NAIS - Developing a Risk Culture to Support School Mission and Vision

Inherently, risk is neither good nor bad. Rather, how we approach risk defines the result. We often associate risk with negative outcomes. Many dictionaries define risk as exposure to danger or as the potential for loss or injury. As children we’re taught that behaviors with dangerous consequences are risky. Media stories abound about people and organizations that took risks and suffered tragic consequences.

Undoubtedly, certain risks can lead to negative consequences. In the independent school world, there are many threats to the well-being of institutions and the students we serve. And it is crucial that we manage those risks. We need to identify, understand, and mitigate risks that could cause harm. At the same time, we must be open to risks that drive opportunity. Therefore, developing an intentional risk culture is equally as important as developing policies and practices that protect our students. Management consultant and educator Peter Drucker said that culture eats strategy for breakfast. This saying is applicable to risk as well. The culture we intentionally pursue will drive our approach to risk.

Diagnosing Your Risk Culture

According to the Institute for Risk Management (IRM), risk culture describes the values, beliefs, knowledge, and understanding about risk shared by a group of people with a common purpose, in particular the employees of an organization or teams or groups within an organization. IRM suggests that every organization should assess their current risk culture before taking steps toward building the strong risk management program they desire. This approach ensures that organizations are examining risk from two angles: harm prevention and opportunity. IRM has created a risk culture diagnostic, which a school can perform by asking these 10 questions:

What tone do we set from the top? Are we providing consistent, coherent, sustained, and visible leadership in terms of how we expect our people to behave and respond when dealing with risk?
How do we establish and maintain sufficiently clear accountabilities for those managing risks and hold them to their accountabilities?
What risks does our current culture create for the organization, and what risk culture is needed to ensure achievement of our goals?
Do we acknowledge and live our stated values when addressing and resolving risk dilemmas? Do we regularly discuss risk dilemmas in value terms and does it influence our decisions?
How do our structure, processes, and reward systems support or detract from development of our desired risk culture?
How do we actively seek information on risk events and near misses and ensure key lessons are learned? Do we have sufficient organizational humility to look at ourselves from the perspective of stakeholders and not just assume we’re getting it right?
How do we respond to whistleblowers and others raising genuine concerns?
How do we reward and encourage appropriate risk-taking behaviors and challenge unbalanced risk behaviors (either overly risk-averse or risk-seeking)?
How do we satisfy ourselves that new joiners will quickly absorb our desired cultural values and that established staff continue to demonstrate attitudes and behaviors consistent with our expectations?
How do we support learning and development associated with raising awareness and competence in managing risk at all levels?

Organizations with well-defined risk cultures will generally weather crises more effectively, as well as take appropriate risks during times of great change. Like having a vision to guide strategic decisions, a defined risk culture establishes guardrails that people can use when approaching any decision that has some level of risk.

What Defines an Effective Risk Culture?

Following the 2008 recession, many researchers sought to understand the DNA of the cultures that drove so many financial institutions to take risks that had such negative consequences. Deloitte suggested that the most effective risk cultures share the following attributes:

Commonality of purpose, values, and ethics: The extent to which an employee’s individual interests, values, and ethics are aligned with the organization's risk strategy, appetite, tolerance, and approach.
Universal adoption and application: Whether risk is considered in all activities, from strategic planning to day-to-day operations, in every part of the organization.
A learning organization: How and if the collective ability of the organization to manage risk more effectively is continuously improving.
Timely, transparent, and honest communications: People are comfortable talking openly and honestly about risk, using a common risk vocabulary that promotes shared understanding.

Most researchers agree that the process for developing the risk culture that an organization seeks begins at the top. Leaders must be intentional about how they view the role risk plays in achieving organizational priorities. For example, if the message from the top is that everything the school does needs to ensure the health and well-being of students and adults in the community, then the hiring process might reflect that and aggressively weed out predators. This same message of prioritizing well-being could also encourage teaching and learning practices that help students adapt to a changing economy, take healthy risks, and accept failures.

Schools also need to build a system of rewards and accountability to drive the risk behaviors they seek. If school leaders want faculty and staff to identify and pursue opportunity risks, what kind of reward system would they build to encourage questioning the status quo? One organization I know does this by sponsoring a Sacred Cow Hunt once a year in which staff members receive rewards (cash, days off, etc.) for identifying practices that inhibit growth or new initiatives that can drive innovation.

Mature risk management cultures use performance metrics to identify what is working and what’s not. The goal for a school operating at this level is to be in a continual learning mode and be ready to adjust whenever the metrics suggest an alternative course.

The threats to schools and their students are real and growing more complex, but opportunities abound as well. Developing a risk culture that works seamlessly with the school mission and vision can help us to approach risk wisely.