The Understanding of Risk Culture Among Risk Management Practitioners.

Chapter 1: Introduction

Business leaders use risk management to identify and mitigate risk in their organizations

(Flitner, 2018). It is also a method that allows leaders to make decisions about speculative risk,

enabling organizations to take advantage of the upside of risk while also reducing the downside

of risk. The risk management process provides organizations with tools and policies to mitigate

risk and employee training regarding those policies. Unfortunately, many of these policies do not

align with the organizational culture, organizational climate, and performance management

systems. Levy et al. (2020) stated that cultural roots exist in many risk incidents. Therefore, a

unfortunate events. Still, they may not have understood the impact risk culture played in a

tragedy. For instance, Achampong (2010) showed that Penn State guided campuses to integrate

risk management and strategic planning. However, while the university employees focused on

implementing a risk management process that included strategic planning, a few senior-level

employees sat on information about the alleged abuse of a child on campus. Their inaction

allowed the exploitation of many more children and cost the university millions of dollars in

liability losses.

At NASA, there was excitement around the Challenger launch, but the temperature

conditions on the day of the launch increased the risk of failure of critical components of the

2

rocket (Kaplan & Mikes, 2016). Kaplan and Mikes (2016) outlined the attitude toward risk

management at NASA at the time of the catastrophe as a hindrance to business development.

Other cultural issues at NASA led to the key personnel ignoring the information to meet internal

objectives and allowed the launch to occur as planned. All passengers on the rocket died because

of that decision.

In 2015, Wells Fargo released its environmental and social risk management report while

employees were creating fake accounts for customers so the employees could meet unreasonable

performance expectations (Equator Principles, 2016). According to the Equator Principles (2016)

Academic literature refers to the corporate culture that provides the foundation for effective risk

management as risk culture (Agarwal & Kallapur, 2018; Ring et al., 2016; Storer, 2018; Viscelli

et al., 2017; Weston et al., 2018). Dekker (2014) showed that risk culture contributed to these

tragedies, but professionals widely misused the term. According to Agarwal and Kallapur

(2018), “Risk culture ties together enterprise risk management (ERM) and risk governance with

the understanding of risks, beliefs, and values” (p. 327). Kaplan and Mikes (2016) added that

Admitting that risk management is more art than science helps to introduce some

humility into the risk function—and to the standards that govern this function—that

3

should enable a company’s management function to become more reliable and more

effective. (Kaplan & Mikes, 2016, p. 9)

The term risk culture emerged from the financial crisis of 2007–2009 (Roeschmann,

2014). While many studies identified risk culture as a contributing factor to the financial crisis

(Bott & Milkau, 2018; Bugalla et al., 2012; Fritz-Morgenthal et al., 2016; Gontarek, 2016; Power

et al., 2013; Storer, 2016), there is no formal definition of risk culture in the literature and few

studies on how it is created or maintained (Agarwal & Kallapur, 2018; Pan et al., 2017; Ring et

al., 2016; Roeschmann, 2014; Storer, 2016, 2018; Viscelli et al., 2017; Weston et al., 2018).

behaviors in an organization and the systems that drive them. Leaders can manage those

behaviors by attending to the systems that they create (Ring et al., 2016). Schein and Schein

(2017) used the concept of safety culture to show that “many other possible reasons for assessing

a culture might lead to a different diagnostic and change process, using different kinds of tools

and models of change” (p. 253). Risk culture may provide answers to the many stories of

organizations that fail regardless of their investment in risk management policy and governance.

