, they teach the kids to share with their friends. They provide some food. So, whenever they play [at their] house, they will [eat] the same.” – Workshop 2 INDO (Mothers).

Understanding of stunting

The teachers in East Lombok were aware of child stunting through Children’s Development Cards provided by local healthcare organizations. They stated that they recognise children with nutrition problems as having no patience period, no expression, no energy for activities and less desire to socialise and play with other children. The teachers said that stunted children do not develop the same as other children and are not as independent as children who are the proper height and weight for their development. They also stated that they recognise stunted children by their posture, pale faces and bloated stomachs. They explained how they usually use the same teaching methods for stunting children, but will sometimes allow them to do some activities, like singing, later, once the other children are leaving.

“ They have no patience period, don’t have any energy to do any of the activities. No expression, only sitting down and not mingling around with the kids. They are different way to learn. They are much slower than the other kids .” – Workshop 1 INDO (teachers).

“ When they are passive in singing, they will do it later when everyone else is leaving, they just do it [by] themselves ” – Workshop 1 INDO (teachers).

Specific views on eggs

In East Lombok, Indonesia, there were no superstitions or traditional beliefs around the consumption of eggs. When asked specifically on their views of eggs, and if they would like to be provided with eggs, women in East Lombok said that they would be happy to accept eggs. They also mentioned that eggs were a food they commonly eat, feed to children and use for convenience. Eggs were considered healthy and were common in their house.

“ We choose eggs instead. If we don’t have time, we just probably do some omelettes or sunny side up. So, it happens, actually when we get up late, we don’t have much time to be able to escort our kids to the school, then we fry the eggs or cook the instant noodles. And it happens to all mothers. So, if my kids are being cranky, that’s what happens, I’m not going to cook proper meals so, probably just eggs and instant noodles.” – Workshop 3 INDO (Mothers).

Other important topics – food practices

Some detailed themes about food practices were heard in East Lombok, Indonesia. The women were responsible for buying and preparing the food, which they purchased daily mainly due to the cost (their husbands were paid daily and so provided them with a daily allowance) and lack of storage facilities. They also bought from mobile vendors who came to the street, because they could buy very small amounts and get occasional credit. The mother decided the menu for the family and cooked once per day in the morning: the family then took from this dish throughout the day. Mothers always washed their fruits and vegetables and tried to include protein in their meals when funds allowed: either meat, eggs, tofu or tempeh.

“ One meal a day. They [the mothers] cook one time and they [the children] can eat it all day long. Yes, they can take it all day long. They find that they like [to take the food], because they tend to feel hungry.” – Workshop 6 INDO (Mothers).

“ They shop every day because they don’t have any storage in their house and the other factor is because the husband has a daily wage. They don’t have monthly wage. In the morning, the husband gives the ladies the money and the ladies go to the shop for the food. ” – Workshop 4 INDO (Mothers).

In Kaffrine, the following themes emerged relating to an egg intervention: they were different in content and emphasis to Lombok and contained uniquely local cultural emphases.

Mothers were welcoming of eggs as a supplement to improve their health during pregnancy and acknowledged the importance of good nutrition during pregnancy. However, they also mentioned that their husbands can sometimes be resistant to accepting outside help and provided an example of a vaccination programme in which fathers were hesitant to participate. However, participants stated that the Government should be the source of assistance to them (but currently was not perceived to be so).

“But if these eggs are brought by external bodies, we will hesitate to take it. For example, concerning vaccination some fathers hesitate to vaccinate their children even if they are locals who are doing it. So, educating the fathers to accept this is really a challenge” – Workshop 11 SEN (CHWs).

Some traditional gender roles were found to be strong. The participants emphasised that men are considered the head of the household, as expected in Islam, with the mother as primary caregiver for children. This is reflected in the comments from participants regarding the importance of Islam and living their religious values. The men thus made the family decisions and would need to be informed and agree to any family participation in any intervention – regardless of the education level of the mother. The paternal grandmother also played a very important role in the family and may also make decisions for the family in the place of the father. Community Health Workers emphasised that educating paternal grandmothers was essential to improve access to healthcare for women.

“There are people who are not flexible with their wives and need to be informed. Sometimes the mother-in-law can decide the place of the husband. But still, the husband’s [permission] is still necessary.” – Workshop 1 SEN (CHWs).

“[We recommend] communication with mothers-in-law and the community. Raise awareness through information, emphasizing the well-being of women and children.” – Workshop 1 SEN (CHWs).

“The [grand]mothers take care of the children so that the daughters in-law will take care of them in return So it’s very bad for a daughter in law not to take care of her mother in-law. Society does not like people who distance themselves from children.” – Workshop 4 SEN (grandmothers).

Social hierarchies

In addition to hierarchies relating to gender/position in the family such as grandmothers have decision making power, there was some mention of social hierarchies in Kaffrine, Senegal. For example, during times of food stress it was said that political groups distribute food and elected officials who choose the neighbourhoods in which the food will be distributed. Neighbourhood leaders then decide to whom the food is distributed, meaning there is a feeling that some people are being left out.

“ It’s political groups that come to distribute food or for political purposes…organizations that often come to distribute food aid, but in general it is always subject to a selection on the part of elected officials, in particular the neighbourhood leaders, who select the people they like and who leave the others ” – Workshop 11 SEN (CHWs).

Participants explained that during mealtimes, the family will share food from one large plate from which the father will eat first as a sign of respect and courtesy. Sometimes, children would also eat in their neighbour’s house to encourage them to eat.

“ Yes, it happens that we use that strategy so that children can eat. Note that children like to imitate so that’s why we [send them to the neighbour’s house]” – Workshop 11 SEN (CHWs)”.

Traditional beliefs about malnutrition

In Kaffrine, Senegal, some participants spoke of traditional beliefs relating to malnutrition, which are believed by fewer people these days. For example, uncovered food might attract bad spirits, and any person who eats it will become ill. There were a number of food taboos spoken of which were thought to have negative consequences for the baby, for example watermelon and grilled meat which were though to lead to birth complications and bleeding. Furthermore, cold water was thought to negatively impact the baby. Groups spoke of a tradition known as “bathie” in which traditional healers wash stunted children with smoke.

“ There are traditional practices called (Bathie) which are practiced by traditional healers. Parents are flexible about the practice of Bathie ” – Workshop 1 SEN (CHWs).

Causes of malnutrition and stunting were thought to be a lack of a balanced diet, lack of vitamin A, disease, intestinal worms, poor hygiene, socio-cultural issues such as non-compliance with food taboos, non-compliance with exclusive breastfeeding and close pregnancies. Malnutrition was also thought by some to be hereditary. Numerous signs of malnutrition were well known amongst the groups in Kaffrine. For example, signs of malnutrition were thought to be a big bloated belly, diarrhoea, oedema of the feet, anaemia, small limbs and hair loss as well as other symptoms such as red hair and a pale complexion. Despite this, malnutrition was thought to be hard to identify in Kaffrine as not all children will visit health centres, but mothers do try to take their babies heights and weights monthly. The groups were aware of the effect of poverty on the likelihood of stunting as impoverished parents cannot afford food. Furthermore, the groups mentioned that there is some stigma towards stunted children, and they can face mockery from other children although most local people feel pity and compassion towards them. Malnourished children are referred to as Khiibon or Lonpogne in the local language of Wolof.

