17% of your people would sabotage your business

What does managing corporate risk mean to you? In most large organisations, particularly financial services ones, it’s mostly about processes and oversight structures designed algorithmically to detect fraud, prevent safety violations, or predict and circumvent human error before these end up as a crisis.

Culture, more than rule books, determine how a company behaves

Of course, it makes sense to manage risk actively.  Cock ups and criminality trash value and even destroy companies. But process is a small part of the picture. Everyone knows it’s people that cause the problem. We even have a name for it; ‘risk culture.’ But if that’s true, it’s also people that prevent bad stuff happening, or at least act swiftly to limit the damage when it does.

In other words, the beliefs and behaviours of employees either expose you to risk or save you from it. As Warren Buffett says “culture, more than rule books, determine how a company behaves.”

But the general view is that people are pretty weird and unpredictable. Certainly, most organisations seem peculiarly unable to get them all pointing in the same direction.

Yet, it turns out that something over 90% of people in your organisation are remarkably predictable. And the rest you can probably do without.

“Over 90% of human beings in a typical organisation are motivated not by self-interest but by a sense of joint and meaningful endeavour.”

Chuck away your preconceptions about carrots and sticks and the theory of the rational actor and the evidence is pretty compelling.  Once their basic needs for comfort and safety are met, just over 90% of human beings in a typical organisation are motivated not by self-interest but by a sense of joint and meaningful endeavour. Call it purpose, if you like. Of course, if you choose not to provide that sense of shared meaning, or you choose to undermine people’s sense of safety, people will default to self-interest. That’s fine if you want people to perform purely simple binary tasks. But it’s deeply ineffective if people have discretion and agency in what they are doing. It’s also a horrible way to avoid risk.

Which is why a clear and authentic purpose, at the heart of strategy and the lived experience of employees, resolves a lot of the problem of a poor risk culture.

Health check: operative words in the sentence above are ‘authentic’ and ‘lived’. This is not a quick fix. It’s not about ‘having’ a purpose and sticking it on all the mouse mats (do they still make those?).  One thing that surprised us in our research across global companies was the extent to which organisations can achieve high purpose recognition amongst employees and still leave them entirely untouched in how they feel and behave. It’s abundantly clear that, in truly purposeful companies in which purpose is engaged in driving strategy and supporting human performance, purpose is truly alive in the experience of everyone in the business.

The key question therefore is ‘if that’s the key to effective risk management, how do you create a lived and experienced purpose?’ Our research shows that genuinely purposeful companies seem to have three key attributes embedded in their cultures that turn out to be critical in managing risk.

People care because they belong

Firstly, these companies exhibit a culture of ownership and responsibility that makes people, at every level, care because they belong. They own. Which means when something damaging happens or is likely, they care enough to do something about it because, emotionally, it is theirs. Emotional ownership appears to have a direct impact on both engagement (do I care?) and autonomy (enough to do something about it myself). And the easiest thing to feel ownership of is a purpose to be proud of.

They can articulate what the organisation believes in

Secondly, these organisations have in their purpose a clear articulation for what the organisation believes in, that this is inspiring to people whilst also being credible and congruent to what the business does for a living. And, critically, they have a commitment to authentically apply that purpose in how the business behaves and how decisions are made. That clarity of purpose cuts through confusion and guides how people behave and how decisions are made, right down the organisation, with laser-clarity and with real velocity. That means when damage occurs people are more likely to know how to respond and do so quickly.

They have built an environment of trust and compassion

Thirdly, and most critically, they have built an environment of trust and compassion. Which means  people feel able to act for the good of the company and not to keep their heads down or protect their position because they fear ridicule or blame. In every company we have assessed, a big difference in trust is one of the key discriminators between a company where purpose is lived, against one where it is stated.

And critically, these cultural factors appear to work together.

I’m clear about why we do what we do, I’m proud of it and feel responsible for its success, and I’m not afraid to act on it to protect it and see us succeed.

Purpose is not a statement. It’s a living culture based on clarity, trust and ownership. If you don’t invest the time and energy in creating these cultural underpinnings to your purpose it will have minimal impact on your people. And that matters a great deal when it comes to managing risk. If I don’t really get ‘why’, if I don’t feel I belong or if I feel scared I’m spectacularly unlikely to bother to do much about it when I see a risk of harm to the company or respond quickly and in the right direction to reduce the damage.