Academic literature shows a definite need for a standard definition of risk culture, but

there is little agreement regarding that definition (Agarwal & Kallapur, 2018; Ring et al., 2016;

Roeschmann, 2014; Storer, 2016, 2018; Unterrheiner, 2017; Viscelli et al., 2017; Weston et al.,

4

2018), which contributes to the problem of risk managers understanding of the impact of risk

culture. However, since Schein and Schein (2017) showed that observable behaviors relate to

culture, any definition of risk culture should include the same. Braumann (2018) stated that

managers must understand the impact of their behaviors on risk. Althonayan et al. (2012)

outlined a definition of risk culture that states the actions and decisions that determine risk

culture by tying it to the principles and values of an organization. Therefore, risk culture in this

context is the repeated, observable behaviors within an organization that drive the risk-based

decision-making of all employees.

lack adequate guidance for developing culture, and their scope needs to be expanded to include

the same. The Committee of Sponsoring Organizations of the Treadway Commission (2004) and

ISO (2018) aimed to create effective governance of risk, but they do little to provide a cultural

foundation to ensure the effectiveness of that governance. Kaplan and Mikes (2016) showed that

risk culture contributed to several disasters. Still, risk practitioners have little agreement on the

definition of risk culture (Agarwal & Kallapur, 2018; Ring et al., 2016; Roeschmann, 2014;

Storer, 2016, 2018; Viscelli et al., 2017; Weston et al., 2018). Kaplan and Mikes (2016) also

pointed out the ineffectiveness of risk identification because of recency bias.

5

Contributing to the gap between the understanding of risk culture and its impact on an

organization’s risk management program, many risk managers do not understand risk culture or

how to change it (Weston et al., 2018). Weston et al. (2018) found that 13% of risk managers

surveyed indicated knowledge of top organizational culture researchers such as Edgar Schein and

John Kotter. Schein (2016) showed the importance of risk culture by explaining how some work

units had strong norms and values that overrode an organization’s court-ordered safety

requirements. Roeschmann (2014) also noted an absence of Schein’s work in the risk culture

literature. Few authors have explored defining risk culture in the business context. A lack of

recommended future studies to determine the influence organizational structure elements have on

the effectiveness of risk management. Examining whether risk managers understand the impact

of risk culture on their risk management frameworks and how to change them will increase the

understanding of the conditions preceding risk management failures and increase the

effectiveness of the risk management profession.

Purpose of the Study

This qualitative, phenomenological research study aimed to examine the understanding

risk managers have regarding the impact of risk culture elements on the overall effectiveness of

6

an organization’s risk management practices. Semistructured, inductive interviews of risk

management professionals in the United States provided the data for the research.

There is limited research on the impact that culture has on risk management. Braumann

(2018) showed that cultural factors were essential to effective risk management, but there is little

research on the topic. Braumann (2018) stated, “research on cultural components is still at a

nascent stage due to the difficulty of accessing data and specifying a cultural phenomenon” (p.

261). Interpretive phenomenological research provides an avenue to specify the cultural

phenomenon that impacts an organization’s risk management.

culture and what types of tools they may use to assess their risk culture.

Research Question

RQ1. What is the understanding of risk managers relating to the impact of risk culture on

risk management practices?

Definition of Key Terms

Cultural elements. The shared assumptions, artifacts, and espoused values that exist

within a culture (Schein & Schein, 2017).

Enterprise risk management. Enterprise risk management (ERM) is a process that

allows a business to manage all key business risks and opportunities by applying risk

7

management concepts across organizational disciplines (Flitner, 2018). Enterprise risk

management builds on the traditional risk management process by identifying threats and

opportunities and providing an interdisciplinary approach to assess them.

Organizational culture. Organizational culture is the impact that shared assumptions,

artifacts, and espoused values have on an organization’s operations (Schein & Schein, 2017).

Risk. Risk has many different meanings across different contexts. In this study, risk

means the variability related to a future outcome (Flitner, 2018).

Risk assessment. Risk assessment is the process of identifying, analyzing, and evaluating

Risk management framework. The risk management framework provides the process

used to improve risk management across the organization (ISO, 2018).

Risk management policy. A risk management policy is a statement used by an

organization to set its risk management direction (ISO, 2018).

Risk manager. A risk manager is a professional practitioner of risk management whose

responsibility is to manage an organization’s overall risk management policy.

