Risk culture is the glue that binds all elements of risk management infrastructure together. It reflects the shared values, goals, practices and reinforcement mechanisms that embed risk into an organization’s decision-making processes and risk management into its operations. However, risk culture is an enigma in many organizations. We agree it is important when someone asserts its significance − even though we may not be sure exactly what it is or what to do about it if it requires improvement.

This issue of Board Perspectives: Risk Oversight looks at how the use of self-assessment techniques, internal surveys, focus groups and other methods can help an organization understand its current risk culture state.