“ It is poverty that is at the root of malnutrition, because parents do not have enough money [and] will have difficulty feeding their families well, so it is the situation of poverty that is the first explanatory factor of malnutrition here in Kaffrine” – Workshop 9 SEN (administrators).

“It can happen that some children are the victim of jokes for example of mockery from children of their same age, but not from adults and older ” – Workshop 9 SEN (administrators).

Pregnancy beliefs

In Kaffrine, Senegal, there were concerns around close pregnancies, and pregnancies in women who were too young, and for home births. Within the communities there was a stigma around close pregnancies, which prevented them from attending antenatal appointments. Similarly, there were superstitions around revealing early pregnancies, which again delayed attendance at health centres.

Groups acknowledged the role of good nutrition, and mentioned some forbidden foods such as salty foods, watermelon and grilled meat (which sometimes related back to a traditional belief that negative impacts would be felt in the pregnancy such as birth complications and bleeding). Similarly, drinking cold water was thought to negatively affect the baby. Beneficial foods mentioned included vegetables and meat, during pregnancy.

“ Often when a woman has close pregnancies, she can be ashamed, and this particularly delays the time of consultation” – Workshop 5 SEN (CHWs).

“Yes, there are things that are prohibited for pregnant women like salty foods” – Workshop 11 SEN (CHWs).

In Kaffrine, Senegal, some participants spoke of a traditional belief that if a pregnant woman consumes eggs then her baby might be overweight, or have problems learning how to talk. Despite this, mothers in Kaffrine said that they would be happy to accept eggs as a supplement, although if supplements are provided that require preparation (such as powdered supplements), they would be less likely to accept them.

“These restrictions are traditional, and more women no longer believe that eggs will cause a problem to the child. But if these eggs are brought by external bodies, we will hesitate to take it.” – Workshop 11 SEN (CHWs).

“They don’t eat eggs before the child starts speaking (the child only eats eggs when he starts talking). This is because it’s very heavy and can cause bloating and may also lead to intestinal problems.” – Workshop 4 SEN (grandmothers).

Other important topics – access to health services

For the participants in Kaffrine, Senegal, accessing health services was problematic, particularly for pre- and post-natal appointments, which faced frequent delays. Some women had access due to poor roads and chose to give birth at home. Access issues were further compounded by poverty and social factors, as procedures in hospitals can be costly, and women with close pregnancies (soon after an earlier one) can feel shame from society and hide their pregnancy.

“Women really have problems of lack of finances. There are social services in the hospital; but those services rarely attend to women without finances. Even when a child dies at birth they will require money to do the necessary procedure ” – Workshop 11 SEN (CHWs).

Creation of the culturally-informed protocols

Recommendations that comprise a culturally-informed protocol for intervention design in each locality are given in Table 3 .

The Major Cultural Themes, and specific Egg Intervention Themes drawn out from only 9–11 carefully planned group sessions in each country provided a rich set of recommendations towards a culturally-informed protocol for the localised design of a proposed Egg Intervention for both East Lombok, Indonesia and Kaffrine, Senegal. A culturally-informed protocol designed in this way comprises cultural insights which are worthy of consideration in local intervention design and should guide future stages of engagement and provide a platform from which good rapport and trust can be built between researchers and the community [ 16 ]. For example, in Kaffrine, Senegal, the early involvement of husbands and grandmothers is crucial, which reflects values around shared decision making within families that are noted to be more prevalent in LMICs, in contrast to individualistic values in HICs [ 16 , 39 ]. Similarly, due to strong religious values in both East Lombok, Indonesia and Kaffrine, Senegal, partnerships with Islamic leaders is likely to improve engagement. Past studies show the crucial role that religious leaders can play in determining social acceptability of interventions, particularly around taboo topics such as birth spacing [ 40 ].

The WVIS plus PEX:FGD method demonstrated here produced both broad cultural themes from shared values, which were in a concise and easy-to-understand format which could be readily communicated with the wider Action Against Stunting Hub, as well as life practices relevant to stunting in Kaffrine, Senegal and in East Lombok, Indonesia. Discussions of shared values during the WVIS main workshop provided useful cultural background within each community. PEX:FGD discussion uncovered numerous cultural factors within local life practices that could influence on the Egg Intervention engagement and acceptability. Combining themes from the WVIS workshop and PEX:FGDs allowed for specific recommendations to be made towards a culturally-informed protocol for the design of an Egg Intervention that included both broad cultural themes and specific Intervention insights (Table 3 ). For example, in Kaffrine, Senegal, to know that the husband’s authoritative family decision-making for health care (specific) is rooted in Islamic foundations (wider cultural) points to an Intervention Recommendation within the protocol, involving consultations with Islamic Leaders to lead community awareness targeting fathers. Similarly, in East Lombok, Indonesia the (specific) behaviour of breastfeeding for 2 years was underpinned by (wider cultural) shared values of living in Islam. This understanding of local values could prevent the imposition of culturally misaligned values, which Bernal and Adames (2017) caution against [ 17 ].

There are a number of interesting overlaps between values seen in the WVIS Frameworks and Narratives and the categories of Schwartz (1992) and The World Values Survey (2023) [ 41 , 42 ]. For example, in both Kaffrine, Senegal and East Lombok, Indonesia, strong religious values were found, and the groups spoke of the importance of practicing their religion with daily habits. This would align with traditional and conservation values [ 41 , 43 ]. Furthermore, in Kaffrine, Senegal participants often mentioned the importance of mutual aid within the community, and similar values of togetherness and respect in the community were found in East Lombok, Indonesia. These would seem to align with traditional, survival and conservation values [ 41 , 43 ]. However, the values mentioned by the groups in the WVIS workshops are far more specific, and it is possible that through asking what is most worthwhile, valuable and meaningful about their context, the participants are able to prioritise which aspects of their values are most salient to their daily lives. Grounded shared values such as these are generally neglected in Global Health Research, and values predominant in the Global North are often assumed to be universal [ 14 ]. Thus, by excluding the use of a predefined external framework, we minimized the risk of imposing our own ideas of values in the community, and increased the relevance, significance and local validity of the elicited information [ 28 ].

Participatory methods of engagement are an essential step in conducting Global Health Research but there is currently a paucity of specific guidance for implementing participatory methods in vulnerable communities [ 16 , 44 ]. In addition, there is acknowledgement in the literature that it is necessary to come into communities in LMICs without assumptions about their held values, and to use bottom-up participatory approaches to better understand local values [ 14 , 16 ]. The WVIS plus PEX:FGD methodology highlighted here exemplifies a method that is replicable in multiple country contexts [ 28 , 32 ] and can be used to crystallize local In Situ Shared Values which can be easily communicated to external researchers. Coupled with the specialised FGD (PEX:FGD), values-based perceptions of specific topics (in this case stunting) can be elicited leading to the creation of specific Culture-based recommendations. This therefore takes steps to answer the call by Memon and colleagues (2021) for the creation of cultural protocols ahead of conducting research in order to foster ethical research relationships [ 16 ]. We believe that the potential usefulness of the WVIS approach to guide engagement and inform intervention design is effectively demonstrated in this study and WVIS offers a method of making explicit local values in a novel and valuable way.