Chapter Summary

Risk adversely impacts organizations despite their best efforts to manage risk. Risk

culture plays a role in the ineffectiveness of some risk management policies, and the need exists

8

to examine whether risk managers truly understand how risk culture impacts their risk

management frameworks. This study will help close the gap in understanding between currently

used risk management frameworks and the impact of risk culture on those frameworks. The

literature review provides the current status of the literature on risk culture and outlines the

theoretical and conceptual frameworks for this study.

9

Chapter 2: Literature Review

This study aimed to determine the understanding that risk managers have regarding the

impact of risk culture on the risk management practices within their organizations. This literature

review discusses Edgar Schein’s research regarding organizational culture as a theoretical

framework for the study. A literature review on organizational culture sets the context for

discussing risk culture. Conventional risk management practices will follow the risk culture

discussion ending with an analysis of the risk management process to conclude this literature

review.

Risk culture impacts the effectiveness of risk management programs in most

organizations. Althonayan et al. (2012) found that 93% of businesses with effective risk

management practices were more successful in achieving corporate objectives. More

importantly, they found that “the presence of a robust risk culture inspires collaborative efforts to

achieve minimized total cost of risk, improved organizational performance, and emerging growth

opportunities” (Althonayan et al., 2012, p. 13). Further, Unterrheiner (2017) stated, “The often

overlooked and underappreciated element is that of the organizational culture and the impact it

has on the company’s response to risk” (p. 1). Businesses began formally practicing risk

management decades ago, but the acknowledgment that organizational culture has on risk

16

Risk Culture

Risk culture is not a new phenomenon, but there is little research on the concept. Sinha

and Arena (2020) distinguished between the broader organizational culture and the concept of

risk culture. The risk management function has yet to settle on its definition (Agarwal &

Kallapur, 2018; Viscelli et al., 2017; Weston et al., 2018; Wood & Lewis, 2018). According to

Thomya and Saenchaiyathon (2015), “The studies that show the linkage among organizational

culture, ERM, and organizational performance are rare” (p. 26). Ashby et al. (2012) identified 10

distinct definitions of risk culture, but they found one common thread. They found that “risk

risk identification.

Schein and Schein (2017) showed that in risk management (namely workplace safety),

work units have strong norms and values that often override new requirements of safety

programs imposed on them. According to Hillson (2013), “Risk culture can prevent the

appearance of condoning wrong behaviors, which can arise when leaders send inconsistent

messages on the level of acceptable risk” (p. 4). This phenomenon is why change management is

so difficult. People have risk tolerance and idea about what is safe and are willing to trust that.

However, according to Schein and Schein (2017), learning new skills allows workers to

17

collaborate with leaders to create change, which is more effective than imposing programs on the

employees.

Defining Risk Culture

Academic literature shows a definite need for a standard definition of risk culture, but

there is little agreement regarding that definition (Agarwal & Kallapur, 2018; Viscelli et al.,

2017; Weston et al., 2018). The lack of clarity around the definition of risk culture leads to

misunderstandings by risk practitioners. Risk culture is also difficult to measure because it is

internal and invisible (Hillson, 2013). Schein and Schein (2017) provided the use of observable

Schein (2017) and Hillson (2013). The definition adopted by Althonayan et al. (2012), where

they outline a definition of risk culture that states the actions and decisions that determine risk

culture by tying it to the principles and values of an organization, only addresses a small part of

Schein and Shein’s framework. According to Schein and Schein (2017), “We cannot rely on

behavior alone because it is always determined both by the cultural predisposition (i.e., the

shared perceptions, thoughts, and feelings that are patterned) and by the situation contingencies

that arise from the immediate external environment” (p. 13). Therefore, risk culture in this

context must include the elements of Schein and Schein’s definition.

18

Some researchers define risk culture as observable behaviors relating to risk, but Schein

and Schein (2017) provided a more productive framework for defining risk culture. Risk culture

is the impact that artifacts, espoused beliefs and values, and basic underlying assumptions have

on an organization’s attitude toward risk. This expanded definition allows risk managers to

assess situations with greater detail. Schein and Schein (2017) found a narrow approach to

culture to be problematic in investigating risk management failures. They stated:

Even though the analysis of accidents has shown repeatedly that they are caused by

multiple systemic events that may involve incorrect decisions by each party in the

investigator. Risk culture ties an organization’s enterprise risk management program to its

understanding of risk, beliefs, and values (Agarwal & Kallapur, 2018). Risk practitioners often

overlook the impact that those factors have on accidents.

