Supervisors on Supervision

“People need to feel they have to do things differently and feel the pain in order to really change. All the countries that have adopted some of our work have also experienced some kind of pain, like Australia, a couple of countries in Europe, and the New York Fed. In Canada, it was slower; I think their financial industry is very easygoing. 

On one hand, it's so obvious, and everybody says it's culture. But to make it tangible and actionable, it has to be owned on the board level and by the executives. Somebody has to step up and say, ‘We need to drive this in a very serious manner.’ 

But as a psychologist, I would say the pain isn't big enough for people to take this on and make it happen.”

“The biggest challenge at the DNB was always that our deep-dive [culture and behavior] review approach, where we zoomed in and got a lot of depth, was difficult to scale. We were able to find a way to scale with our annual risk-profiling and identification process, but I definitely would've liked to do more.”

“In the last decade, a majority of supervisors have adopted a focus on behaviours such as leadership, decision-making, and escalation. In order to manage behavioural risks and change undesired behaviours, one needs to dig deeper to be able to understand why people behave in a certain way — i.e., what drives them.

A distinction between supervisory approaches can be made, whether the focus is on (1) formal drivers and/or (2) informal drivers of behaviour. Formal drivers refer to the ‘tangible’ side of the organisation — i.e., how it is ‘set out on paper.’ These include the more structural elements such as those reflected in organisational charts, job descriptions, hierarchical reporting lines, standard operating procedures and incentive schemes. 

Informal drivers refer to the ‘intangible’ side of an organisation, that which is not written down on paper or openly voiced. It is often referred to as the unwritten, unspoken rules of an organisation. Informal drivers include, for example, social relationships, perceptions of the work climate, and the beliefs and values that people hold. Formal drivers are more tangible and more easily accessed by supervisors. They therefore require less specific expertise from supervisors than that which is necessary to gain systematic insights into the informal drivers of behaviour. 

In my view, it is almost impossible to assess the informal drivers of behaviour based solely on tangible information such as frameworks, policies or controls via off site activity. Conduct — and misconduct — follow partly from formal systems, such as incentive schemes and ‘tone from the top,’ but far more powerfully so from informal influences obtained by observing ‘what actually happens’ among close colleagues. We rely on interaction with other people for ‘social proof’ that our behaviour is ‘normal’ — that is, in keeping with group norms. These norms shape our individual and collective identities, setting and re-setting what we see as boundaries of acceptable and expected behaviour. Employees in a firm experience the same standard-setting of norms for the workplace.”

“Risk culture, like organizational culture, is usually the aspirational side. It's about who we want to be and how we want our people to behave. Risk culture is part of your organizational culture, and there's no big distinction between them. It's simply a way of zooming in on day-to-day risk management behavior.

As a regulator, you should ask institutions to think about their culture — who they want to be. But at the same time, you, as a regulator or as a risk function within an organization, also need to understand the behavioral risks. The distinction I always make is between the aspirational culture you want to have and the reality of the issues you're working on. 

Is the term ‘risk culture’ helpful? No, I think people find it confusing. ‘Behavioral risk’ is becoming more common, but people are not always familiar with it. The aspirational side of culture provides an escape for people to avoid talking about the real issues. I'm generalizing, but HR loves to talk about the aspirational side of culture, and they're allergic to anything that has to do with risk. 

However, for people in the risk function, which is a harder business to discuss, they're much more comfortable talking about risk. In that context, the language and perspective of behavioral risk are incredibly important.”

“[In the Netherlands] one of the lessons that could be drawn from the financial crisis and major incidents in the financial sector is that employee behaviour and culture greatly affect the soundness, risk profile and integrity of financial institutions. Answers had to be sought in employee behaviour, going beyond organizational structure and processes.”

“In recent years it has become increasingly clear that studying behaviour has a predictive quality with regard to future performance. 

Behavioural problems often already exist before problems in the performance of the organization come to light. Therefore, by identifying and tackling ineffective behaviour and an unhealthy culture at an early stage, major financial and non-financial risks can be prevented. 

Behavioural Risk Management uncovers structural behavioural patterns at work within an organization that might lead to financial as well as non-financial risks. By thoroughly analysing behavioural patterns in the organization, we develop tailor-made interventions that mitigate and — eventually — prevent behavioural risks. 

Early intervention can mitigate risks in a more timely way and help to prevent future problems. Where people used to look back more, nowadays, there is more value attached to looking ahead, and people are increasingly aware that the capacity to examine behavioural risk is an important asset in this respect. 

In the end, we all want the same outcome: reduced financial and non-financial risk and a healthy, high performing organization. If that requires insight drawn from behavioural science, most people are actually quite keen to explore how this adds value.”

“I think a legal framework is incredibly important because I see it as a hygiene factor, but it needs to be in order because the majority of people we work with — accountants, lawyers, or economists — are used to having everything anchored in some kind of regulation, guidance, or legal framework. It's incredibly important because it legitimizes that it's part of the role. 

The majority of institutions understand that this is part of a supervisory role. However, the institutions that really push back on this are always the ones that have the most behavior and culture issues. So, in those situations, when you are entering a very hard fight as a supervisor, it's incredibly important to have your legal framework in order and right, so you don't get sucked into a legally weaponized discussion with that institution.”

“Supervisors should make use of machine learning tools, developed and trained in a manner that incorporates behavioural science. These technologies produce actionable insights by sifting through existing data sets, found within: audit systems, accounting records, internal policies, and external regulatory compliance reports, and the multitude of ‘digital artifacts’ produced by employees in the course of their daily routines. 

Marrying behavioural science, network analysis, and complexity theory, and fuelled by data reflecting both the formal and informal interactions within organisations, such AI-driven tools offer a scalable and automated means by which supervisors may identify behavioural risk profiles consistently across the industry, allowing for proactive horizontal peer review. These tools transform supervisory capabilities and allow us to act on leading indicators of risk.”
 

“I would say having that discussion at a global supervisory level would be incredibly valuable because supervisors need to be helped to understand why this is important. It should be evident in the prudential role that you play, and for a conduct regulator, the same applies: this taps into why this should be part of your role and responsibilities to address as well. 

On a global level, we should initiate a capability — thinking of an organization like the BCBS — with enough mandate and expertise to truly standardize an approach that can be rolled out across different countries. This would create a global standard for how to do deep dives and for the annual risk identification process, allowing for an industry-wide view. You need to have both of those capabilities. 

There should be a global structural capability to develop and implement this approach across countries, which could then be done in different phases. This is important, along with having ownership within a global group that drives these developments.”