However, we acknowledge that our approach has several limitations. It has relied heavily on the local university researchers to debate and decide which participant stakeholder groups should be chosen, and although they did this in the context of the Whole Child approach, it would have been advantageous to have involved cultural researchers with a deeper understanding of cultural structures, to ensure sufficient opportunities for key cultural elements to emerge. This would have in particular strengthened the intervention design derived from the PEX:FGD data. For example, we retrospectively realised that our study could have been improved if grandmothers had been engaged in East Lombok. Understanding this limitation leads to suggestion for further work: to specifically investigate the overlap of this approach with disciplinary studies of culture, where social interactions and structures are taken into account via formal frameworks.

There are more minor limitations to note. For example, the WVIS approach can only be led by a trained and experienced facilitator: not all researchers can do this. A training programme is currently under development that could be made more widely available through online videos and a Handbook. Secondly, although the groups recruited do not need to be representative of the local population, the number recruited should be increased until theoretical saturation is achieved of the themes which emerge, which was not carried out in this study as we focussed on demonstrating the feasibility of the tool. Thirdly, there is a limit to the number of topics that can be explored in the PEX:FGDs within the timeframe of one focus group (depending on the stamina of the participants), and so if a wider range of topics need formative research, then more workshops are needed. Lastly, this work took place in a large, highly collaborative project involving expert researchers from local countries as well as international experts in WVIS : other teams may not have these resources. However, local researchers who train in WVIS could lead on their own (and in this Hub project such training was available).

The need for better understanding, acknowledgement and integration of local culture and shared values is increasing as the field of Global Health Research develops. This study demonstrates that the WVIS plus PEX:FGD shared values approach provides an efficient approach to contextualise and localise interventions, through eliciting and making communicable shared values and local life practices which can be used towards the formation of a culturally-informed protocols. Were this method to be used for intervention design in future, it is possible that more focus should be given to existing social structures and support systems and a greater variety of stakeholders should be engaged. This study thus contributes to the literature on methods to culturally adapt interventions. This could have significant implications for improving the uptake of nutrition interventions to reduce malnutrition through improved social acceptability, which could help progression towards the goal of Zero Hunger set within the SDGs. The transferability and generalisability of the WVIS plus PEX:FGD approach should now be investigated further in more diverse cultures and for providing formative research information for a wider range of research themes. Future studies could also focus on establishing its scaling and pragmatic usefulness as a route to conceptualising mechanisms of social acceptability, for example a mechanism may be that in communities with strong traditional religious values, social hierarchies involving religious leaders and fathers exist and their buy-in to the intervention is crucial to its social acceptability. Studies could also focus on the comparison or combination of WVIS plus PEX:FGD with other qualitative methods used for intervention design and implementation.

Availability of data and materials

The datasets used and/or analysed during the current study are available from the corresponding author on reasonable request [email protected], Orcid number 0000–0002–1811-4597. These include deidentified Frameworks of Shared Values and Accompanying Narrative from each Group; deidentified Hub Insight Statements of relevant themes.

World Health Organization and Food and Agriculture Organization of the United Nations. Driving commitment for nutrition within the UN Decade of Action on Nutrition: policy brief. Geneva: World Health Organization; 2018.

Google Scholar  

Victora CG, Christian P, Vidaletti LP, Gatica-Domínguez G, Menon P, Black RE. Revisiting maternal and child undernutrition in low-income and middle-income countries: variable progress towards an unfinished agenda. Lancet. 2021;397(10282):1388–99.

Article   CAS   PubMed   PubMed Central   Google Scholar  

Aguayo VM, Nair R, Badgaiyan N, Krishna V. Determinants of stunting and poor linear growth in children under 2 years of age in India: an in-depth analysis of Maharashtra's comprehensive nutrition survey. Matern Child Nutr. 2016;12 Suppl 1(Suppl 1):121–40.

Article   PubMed   Google Scholar  

Beal T, Tumilowicz A, Sutrisna A, Izwardy D, Neufeld LM. A review of child stunting determinants in Indonesia. Matern Child Nutr. 2018;14(4):e12617.

Article   PubMed   PubMed Central   Google Scholar  

Hossain M, Choudhury N, Adib Binte Abdullah K, Mondal P, Jackson AA, Walson J, et al. Evidence-based approaches to childhood stunting in low and middle income countries: a systematic review. Arch Dis Child. 2017;102(10):903–9.

Brar S, Akseer N, Sall M, Conway K, Diouf I, Everett K, et al. Drivers of stunting reduction in Senegal: a country case study. Am J Clin Nutr. 2020;112(Suppl 2):860s–74s.

Heidkamp RA, Piwoz E, Gillespie S, Keats EC, D'Alimonte MR, Menon P, et al. Mobilising evidence, data, and resources to achieve global maternal and child undernutrition targets and the sustainable development goals: an agenda for action. Lancet. 2021;397(10282):1400–18.

Article   CAS   PubMed   Google Scholar  

Goudet SM, Bogin BA, Madise NJ, Griffiths PL. Nutritional interventions for preventing stunting in children (birth to 59 months) living in urban slums in low- and middle-income countries (LMIC). Cochrane Database Syst Rev. 2019;6(6):Cd011695.

PubMed   Google Scholar  

Desai S, Misra M, Das A, Singh RJ, Sehgal M, Gram L, et al. Community interventions with women's groups to improve women's and children's health in India: a mixed-methods systematic review of effects, enablers and barriers. BMJ Glob Health. 2020;5(12)

Muraya KW, Jones C, Berkley JA, Molyneux S. Perceptions of childhood undernutrition among rural households on the Kenyan coast – a qualitative study. BMC Public Health. 2016;16(1):693.

Isler J, Sawadogo NH, Harling G, Bärnighausen T, Adam M, Sié A, et al. 'If he sees it with his own eyes, he will understand': how gender informed the content and delivery of a maternal nutrition intervention in Burkina Faso. Health Policy Plan. 2020;35(5):536–45.

Zaidi S, Das JK, Khan GN, Najmi R, Shah MM, Soofi SB. Food supplements to reduce stunting in Pakistan: a process evaluation of community dynamics shaping uptake. BMC Public Health. 2020;20(1):1046.

Wight D, Plummer M, Ross D. The need to promote behaviour change at the cultural level: one factor explaining the limited impact of the MEMA kwa Vijana adolescent sexual health intervention in rural Tanzania. A process evaluation. BMC Public Health. 2012;12(1):788.

Aubel J, Chibanda D. The neglect of culture in global health research and practice. BMJ Glob Health. 2022;7(9):e009914.

Article   PubMed Central   Google Scholar  

Myser C. Defining "global health ethics": offering a research agenda for more bioethics and multidisciplinary contributions-from the global south and beyond the health sciences-to enrich global health and global health ethics initiatives. J Bioeth Inq. 2015;12(1):5–10.

Memon R, Asif M, Khoso AB, Tofique S, Kiran T, Chaudhry N, et al. Recognising values and engaging communities across cultures: towards developing a cultural protocol for researchers. BMC Med Ethics. 2021;22(1):47.

Bernal G, Adames C. Cultural adaptations: conceptual, ethical, contextual, and methodological issues for working with Ethnocultural and majority-world populations. Prev Sci. 2017;18(6):681–8.

Glickman SW, McHutchison JG, Peterson ED, Cairns CB, Harrington RA, Califf RM, et al. Ethical and scientific implications of the globalization of clinical research. N Engl J Med. 2009;360(8):816–23.