Risk Culture as a Phenomenon

Many organizations with weak leaders still invest in risk management programs.

However, organizations with poor leadership show few signs of caring for their employees

(Panda & Gupta, 2001), countering their attempts to keep people safe. The contradiction between

weak leadership and investment in risk management creates confusion among employees. Still,

employees “create symbols to resolve confusion, increase predictability, and provide direction”

19

(Panda & Gupta, 2001, p. 5). This phenomenon can weaken the impact of the risk management

program.

Risk Culture Can Lead to Costly Failures

Organizations invest in risk management programs to reduce the likelihood of

occurrences that damage their assets, people, finances, and reputation. However, those

investments do not always pay off. Kaplan and Mikes (2016) stated:

Having studied many man-made disasters, we have found repeatedly that early warning

signs and risk information were available to operators and decision-makers in advance of

psychological safety and poor upward communication contributed to the disaster. The symbols

created by a lack of psychological safety in the organization created a situation where employees

were afraid to raise concerns about the mission.

Organizations that lack psychological safety struggle to have an effective risk culture.

Edmondson (2019) showed that a lack of psychological safety led to other significant

organizational failures at Volkswagen, Wells Fargo, Nokia, and the Federal Reserve Bank of

New York. She showed that fear-based leadership, unreachable goals, and a fear of failure are a

“playbook that invites avoidable, and often painfully public failure” (Edmondson, 2019, p. 60).

20

Organizations that set a culture where employees are afraid to speak the truth create an

environment where risks are not communicated to senior management and lead to costly failures.

Research on Risk Culture

There was agreement in the literature that there is little research regarding risk culture

even though it appears vital to creating an effective risk management program (Bott & Milkau,

2018; Viscelli et al., 2017; Weston et al., 2018). Also, Sheedy and Griffin (2018) found that “risk

culture is the intervening or mediating variable that explains why risk structures predict

outcomes” (p. 7). Still, they also indicated that their study was limited by context, and there was

risk management practitioners regarding its impact on their risk management programs.

According to Viscelli et al. (2017), “We find that organizations’ culture and an informal

approach to preparing for ERM’s launch may have contributed to its limited connection with the

strategic leadership of the firm” (p. 71). The following sections discuss the concepts of

conventional risk management and provide a context for the impact that risk culture plays in

their effective adoption.

While there is little research on the concept of risk culture, researchers provide insight

into organizations that effectively changed their risk culture. Agarwal and Kallapur (2018)

showed an improvement in risk management outcomes for an organization through concerted

21

efforts to improve their employees’ fundamental understanding of risk and create a safe

environment to elevate concerns. Their research showed that conventional risk management was

not, by itself, enough. However, the organization changed its risk management outcomes by

implementing cultural factors.

Conventional Risk Management

Companies invest substantially in risk management policies and risk governance. The

financial industry invests in quantitative risk measures, and other industries invest actively in the

risk identification and mitigation processes outlined in the Committee of Sponsoring

Conventional risk management aims to manage an organization’s pure risk, which Flitner (2018)

described as a hazard risk. In essence, pure risk has no upside. Either something bad happens (an

injury, fire, etc.), or nothing happens. An organization does not benefit from pure risk.

In this conventional approach to risk management, organizations manage risk in silos

without much collaboration between departments, and risk management occurs on an as-needed

basis (Williams, 2019). The approach applied rules, training, and compliance with management

processes to drive the risk management process. However, as Campbell (2015) points out,

governance and leadership make the process more effective. According to Fritz-Morgenthal et al.

(2016), “Experienced and responsible governance structure in place represents a good indicator

22

for an appropriate risk culture” (p. 78). Their results showed that strong governance might

provide a leading indicator of effective risk culture, but the authors admitted that their research

was simply a starting point.

