Risk Culture and Precision Management Maturity Models

As regulators increasingly encourage firms to adopt stronger culture and conduct risk management strategies, those firms are likewise looking for guidance as to what programs, systems, and metrics they might adopt to meet these new expectations successfully. Regulators say they are reluctant to provide explicit guidance—for many, out of fear that firms will simply respond with some check-box exercise.

But if regulators can’t or won’t define what kind of information will serve as evidence that a firm has taken the correct proactive measures, then what are the firms to do? Most are unwilling to risk taking some new approach that has not won broad industry adoption, and they are understandably reluctant to make investments that may prove to be unnecessary, or unwise. As a result, innovation in culture and conduct risk governance is sidelined or delayed, giving an appearance of foot-dragging on the part of firms. It is a text-book case of what economists might call a “collective action” problem: no one wants to do it unless everyone else does as well.