King KF, Kolopack P, Merritt MW, Lavery JV. Community engagement and the human infrastructure of global health research. BMC Med Ethics. 2014;15(1):84.

Horton R. Offline: is global health neocolonialist? Lancet. 2013;382(9906):1690.

Article   Google Scholar  

Woodward EN, Matthieu MM, Uchendu US, Rogal S, Kirchner JE. The health equity implementation framework: proposal and preliminary study of hepatitis C virus treatment. Implement Sci. 2019;14(1):26.

The Pūtaiora Writing Group. Te Ara Tika Guidelines for Māori research ethics: A framework for researchers and ethics committee members. Health Research Council of New Zealand. (no date). Online, Accessed 5 th May 2023. Available from: http://www.hrc.govt.nz/sites/default/files/2019-06/Resource%20Library%20PDF%20-%20Te%20Ara%20Tika%20Guidelines%20for%20Maori%20Research%20Ethics.pdf

Pelto GH, Armar-Klemesu M, Siekmann J, Schofield D. The focused ethnographic study 'assessing the behavioral and local market environment for improving the diets of infants and young children 6 to 23 months old' and its use in three countries. Matern Child Nutr. 2013;9 Suppl 1(Suppl 1):35–46.

Bentley ME, Johnson SL, Wasser H, Creed-Kanashiro H, Shroff M, Fernandez Rao S, et al. Formative research methods for designing culturally appropriate, integrated child nutrition and development interventions: an overview. Ann N Y Acad Sci. 2014;1308:54–67.

Kodish S, Aburto N, Dibari F, Brieger W, Agostinho SP, Gittelsohn J. Informing a behavior change communication strategy: formative research findings from the scaling up nutrition movement in Mozambique. Food Nutr Bull. 2015;36(3):354–70.

Mattes RD, Rowe SB, Ohlhorst SD, Brown AW, Hoffman DJ, Liska DJ, et al. Valuing the diversity of research methods to advance nutrition science. Adv Nutr. 2022;13(4):1324–93.

Robert RC, Bartolini RM, Creed-Kanashiro HM, Verney SA. Using formative research to design context-specific animal source food and multiple micronutrient powder interventions to improve the consumption of micronutrients by infants and young children in Tanzania, Kenya, Bangladesh and Pakistan. Matern Child Nutr. 2021;17(2):e13084.

Sethamo OA, Masika RJ, Harder MK. Understanding the role of crystallizing local shared values in fostering effective community engagement in adaptation planning in Botswana. Clim Dev. 2020;12(5):448–56.

Odii EC, Ebido CC, Harder MK. A values-based approach for generating localized social indicators for use in sustainability assessment and decision-making: test case of brownfield soft reuse in Nigeria. Sci Total Environ. 2020;711:135045.

Podger D, Piggot G, Zahradnik M, Janoušková S, Velasco I, Hak T, et al. The earth charter and the ESDinds initiative: developing indicators and assessment tools for civil society organisations to examine the values dimensions of sustainability projects. J Educ Sustain Dev. 2010;4(2):297–305.

Odii BC, Huang Y, Bouvrie N, Harder MK. Cycles of meaning-making crystallization in the WeValue InSitu process as clear contributions towards transformative learning. J Clean Prod. 2021;304:127024.

Huang Y, Wu W, Xue Y, Harder MK. Perceptions of climate change impacts on city life in Shanghai: through the lens of shared values. Cleaner Prod Lett. 2022;3:100018.

Action Against Stunting Hub. UKRI GCRF action against stunting: alleviating child undernutrition, globally. 2020. URL: https://actionagainststunting.org/ [Accessed 15/08/2022].

UNICEF. Nutrition country profiles . 2010. URL: https://data.unicef.org/resources/nutrition-country-profiles/ [Accessed 10/05/2023].

Charmaz K. Constructing grounded theory. 2nd ed. London: SAGE; 2014.

Noblit GW, Hare RD, Hare RD. Meta-ethnography: synthesizing qualitative studies: sage; 1988.

Stelle I, McDonagh LK, Hossain I, Kalea AZ, Pereira DIA. Nutrients. 2021;13(4):1140.

Muraya KW, Jones C, Berkley JA, Molyneux S. "If it's issues to do with nutrition…I can decide…": gendered decision-making in joining community-based child nutrition interventions within rural coastal Kenya. Health Policy Plan. 2017;32(suppl_5):v31–v9.

Aubel J. Grandmothers — a neglected family resource for saving newborn lives. BMJ Glob Health. 2021;6(2):e003808.

Egeh AA, Dugsieh O, Erlandsson K, Osman F. The views of Somali religious leaders on birth spacing - a qualitative study. Sex Reprod Healthc. 2019;20:27–31.

Schwartz SH. Universals in the content and structure of values: Theoretical advances and empirical tests in 20 countries. Advances in experimental social psychology. 25: Elsevier; 1992. p. 1–65.

World Values Survey Association. Findings and insights, 2020 [Available from: https://www.worldvaluessurvey.org/WVSContents.jsp .]

Inglehart R, Welzel C. Value change and the persistence of cultural traditions. Modernization, cultural change, and democracy: the human development sequence. Cambridge: Cambridge University Press; 2005. p. 48–76.

Glandon D, Paina L, Alonge O, Peters DH, Bennett S. 10 best resources for community engagement in implementation research. Health Policy Plan. 2017;32(10):1457–65.

Download references

Acknowledgements

We thank the Hub PI, Claire Heffernan, for feedback on a late draft of the manuscript.

The Action Against Stunting Hub is funded by the Medical Research Council through the UK Research and Innovation (UKRI) Global Challenges Research Fund (GCRF), Grant No.: MR/S01313X/1.

Author information

Authors and affiliations.

Values & Sustainability Research Group, School of Architecture, Technology and Engineering, University of Brighton, Brighton, UK

Annabel J. Chapman, Mahsa Firoozmand & Marie K. Harder

Department of Environmental Science and Engineering, Fudan University, Shanghai, People’s Republic of China

Chike C. Ebido, Rahel Neh Tening, Yanyan Huang & Marie K. Harder

Department of Zoology and Environmental Biology, University of Nigeria, Nsukka, Nigeria

Chike C. Ebido

Preventive Medicine and Public Health, Université Cheikh Anta Diop (UCAD), Dakar, Senegal

Ndèye Marème Sougou

Faculty of Psychology, Universitas Islam Negeri Syarif Hidayatullah, Jakarta, Indonesia

Risatianti Kolopaking

Southeast Asian Ministers of Education Organization Regional Centre for Food and Nutrition (SEAMEO RECFON) Universitas Indonesia, Jakarta, Indonesia

Risatianti Kolopaking & Rita Anggorowati

International Research Laboratory (IRL 3189) Environnement santé et sociétés/CNRS/UCAD, Dakar, Senegal

Amadou H. Diallo

Department of Medical Records and Health Information, Faculty of Health and Technology, Universitas Bandung, Bandung, Indonesia

Rita Anggorowati

Laboratory of Cultural Anthropology, IFAN, Université Cheikh Anta Diop (UCAD), Dakar, Senegal

Fatou B. Dial & Cheikh El Hadji Abdoulaye Niang

School of Education, Languages and Linguistics, Faculty of Humanities and Social Sciences, University of Portsmouth, Portsmouth, UK

Jessica Massonnié

Department of Learning and Leadership, IOE, UCL’s Faculty of Education and Society, University College London, London, UK

You can also search for this author in PubMed   Google Scholar

Contributions

MKH formulated the initial research question and study design. AJC developed the specific research question. Data collection in Senegal involved CCE, NMS, AHD, FBD, RNT, CEHAN and JM. Data collection in Indonesia involved RA, RK, YH and MKH. Cultural interpretation in Senegal Involved AHD, FBD, NMS, RNT and JM. Analysis involved AJC and MF. AJC and MKH wrote the paper.