One other limitation of conventional risk management is that it assumes that people are

rational. People make flawed assumptions about their ability to manage risks based on the past

and miss the momentum of a new crisis as it approaches (Funston & Wagner, 2010).

Organizations rely on decisions that they made in the past instead of considering alternatives that

limit their ability to manage risk. The success of risk management typically relies on the

intent of maximizing shareholder value” (p. 111). The goal of ERM is to break down

organizational silos to enhance the effectiveness of risk management practice. Levy et al. (2020)

showed how to create an effective ERM framework and stated that risk culture plays a “crucial

role in the execution of a company’s enterprise risk management strategy” (p. 8). Culture is

important to ERM as business units must be open to allowing risk management into their

operations (Flitner, 2018).

Enterprise risk management focuses on pure and speculative risk, which broadens the risk

management approach to include financial, operations, and strategic risk. Thomya and

Saenchaiyathon (2015) stated that ERM aims to provide better benefits to organizations.

23

Bogodistov and Wohlgemuth (2017) showed that ERM provides organizations with the routines

and processes to recover from uncertain events quickly. Hoyt and Liebenberg (2015) provided

“persuasive evidence that ERM can be used to increase the value of insurance companies” (p.

47). According to Callahan and Soileau (2017), “ERM creates value for firms including

improved performance management, improved risk-adjusted decision-making, enhanced board

oversight, improved capital efficiencies, and higher quality of strategic planning” (p. 125). The

focus on upside and downside risk allows ERM to reduce the risk of loss and provides

organizations with a framework to manage the risks they take to advance their enterprise.

create a risk management subcommittee. This change integrates risk management across the

organization.

ERM Frameworks

Several ERM frameworks are available to organizations to develop their risk

management program. While there are differences in each framework, they all serve the same

primary function. According to Lee and Green (2015), “ERM processes are used to identify,

assess, communicate, measure, and manage the multitude of risks facing an organization” (p.

195). One drawback of an ERM process is that it can be labor intensive when identifying all of

an enterprise’s risks.

24

This study used the International Organization for Standardization (ISO) 31000 standard

and the Committee of Sponsoring Organizations of the Treadway Commission (COSO) ERM

framework to explain the risk management process and to assess their adequacy regarding

guidance on risk culture. The Committee of Sponsoring Organizations of the Treadway

Commission updated its framework in 2017 to include more guidance relating to governance and

culture, but they only focus on behaviors when they discuss culture. International Organization

for Standardization identifies the organization’s culture as part of the internal context for risk

management but provides little guidance relating to assessing or developing a proper risk culture.

organization, such as project risk and strategic risk. Kegan and Lahey (2016) showed how

Suncorp Personal Insurance uses enterprise risk management to help the business make decisions

about the organization’s future and mitigate the risk of those decisions. The secret to the success

of the process was a culture where people are free to think openly without retaliation and

consider how risks create opportunities. According to Kegan and Lahey (2016), “The taxing

mental and emotional exercise requires capacities most people don’t develop in the course of

their regular lives” (p. 260). Suncorp Personal Insurance shows the value ERM can bring to an

organization, but many do not benefit from the process.

25

Impediments to Successful ERM

Many organizational issues keep ERM from being implemented and successful. Three

key issues are communication, leadership, and organizational culture (including the risk

subculture). For instance, a fully implemented ERM program requires department leaders to be

fully accountable for the risks of their operations (Flitner, 2018), and many leaders place a low

priority on risk management in pursuit of their other goals. Many leaders have performance goals

that may contradict risk management practices (i.e., sales, production). Pan et al. (2017) showed

that organizational leaders tend to have the same attitude toward objectives as their chief

risk management practices after a severe event. Still, they fail to create a robust culture because

they fail to address organizational artifacts and espoused values that limit the value of their

efforts.

