In the second year of my country risk role at an Indonesian insurer, I sat in a senior management meeting where a proposed product was on the table. The credit risk was material, the operational risk was novel, and the regulatory positioning was ambiguous. I raised three specific concerns. The chief executive listened, nodded, thanked me, and approved the product. Two weeks later, when the proposal moved to the Risk Committee, my concerns were not in the materials. The committee approved unanimously.
Eighteen months later, the product produced the loss event the three concerns had predicted.
The failure was not technical. The risk analysis had been correct. The framework had been adequate. The reporting lines were documented. What had failed was the culture around all of it, the small, accumulated decisions that determined whose voice carried weight in the room, whose concerns made it into the materials, and what it cost professionally to say something the room did not want to hear.
After fifteen years inside risk functions across banking, insurance, and multifinance, I have come to believe most risk failures inside financial institutions are not technical. They are cultural. The frameworks have improved dramatically over two decades. The cultures around them often have not. The technical fixes do not solve what is broken.
Three cultural failures I see most often
These show up across institutions, sectors, and geographies. The institutions that have one of them often have all three.
- The marginalised CRO. The Chief Risk Officer reports to the Chief Financial Officer instead of the Chief Executive Officer. The CRO’s compensation is influenced by institutional profitability. The CRO is not part of the executive committee that decides strategy, only the one that reviews risks afterwards. Every piece of this signals to the rest of the organisation that risk is a function, not a counterweight.
- The rubber-stamp committee. The Risk Committee meets monthly. Materials are prepared two weeks in advance, reviewed by management, finalised by the chair. By the time the committee meets, the decisions have been made. Committee members ask polite questions. Minutes record consensus. The information that should have been challenged was never presented in a form that allowed challenge.
- The yellow flag problem. Risk officers learn, often through specific incidents in their early careers, what it costs professionally to colour something red. A red flag stops a deal, blocks a senior executive’s project, requires the institution to file an awkward disclosure. A yellow flag does none of those things. The same situation that should be red, the loan exposure that exceeds prudent limits, the operational gap that has not been remediated, the regulatory finding that has not been closed, becomes yellow, then amber, then “acceptable with monitoring.” The risk function learns to be polite. The institution accumulates the losses anyway.
Also Read: Why building a people-first work culture in HR tech matters more than ever in Southeast Asia
What healthy risk culture looks like
Three patterns separate the institutions where risk works from those where it does not.
The CRO sits at the executive table. Direct reporting to the CEO, not through the CFO. Part of the executive committee that decides strategy. Compensation independent of short-term performance. None of this is sufficient on its own. All of it is necessary.
Disagreement is rewarded. The institutions with the strongest risk cultures actively promote risk officers who, at some specific moment in their tenure, said something the room did not want to hear and turned out to be correct. The promotion is the signal. The rest of the function notices. The next time a difficult call needs to be made, more than one person is willing to make it.
Public losses are studied. When something goes wrong, the institution does a serious, written post-mortem, shared internally, that does not assign individual blame. It maps the decisions, the assumptions, and the cultural mechanisms that allowed the loss to happen. Institutions that do this once become institutions that do it routinely. The ones that do not accumulate the same loss patterns for decades.
What CEOs and boards should watch for
A small number of signals reliably indicate which side of this line an institution sits on.
How does the CRO leave a Risk Committee meeting? If the CRO consistently leaves more agitated than they arrive, the meetings are not working. The risk function is bringing issues the committee is not engaging with.
How long has it been since a risk officer was promoted on the strength of a specific disagreement? If the institution cannot name an instance, the message inside the function is that disagreement does not pay.
When the last significant loss event happened, what document existed afterwards? If there is no written post-mortem, or it was a defensive memo rather than an honest analysis, the next loss event is already in motion.
Also Read: The unspoken crisis: Are we building a new digital divide in agriculture?
The macro stakes
The conventional response to risk failure is to invest in technical infrastructure, better systems, more granular models, deeper reporting. Most of these investments are reasonable. None of them solves the cultural problem they often distract from. The institution that buys better risk software while leaving its CRO reporting to the CFO has spent money on the wrong layer.
The cultural changes are harder than the technical ones. They require uncomfortable conversations about reporting lines, compensation, and the unspoken rules about who gets to disagree. They cost executive capital. They produce no software contract to point to. They are also the only ones that consistently work.
After fifteen years inside risk functions, the institutions I trust most are not the ones with the most sophisticated frameworks. They are the ones where the risk officer in the back of the room is willing to interrupt the CEO, and where the CEO listens. Most risk failures, when you trace them back honestly, are cultural failures wearing a technical disguise. The institutions that figure that out, and act on it, are the ones whose risk function will be doing more than reporting when the next significant loss event arrives.
—
Editor’s note: e27 aims to foster thought leadership by publishing views from the community. You can also share your perspective by submitting an article, video, podcast, or infographic.
The views expressed in this article are those of the author and do not necessarily reflect the official policy or position of e27.
Join us on WhatsApp, Instagram, Facebook, X, and LinkedIn to stay connected.
The post The yellow flag problem: Most risk functions fail at culture before they fail at technique appeared first on e27.