Corresponding author

Correspondence to Marie K. Harder .

Ethics declarations

Ethics approval and consent to participate.

The research was conducted in accordance with the Declaration of Helsinki and has been approved by the Ethics Review Board of the University of Brighton, and national ethics committees for research in Indonesia and Senegal. Informed consent was obtained in the local vernacular language, Bahasa, French or Wolof. Participants retained a copy of the informed consent document for reference.

Consent for publication

Not applicable.

Competing interests

The authors declare no competing interests.

Additional information

Publisher’s note.

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Rights and permissions

Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article's Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article's Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/ . The Creative Commons Public Domain Dedication waiver ( http://creativecommons.org/publicdomain/zero/1.0/ ) applies to the data made available in this article, unless otherwise stated in a credit line to the data.

Reprints and permissions

About this article

Cite this article.

Chapman, A.J., Ebido, C.C., Tening, R.N. et al. Creating culturally-informed protocols for a stunting intervention using a situated values-based approach ( WeValue InSitu ): a double case study in Indonesia and Senegal. BMC Public Health 24 , 987 (2024). https://doi.org/10.1186/s12889-024-18485-y

Download citation

Received : 27 September 2023

Accepted : 29 March 2024

Published : 09 April 2024

DOI : https://doi.org/10.1186/s12889-024-18485-y

Share this article

Anyone you share the following link with will be able to read this content:

Sorry, a shareable link is not currently available for this article.

Provided by the Springer Nature SharedIt content-sharing initiative

• Health intervention
• Shared values
• Culturally-informed protocol
• Cultural factors
• WeValue InSitu

BMC Public Health

ISSN: 1471-2458

• Submission enquiries: [email protected]
• General enquiries: [email protected]

The case for compliance as a competitive advantage for banks

Consider this short tale of two banks: Acme Bank’s top-notch compliance function kept the bank within its risk appetite, but the bank did not perform well. Its strategy team blamed compliance for slow growth, weak market share, and failed digital initiatives. At Apex Bank, the strategy team bypassed compliance to release new products quickly, expand into new customer segments, and ramp up acquisitions, all while keeping costs low. Soon, though, its main regulator brought a significant enforcement action. The stock price fell, key employees quit, the bank had to exit several important businesses, and compliance costs skyrocketed.

While these descriptions are caricatures, they’re not far from reality. Strategy and compliance often operate as antagonists or as ships passing in the night. This is a missed opportunity. Done well, communication and collaboration between the two parties can create competitive advantage. The stakes are particularly high now: technology offers promise, but new risks are rising on uncertain economic and geopolitical landscapes.

This article explains the benefits available when compliance and strategy leaders work together, the quick wins that are possible, and the structural solutions that can sustain and scale the change. In this article, we use the word “strategy” as a metonym for the broader set of decision makers (not just the strategy organization) who influence and shape banks’ strategic direction; these include business unit leaders, leaders in marketing and sales organizations, and product managers.

Finding competitive advantage

Banks’ compliance functions have typically focused on defense: preventing violations of policy, rules, regulation, and laws. The more complicated the regulatory, business, and technological environment, the more complex the defense.

But in complex environments, collaboration with the business  can deliver greater strategic value . In our experience, five objectives that define strategic posture  are ripe for collaboration: differentiating client experience, investing in fast-evolving areas, securing resilience against geopolitical disruptions, improving productivity, and acquiring programmatically. In each, when compliance and business stakeholders responsible for strategic decisions work side by side, institutions benefit by protecting against the downside, capturing more of the upside, or both (exhibit) .

In working with banks around the world, we have seen examples of compliance and strategy collaborating on these five objectives, with varying degrees of success. Here we describe how the successful collaborations were achieved for each objective.

Differentiated client experience

In the increasingly digital world, customer experience is king , and products and services are scrutinized in the court of public opinion—online ratings and social media. Already in 2018, of the 50 largest global banks, three out of four were publicly pledging to initiate some form of customer-experience transformation . We have seen banks’ customer-experience transformations boost the lifetime profitability of satisfied customers—those willing to recommend the bank to friends—to levels five to eight times those of customers with a negative perception.

Banks need processes that deliver a good customer experience in the moment, treat customers fairly, protect against fraud, and comply with laws and other regulations. Poorly designed compliance processes can compromise the experience, but insufficient checks can open the door to fraud or other abuses. Deep collaboration by compliance and business teams can capture opportunities as well as protect the downside.

Poorly designed compliance processes can compromise the experience, but insufficient checks can open the door to fraud or other abuses. Deep collaboration by compliance and business teams can capture opportunities as well as protect the downside.

For example, in retail banking and payments, some consumers have negative experiences with identity verification; it can be confusing and take a long time. Frustrated consumers may even walk away from their bank. Strategy teams with expertise in identifying customer needs, meeting those needs, and differentiating value propositions by bringing together viewpoints from across the organization can work with compliance teams to identify the most critical needs and embed compliance requirements seamlessly into customer journeys.

In institutional banking, some customers experience similar frustrations from the intense and sometimes overlapping queries for information aimed at meeting the complex know-your-customer (KYC) requirements straddling jurisdictions. Certain KYC queries may add operational cost and could even deter large multinational clients from starting new banking relationships. Closer collaboration between compliance and strategy teams helps banks simplify the process in a client-centric and risk-informed way. Our research has found  10 to 30 percent improvement in customer satisfaction scores and 20 to 40 percent reductions of administrative touchpoints.

Compliance and strategy teams can also work together on continual improvement. Customer complaints can indicate compliance issues—for example, problematic sales practices—but also opportunities to improve customer experience. Thus, input on customer experience can serve as an early warning about possible compliance issues.

How to start

Compliance and business operations can together initiate a review of priority client-facing processes. The effort may identify opportunities for improving user experience through simplification or rationalization of controls—for example, by removing redundant or overlapping controls.

Banks that aspire to offer a standout client experience typically form cross-functional teams focused on rapid, agile execution. Practically, this would involve including compliance experts in the core of the agile approach and team configuration from the start. For processes related to customer onboarding, teams can include experts in compliance, technology, operations, strategy, and other functions. This equips the team to incorporate guidance on compliance requirements in the most client-friendly way.

One North American institution created a task force of senior banking executives, including the chief compliance officer, to design a smooth customer onboarding process across its capital markets businesses. The team first established clarity around regulatory requirements and then reengineered customer journeys and built a consistent experience across regions. The resulting process minimized requests for client information and decreased the risk of inconsistencies and conflicts in client data.