Risk Management Practitioners

Risk management practitioners come from many backgrounds. About 80 universities in

the United States have risk management programs (Cohen, 2020). A review of the top programs

showed a need to integrate risk culture into the curriculum as there were no courses found that

identified risk culture as a topic. According to Cohen (2020), “The role is complex and requires a

wide range of skills” (para. 2). The skills that Cohen (2020) identified included communication,

32

Unfortunately, some organizations see the process as a one-time exercise, and the register

becomes outdated with the rapidly changing business environment.

Risk registers allow organizations to prioritize their risk management efforts based on the

impact and likelihood of identified risks. Based on this model, the scientific approach to risk

management allows organizations to avoid misallocating risk management resources. The risks

identified during the risk management process impact the effectiveness of risk registers because

the process can cause organizations to overlook critical hazards (Ivensky, 2018). The risk

register assigns an owner to an identified risk, which creates accountability and knowledge of the

Several researchers agreed that risk culture played a role in the development of an effective risk

management practice, but there was little research regarding how it was developed or maintained

(Agarwal & Kallapur, 2018; Pan et al., 2017; Ring et al., 2016; Roeschmann, 2014; Storer, 2016,

2018; Viscelli et al., 2017; Weston et al., 2018).

One area contributing to the gap in the literature is the lack of a standard definition of risk

culture (Agarwal & Kallapur, 2018; Ring et al., 2016; Roeschmann, 2014; Storer, 2016, 2018;

Unterrheiner, 2017; Viscelli et al., 2017; Weston et al., 2018). The varied definition of risk

culture contributes to a lack of understanding regarding its impact on risk managers since there is

33

no standard definition of the phenomenon. Risk managers may have varying experiences

regarding the impact of risk culture.

This study aimed to close a gap in the literature by gaining a perspective on whether risk

managers understand the phenomenon of risk culture and how to change it (Weston et al., 2018).

The study provided a foundation for future research on risk culture by assessing whether

experienced risk managers understand the impact of risk culture on their risk management

practices and whether they can explain their lived experience with risk culture. This study closed

the gap in the research toward a standard definition of risk culture, assessing the level of

that risk managers do not have a standard definition of risk culture, which reduces their ability to

identify and change risk culture. Many do not have the correct context, and their risk

management platforms suffer from this blind spot.

This literature review started by explaining organizational culture through the lens of

Schein and Schein (2017). Schein and Schein’s framework provided the foundation to identify

risk culture as an organizational subculture and showed how the elements of risk culture

impacted an organization’s risk management process. Finally, the literature review provided an

overview of the risk management process to provide context for the importance of culture in the

risk management process. The literature review provided insight into the research about how risk

34

culture impacts the risk management process and how risk culture is missing from multiple risk

management frameworks.

Organizations use risk management to reduce the uncertainty in their operations. They

can apply the process across disciplines and use it to create accountability for managing risk at

the board (or top executive level). Most organizations have a single individual responsible for the

risk management framework, but all members must manage risk. Failures in the risk

management process can occur even when it creates excellent risk-based decisions (Paté-Cornell

& Cox, 2014). Several risk management frameworks guide professionals in developing risk

good at assessing risk. They used tragedies such as the Challenger explosion and, through their

research, showed that a sense of psychological safety among members of the organization

provided more effective risk identification.

The literature review identified a gap in the research regarding studies relating to and a

definition of risk culture, leading to a lack of understanding of the impact on risk management

practice. This gap appears to contribute to a lack of understanding of risk culture among risk

management practitioners. It creates situations where organizations do not appreciate that impact

on their investment in risk management. Many studies identify the importance of risk culture, but

few show a framework or understanding of how risk culture is assessed and created. This study

35

contributes to the academic literature by identifying whether risk managers understand the

impact of the risk culture phenomenon and works toward future research to develop a standard

definition of risk culture.