Investment in fast-evolving areas

Growth into adjacent or secondary industries offers financial services institutions strong opportunity, yet some of the most alluring domains are fraught with uncertainty related to compliance. 1 Our recent research finds that in financial services, 35 percent of growth comes from secondary industries or expansion into new ones. Companies that grow into adjacent industries generated, on average, an extra 1.5 percentage points per year of shareholder returns above their industry peers. https://www.mckinsey.com/industries/financial-services/our-insights/managing-a-customer-experience-transformation-in-banking This is especially true of areas in which some combination of technology, products and services, business dynamics, and customer expectations are evolving quicky. Strategists weigh the opportunity from potential investments against costs of competition or regulation. Compliance can shape ideas for coping with the regulatory uncertainty and suggest implications for various investment options.

New business opportunities linked to data and analytics exemplify an area that shows promise but presents new and sometimes uncertain compliance expectations. Some institutions are considering investing in or partnering with data and analytics players that provide credit decisioning tools. When decisions about credit extension are informed by or fully based on AI algorithms, banks will need to demonstrate the fairness of such decisions and their compliance with customer protection rules. Compliance teams can inform assessments of these requirements, such as required investments in controls and the AI talent required to interpret algorithms’ output.

Environmental, social, and governance (ESG) offerings are another area of potential opportunity for collaboration. Institutions that aspire to bring attractive ESG offerings to market need well-designed processes for product creation and maintenance. Basic criteria include factors (and underlying data) used to construct ESG investment products that are transparent and reflective of the investment objectives described in the prospectuses. Strategy teams play a key role in defining ESG product initiatives based on market dynamics and client needs. Compliance teams working with strategy teams can provide insights on alignment of ESG factors with the declared investment objectives and regulatory guidance, as well as the processes for monitoring product performance and informing customers.

Compliance and strategy could collaborate to articulate the largest regulatory risks associated with products or segments that are new to the industry, growing in importance, or being considered as a new focus. Examples could include analytics or digital payments.

Compliance officers could regularly share with colleagues the latest regulatory developments in this space, including potential implications for a bank’s planned investment actions, if relevant. In addition, banks should consider explicitly designating compliance team members who will be on point to provide strategically informed compliance insights on fast-evolving areas that the institution has prioritized for potential investment. These people would have the dual mandate of being compliance officers while advising strategists in areas where the bank is exploring the potential for growth or an inorganic investment thesis. Banks can even consider forming a small compliance advisory team to provide such input as needed in areas of strategic significance. This team might sit either within the strategy or compliance functions, with a dotted-line relationship to the other group.

Resilience against geopolitical disruption

For global institutions, geopolitical forces up the ante, particularly when laws or regulations shift quickly in response to countries’ foreign-policy stances. Institutions with an international footprint have complicated links between countries. Rarely can such organizations disconnect rapidly from any given country, not least because of compliance requirements. The strategy function may lack routines for systematically analyzing and understanding geopolitical scenarios.

For example, companies doing business in Russia or with Russian entities when it invaded Ukraine in early 2022 had to quickly translate the implications of the sanctions that many other countries imposed on Russia. Predefined playbooks for handling similar geopolitical shocks would accelerate response and reduce the probability of any outsize operational losses or regulatory fines that might create opportunities in the defensive quadrant of the values matrix.

Given recent geopolitical shifts, strategy teams may be well advised to start building a planning capacity, with compliance teams included. Those engaged with strategy at the senior level, with participation from the senior level of the compliance function, can systematically develop and analyze a set of geopolitical scenarios. For example, scenarios might include imposition of sanctions or quickly exiting a country.

Improved productivity

Collaboration to improve process productivity delivers impact primarily on the value capture axis of the matrix. For example, the compliance team can suggest the productivity initiatives (e.g., streamlining compliance controls, suggesting process simplification ideas based on compliance risk assessments) that could lead to significant impact on margin or revenue growth, given that prioritization of productivity initiatives is key for value capture.

When strategy teams design operational productivity programs, they balance effectiveness and efficiency levers across thousands of individual processes. Compliance organizations are uniquely positioned to support these efforts based on their observation of issues and challenges across the organization. In addition, the compliance team can help structure companywide communication flows on process and control streamlining opportunities. For example, they may have data and insights from security breaches, fraud, suspicious activity, and anti-money-laundering (AML) flags, as well as insights from control testing. These insights can inform where to eliminate, establish, or maintain manual checks; eliminate overlaps in the scope of reviews; or reengineer processes more holistically.

At the start of any productivity improvement effort, banks have an opportunity to include compliance as part of the core team. Similarly, when deploying the agile approach to identify opportunities, compliance officers can be core to the team structure from the start. This collaboration enables the team to review prioritized processes for opportunities to streamline compliance risk assessments and identified overlapping controls.

As the productivity program establishes baselines—for example, collecting data to prioritize the highest-impact products, businesses, and processes to start with—compliance experts can help with specifying data types and inputs needed, especially in areas such as control performance, key risk indicators, or customer complaint themes. For prioritizing productivity initiatives, compliance experts can contribute insights related to control testing or compliance risk assessment.

Stronger programmatic M&A

The compliance team can also help the strategy and M&A teams generate differentiated insights on mergers and acquisitions. In particular, collaboration can help strengthen programmatic M&A strategies , which generate excess returns relative to peers because serial acquirers tend to grow faster and more profitably. 2 Among companies with revenue CAGR over 5 percent, our research has shown, those with programmatic M&A strategies generate shareholder returns 3.5 percentage points higher than for those growing organically.

Collaboration on acquisition-related themes enables both offensive and optimizing strategies. Organizations can generate differentiated insights for upside capture, such as compliance criteria integrated in M&A sourcing filters. They also can pursue the dual benefits of upside capture and downside protection, such as collaboration on postmerger decisioning and planning.

Successful execution requires strong M&A capabilities, and the compliance function has a key role to play in each capability, including M&A sourcing, due diligence, and integration planning and execution. To enable programmatic M&A, compliance can help design filtering criteria so target identification excludes companies with suspicious clients or that operate in jurisdictions with weak regulatory infrastructure. Strategy and compliance teams should also collaborate to ensure the filters stay calibrated to existing market conditions.

Collaboration on due diligence can include pressure-testing strategic and financial assumptions linked to compliance. Key questions to consider for accurate valuation and assessment of targets’ business models are whether the market sizing assumes no new restrictive regulation of the target’s core product and what it will cost to bring a target’s financial-crime controls in line with those of the acquiring bank.

During postmerger integration and planning, the compliance team can be a partner in deciding the nature and level of integration. In our experience, companies do make compliance part of premerger planning but frequently as a stand-alone workstream. However, the maturity of a target’s control infrastructure often has direct bearing on the right approach to business, process, and system integration. For example, limited control infrastructure and a history of regulatory relationship challenges may prompt the organization to pursue greater integration across functions in order to migrate the target’s businesses to the acquirer’s more controlled and mature environment.

Consider integrating the compliance team into the entire M&A deal workflow. Bringing compliance into the M&A deal workflow can be a simple change. For example, compliance officers can become permanent members of the deal team across the full deal life cycle, including deal identification (refining investment filters with compliance factors), due diligence (leading compliance-specific deep dives), and integration (using control performance to generate insights on the integration strategy).

Structural solutions to sustain and amplify collaboration impact

Walk a day in my shoes.

Strategists and compliance officers have not been natural bedfellows. Strategists may not fully grasp compliance-related risks, while compliance officers may not understand in detail competitor moves or friction that spurs clients to reduce their business. But in the world that lies ahead, mutual understanding will likely be foundational for gaining a competitive edge.