36

Chapter 3: Research Method

This chapter aims to introduce the research methodology for this qualitative interpretive

phenomenological analysis (IPA) of the understanding that risk managers have regarding the

impact of risk culture on an organization’s risk management program. This study explored the

human side of risk management, so while most risk measures are quantitative, the measure of the

human factors involved in risk culture must allow for the participants’ subjective experiences

through their lived experiences. This chapter lays out the rationale for the choice of IPA, the

research plan, study participants, data collection, data analysis, and the trustworthiness of the

researcher to learn how individuals experience life (Smith et al., 2009). Edmund Husserl first

introduced the field of phenomenology to determine the “essence of phenomena through

people’s experiences of them” (Hopkins et at., 2017, p. 22). Interpretive phenomenological

analysis was first proposed by Smith (1996). It is prevalent in the psychology community,

producing hundreds of studies (Smith, 2010). Gill (2014) showed that while most

phenomenological studies are psychological, IPA can also have a business application, such as

showing how risk managers experience risk culture’s impact on their risk management actions.

This study aimed to understand the importance risk managers placed on risk culture in

their risk management programs. Phenomenological research allows the participants to express

37

experiences on their own terms (Smith et al., 2009). According to Hopkins et al. (2017),

“Phenomenology is an approach to research that turns to people’s experience to better

understand something” (p. 20). Phenomenological studies should be based on rich experiential

material (Adams & Anders van Manen, 2017). So, human experience is at the core of IPA

research and provides a rich context for the inquiry into the research questions.

This study intended to use the lived experiences of risk managers to understand the

impact of risk culture. This method is advantageous over other qualitative and quantitative

methods because it allows for the experience of the risk management professionals to guide the

organization’s risk management. According to Hopkins et al. (2017), “His (Husserl) aim in

developing phenomenology was to discern the essence of a phenomenon, but more specifically,

describe it” (p. 23). To make sense of the essence of a phenomenon, IPA uses a tool called the

hermeneutic circle (Peat et al., 2019). According to Smith et al. (2009), “It describes the process

of interpretation very effectively and speaks to a dynamic, non-linear style of thinking” (p. 27).

The hermeneutic circle makes IPA an iterative process instead of going through each step using a

linear, step-by-step approach. This process allowed me to understand many different data

perspectives (Smith et al., 2009).

38

Population

Study participants were drawn from a population of risk managers across different

industry sectors who held executive positions, such as vice president of risk management or chief

risk officer (CRO). The risk managers were full-time employees of their organization and had at

least 10 years of experience in an executive role, either in the c-suite or reported to a member of

the c-suite. Participants had different educational backgrounds, but all included had a bachelor’s

degree or appropriate professional designations such as the associate of risk management (ARM)

or the RIMS CRMP designation. These requirements provided the participants with enough

Sample

Interpretive phenomenological analysis is focused on small and homogenous samples

(Peat et al., 2019). Peat et al. (2019) recommended up to 10 participants for the study to conduct

a “detailed micro-level analysis of the participant’s response” (p. 8). Smith et al. (2009)

recommended between four and 10 participants for a doctoral study, but this study used 10 to 15

participants to reach saturation. The extra participants provided enough data if they provided a

rich, experiential account of their experience. However, if saturation was not reached during

those interviews, I followed up with the participants to gather more data about their lived

experiences.

39

Materials and Instruments

This study used semistructured interviews to collect data. I conducted the interviews

using the interview protocol found in Appendix A. The protocol followed the guidance of Smith

et al. (2009), and the design of the questions was open-ended, allowing the participant to have an

opportunity to tell their story. I conducted interviews through recorded video conferencing using

the software Zoom, which has the capability to transcribe the interviews to be copied into

Microsoft Word. I used NVivo to analyze the qualitative data. Consent was requested in writing,

and the participants’ privacy will be protected by keeping their responses confidential and

guided the direction of the interaction, with the goal of the interviews lasting between 30 and 60

minutes.

The interview protocol consisted of six open-ended questions with prompts for each

question. The questions provided insight into the research question without directly asking the

research questions. The goal was to ask questions that provided enough information to allow me

an opportunity to answer the research questions (Smith et al., 2009). I tested the interview

protocol using a focus group to review the questions and provide feedback.

Interpretive phenomenological analysis requires a verbatim transcription of each

interview (Smith et al., 2009). I recorded each interview and transcribed the interview using

40

Microsoft Word to memorialize the transcription. The transcript showed all words spoken during

the interview regardless of their applicability to the study. I also kept notes of any nonverbal

language that was important to the context of the study.