Life as a compliance officer

The compliance role has grown as regulatory frameworks and compliance requirements proliferate. Since 2010, more rules have been issued by the four regulatory agencies (Federal Reserve, OCC, FDIC and CFPB) than in the entire period since the creation of the Federal Reserve System in 1913 to 2010. Compliance officers must translate every new requirement into digestible obligations, alter policies and procedures accordingly (often individually for each product, business, and geography), and help the business side understand these obligations in the context of their processes. Failure to do so can result in large fines to the company, restrictions on business, and even liability of individuals including senior executives and board members.

Compliance officers view their core mission as protectors, so the business’s goals of serving clients better, growing, or improving productivity can easily be perceived as resistance to the compliance function’s mission.

Life as a strategist

Unaddressed market forces continually deplete profits , so strategists try to create and capture economic and social value sustainably in the face of uncertainty. As the pace of innovation and disruption accelerates, strategists’ role becomes ever more intense. They rely on insights into key driving factors to formulate powerful strategy, deep interpersonal engagement and debate from senior executives, and a mutual understanding that the business is prepared and willing to act on a strategy once adopted.

While strategists could benefit greatly from the insights supplied by the compliance function, they often struggle to see past the technical language of rules and regulations. They will likely be better able to appreciate the larger meaning behind compliance if they have information synthesized into terms they can apply to their process of strategy formulation.

Three main obstacles tend to hinder systematic collaboration between compliance and business. First, the compliance function is sometimes seen as lacking full understanding of the business, so the idea of collaboratively finding creative solutions never arises (see sidebar, “Walk a day in my shoes”). Second, the operating model, organizational structure, and talent often are not set up to support meaningful engagement that would allow working together. Third, processes and technology generally have not been designed to unlock and sustain such collaboration. Acting systematically in these three areas, banks can sustain and magnify the impact of the initial actions previously described.

Culture of collaboration

Culture is a key determinant of shifts in the collaboration model, but it is arguably the hardest structural dimension to change in a sustainable way. Banks can prepare the ground for larger change by introducing microhabits that start with understanding each other’s vantage point. As with many other aspects of cultural change, building such understanding is a top-down process. Two microhabits are essentials for cultivating mutual understanding:

• The right tone from the top . Senior executives, including heads of the business and functional leadership, should be fully aligned on the principle behind the operating model and reinforce its importance in their communications, decisions, and actions.
• Collaboration at the C-level . An alliance between the chief compliance officer and the chief strategy officer enable their teams to meet the goals of collaboration. Without the chemistry and meeting of minds at the top, simple process interventions won’t deliver meaningful results.

Talent and operating model

Meeting the need for compliance talent skilled in collaboration and strategy requires the right approach to recruiting and upskilling (such as learning pathways and job rotations). From the recruiting perspective, compliance functions may need to reassess their usual criteria for senior compliance hires, such as a legal background, in favor of more diversification and cross-pollination on the team. Recruitment of compliance leaders should leverage the full diversity of the risk and compliance professionals in the industry. Our recent research  indicates that 90 percent of the risk and compliance professionals in our data set did not start in risk roles.

In addition, given that value creation primarily happens within business units, compliance and strategy activities should reflect the needs of business units. Strategy and compliance teams can explicitly align on how to jointly serve relevant business units where needed. Such upfront alignment can then be translated into tactics for collaboration.

Underlying technology

More modular and integrated tech and data infrastructure can enable connectivity between the strategy and compliance systems. More specifically, investments in workflow capabilities would allow both compliance and strategy counterparts to collaborate in real time, assign tasks to each other, and leverage common data sources. Ideally, such systems are capable of ingesting compliance-related input such as data regarding future regulatory scenarios, the potential impact of geopolitical events, and the impact of control failures on M&A integration. The systems then can incorporate this knowledge into major scenario-planning or business valuation tools.

For example, a bank may design a platform for risk assessments where strategy and compliance have access to the same modules and analyses. Such a platform would source the data from business unit systems and allow the compliance officers to see the compliance assessments carried out in real time. This would have an additional benefit: minimizing the time spent on low-value tasks (reconciling data or replicating the analyses, for example). Instead, the teams could focus on jointly prioritizing key risks and on collaborating to select and implement mitigating actions.

Banks have a strong opportunity to realize impact through collaboration between their compliance and business strategists. Quick wins are possible, but banks wanting to unlock the full potential of such collaboration must consider how to build systems, processes, and foundational capabilities that will enable them to scale up their collaboration.

Irakli Gabruashvili is an associate partner in McKinsey’s New York office, where Ishaan Seth is a senior partner; Olivia White is a senior partner in the Bay Area office; and Alexis Yumeng Yang is a consultant in the Seattle office.

Explore a career with us

Related articles.

Lessons from banking to improve risk and compliance and speed up digital transformations

The future of operational-risk management in financial services

World-first “Cybercrime Index” ranks countries by cybercrime threat level

Following three years of intensive research, an international team of researchers have compiled the first ever ‘World Cybercrime Index’, which identifies the globe’s key cybercrime hotspots by ranking the most significant sources of cybercrime at a national level.

The Index, published today in the journal PLOS ONE , shows that a relatively small number of countries house the greatest cybercriminal threat. Russia tops the list, followed by Ukraine, China, the USA, Nigeria, and Romania. The UK comes in at number eight.

‘The research that underpins the Index will help remove the veil of anonymity around cybercriminal offenders, and we hope that it will aid the fight against the growing threat of profit-driven cybercrime,’ Dr Bruce said.

‘We now have a deeper understanding of the geography of cybercrime, and how different countries specialise in different types of cybercrime.’

‘By continuing to collect this data, we’ll be able to monitor the emergence of any new hotspots and it is possible early interventions could be made in at-risk countries before a serious cybercrime problem even develops.’

The data that underpins the Index was gathered through a survey of 92 leading cybercrime experts from around the world who are involved in cybercrime intelligence gathering and investigations. The survey asked the experts to consider five major categories of cybercrime*, nominate the countries that they consider to be the most significant sources of each of these types of cybercrime, and then rank each country according to the impact, professionalism, and technical skill of its cybercriminals.

Co-author Associate Professor Jonathan Lusthaus , from the University of Oxford’s Department of Sociology and Oxford School of Global and Area Studies, said cybercrime has largely been an invisible phenomenon because offenders often mask their physical locations by hiding behind fake profiles and technical protections.

'Due to the illicit and anonymous nature of their activities, cybercriminals cannot be easily accessed or reliably surveyed. They are actively hiding. If you try to use technical data to map their location, you will also fail, as cybercriminals bounce their attacks around internet infrastructure across the world. The best means we have to draw a picture of where these offenders are actually located is to survey those whose job it is to track these people,' Dr Lusthaus said.

Figuring out why some countries are cybercrime hotspots, and others aren't, is the next stage of the research. There are existing theories about why some countries have become hubs of cybercriminal activity - for example, that a technically skilled workforce with few employment opportunities may turn to illicit activity to make ends meet - which we'll be able to test against our global data set. Dr Miranda Bruce  Department of Sociology, University of Oxford and UNSW Canberra   

Co-author of the study, Professor Federico Varese from Sciences Po in France, said the World Cybercrime Index is the first step in a broader aim to understand the local dimensions of cybercrime production across the world.

‘We are hoping to expand the study so that we can determine whether national characteristics like educational attainment, internet penetration, GDP, or levels of corruption are associated with cybercrime. Many people think that cybercrime is global and fluid, but this study supports the view that, much like forms of organised crime, it is embedded within particular contexts,’ Professor Varese said.

The World Cybercrime Index has been developed as a joint partnership between the University of Oxford and UNSW and has also been funded by CRIMGOV , a European Union-supported project based at the University of Oxford and Sciences Po. The other co-authors of the study include Professor Ridhi Kashyap from the University of Oxford and Professor Nigel Phair from Monash University.

The study ‘Mapping the global geography of cybercrime with the World Cybercrime Index’ has been published in the journal PLOS ONE .

*The five major categories of cybercrime assessed by the study were:

1.   Technical products/services (e.g. malware coding, botnet access, access to compromised systems, tool production).

2.   Attacks and extortion (e.g. denial-of-service attacks, ransomware).

3.   Data/identity theft (e.g. hacking, phishing, account compromises, credit card comprises).

4.   Scams (e.g. advance fee fraud, business email compromise, online auction fraud).

5.   Cashing out/money laundering (e.g. credit card fraud, money mules, illicit virtual currency platforms).

DISCOVER MORE

• Support Oxford's research
• Partner with Oxford on research
• Study at Oxford
• Research jobs at Oxford

You can view all news or browse by category

Swiss women win landmark climate case at Europe top human rights court

• Medium Text
• Human rights court: Swiss climate policies fell short
• Case brought against Bern by 2,000 senior Swiss women
• Mixed ruling as court throws out two other climate cases

CLIMATE LITIGATION ON THE RISE

The Reuters Daily Briefing newsletter provides all the news you need to start your day. Sign up here.

Reporting by Gloria Dickie and Kate Abnett; Additional reporting by Oliver Hirt, Dave Graham and Deep Vakil; Editing by Kevin Liffey, Richard Lough and Barbara Lewis

Our Standards: The Thomson Reuters Trust Principles. New Tab , opens new tab

Thomson Reuters

Gloria Dickie reports on climate and environmental issues for Reuters. She is based in London. Her interests include biodiversity loss, Arctic science, the cryosphere, international climate diplomacy, climate change and public health, and human-wildlife conflict. She previously worked as a freelance environmental journalist for 7 years, writing for publications such as the New York Times, the Guardian, Scientific American, and Wired magazine. Dickie was a 2022 finalist for the Livingston Awards for Young Journalists in the international reporting category for her climate reporting from Svalbard. She is also an author at W.W. Norton.

Kate Abnett covers EU climate and energy policy in Brussels, reporting on Europe’s green transition and how climate change is affecting people and ecosystems across the EU. Other areas of coverage include international climate diplomacy. Before joining Reuters, Kate covered emissions and energy markets for Argus Media in London. She is part of the teams whose reporting on Europe’s energy crisis won two Reuters journalist of the year awards in 2022.

Sustainability Chevron

Lufthansa offers concessions to gain EU nod on ITA takeover

German airline Lufthansa has offered concessions aimed at securing EU antitrust approval for its acquisition of a minority stake in Italian carrier ITA Airways, an update on the European Commission website shows.

• Share full article

For more audio journalism and storytelling, download New York Times Audio , a new iOS app available for news subscribers.

• April 14, 2024   •   46:17 The Sunday Read: ‘What I Saw Working at The National Enquirer During Donald Trump’s Rise’
• April 12, 2024   •   34:23 How One Family Lost $900,000 in a Timeshare Scam
• April 11, 2024   •   28:39 The Staggering Success of Trump’s Trial Delay Tactics
• April 10, 2024   •   22:49 Trump’s Abortion Dilemma
• April 9, 2024   •   30:48 How Tesla Planted the Seeds for Its Own Potential Downfall
• April 8, 2024   •   30:28 The Eclipse Chaser
• April 7, 2024 The Sunday Read: ‘What Deathbed Visions Teach Us About Living’
• April 5, 2024   •   29:11 An Engineering Experiment to Cool the Earth
• April 4, 2024   •   32:37 Israel’s Deadly Airstrike on the World Central Kitchen
• April 3, 2024   •   27:42 The Accidental Tax Cutter in Chief
• April 2, 2024   •   29:32 Kids Are Missing School at an Alarming Rate
• April 1, 2024   •   36:14 Ronna McDaniel, TV News and the Trump Problem

How One Family Lost $900,000 in a Timeshare Scam

A mexican drug cartel is targeting seniors and their timeshares..

Hosted by Katrin Bennhold

Produced by Asthaa Chaturvedi and Will Reid

With Clare Toeniskoetter and Lynsea Garrison

Edited by Brendan Klinkenberg and Michael Benoist

Original music by Marion Lozano ,  Rowan Niemisto ,  Dan Powell ,  Pat McCusker and Will Reid

Engineered by Chris Wood

Listen and follow The Daily Apple Podcasts | Spotify | Amazon Music

Warning: this episode contains descriptions of violence.

A massive scam targeting older Americans who own timeshare properties has resulted in hundreds of millions of dollars sent to Mexico.

Maria Abi-Habib, an investigative correspondent for The Times, tells the story of a victim who lost everything, and of the criminal group making the scam calls — Jalisco New Generation, one of Mexico’s most violent cartels.

On today’s episode

Maria Abi-Habib , an investigative correspondent for The New York Times based in Mexico City.

Background reading

How a brutal Mexican drug cartel came to target seniors and their timeshares .

There are a lot of ways to listen to The Daily. Here’s how.

We aim to make transcripts available the next workday after an episode’s publication. You can find them at the top of the page.

The Daily is made by Rachel Quester, Lynsea Garrison, Clare Toeniskoetter, Paige Cowett, Michael Simon Johnson, Brad Fisher, Chris Wood, Jessica Cheung, Stella Tan, Alexandra Leigh Young, Lisa Chow, Eric Krupke, Marc Georges, Luke Vander Ploeg, M.J. Davis Lin, Dan Powell, Sydney Harper, Mike Benoist, Liz O. Baylen, Asthaa Chaturvedi, Rachelle Bonja, Diana Nguyen, Marion Lozano, Corey Schreppel, Rob Szypko, Elisheba Ittoop, Mooj Zadie, Patricia Willens, Rowan Niemisto, Jody Becker, Rikki Novetsky, John Ketchum, Nina Feldman, Will Reid, Carlos Prieto, Ben Calhoun, Susan Lee, Lexie Diao, Mary Wilson, Alex Stern, Dan Farrell, Sophia Lanman, Shannon Lin, Diane Wong, Devon Taylor, Alyssa Moxley, Summer Thomad, Olivia Natt, Daniel Ramirez and Brendan Klinkenberg.

Our theme music is by Jim Brunberg and Ben Landsverk of Wonderly. Special thanks to Sam Dolnick, Paula Szuchman, Lisa Tobin, Larissa Anderson, Julia Simon, Sofia Milan, Mahima Chablani, Elizabeth Davis-Moorer, Jeffrey Miranda, Renan Borelli, Maddy Masiello, Isabella Anderson and Nina Lassam.

Katrin Bennhold is the Berlin bureau chief. A former Nieman fellow at Harvard University, she previously reported from London and Paris, covering a range of topics from the rise of populism to gender. More about Katrin Bennhold

Advertisement