Qualitative Data Collection and Analysis Procedures

Interpretive phenomenological analysis can use numerous data collection techniques, but

the in-depth, semistructured interview is the most widely used method (Peat et al., 2019). This

study uses an in-depth, semistructured interview consisting of up to 10 participants. During the

fall of 2021, I contacted participants via email (see Appendix B) to potential participants.

56). I guided each conversation to uncover the lived experience of the participants relating to risk

culture’s impact on their organizations through the investigation of their understanding that risk

culture played in significant adverse risk management events from the participant’s experience.

Data Analysis

Existing literature on IPA does not prescribe a single method for data analysis (Smith et

al., 2009). Innovation is encouraged in the IPA data analysis process as there is no right or wrong

way, and it is not a linear process (Smith et al., 2009). The process was guided by Smith et al.’s

(2009) five-step process for data analysis for each transcript individually before analyzing the

entire study. Because innovation is encouraged, coding was approached inductively to allow the

41

participant’s experience to guide the data analysis. Any discrepant data will be archived, and it is

not expected to be used for this study. The first step was to read and re-read the written

transcript. This step aims to immerse the researcher in the data (Smith et al., 2009) and slow

down the data analysis. I read the transcription of each interview five times before moving to

step two.

The second step of the analysis was to note anything of interest in the transcript. This step

provides a deeper appreciation of how the participant speaks, talks, and thinks about an issue

(Smith et al., 2009). The analysis focuses on descriptive, linguistic, and conceptual comments,

this reorganization” (p. 91). This process allowed the themes to represent participant responses

and the researcher’s interpretation. The use of deductive coding limited the data analysis as

predetermined codes would not allow the participants’ experience to show up in the data

analysis.

The fourth step was to search for connections across themes. I mapped how I believed the

themes fit together (Smith et al., 2009). This step was not prescriptive, which allowed me to

innovate in developing the analysis (Smith et al., 2009). I assessed themes across the broad

categories of abstraction, subsumption, polarization, contextualization, numeration, and function.

48

This chapter summarizes the data obtained during the interviews. I interviewed 10 risk

managers during the data collection process. The themes that emerged from the interviews are

summarized, and I provided comments from the interview participants to support those themes.

Data Collection and the Research Question

I used semistructured interviews of 10 risk managers from different organizations to

collect data. The interviews were conducted via Zoom and were one-on-one interviews with each

participant. The interview participants had at least 10 years of experience in the risk management

profession and were responsible for administering the organization’s risk management program.

entire process:

RQ1. What is the understanding of risk managers relating to the impact of risk culture on

risk management practices?

The following participant profiles, interview summaries, and themes that emerged from the

interviews provide a context to guide a discussion regarding the research question.

Participant Profiles

I am providing participant profiles to provide a context for their lived experience. A

synopsis of their background in risk management and their journey to becoming risk managers

provides a deeper understanding of the emergent themes from the data analysis. Pseudonyms

49

protect the identity of each participant. Table 1 summarizes each participant and is followed by a

synopsis of each interview that includes the participants’ backgrounds. I did not identify

company names and the participant’s educational institutions to protect the participants’

identities.

Table 1

Manufacturing

Business

Food

Bachelors

Stewart

Sports and

Hospitality

Juris Doctorate

50

Liam

Liam decided to join the risk management profession in college, where he majored in risk

management and insurance. He indicated that his choice resulted from the recession in 2008 and

the availability of jobs in the insurance and risk management profession. He started his career in

the insurance industry as a risk analyst and moved into corporate risk management later in his

career.

Liam’s current role is in the manufacturing sector, and he discussed products liability as

the organization’s leading exposure to risk. Two significant events that impacted his company

and risk management processes. Liam also discussed other organizational culture issues, such as

leadership turnover, toxic cultures at some of the plants, and resistance to change. Liam

described a situation where he attempted to implement a new claims management system, and

the leader at one plant would not use the system. I asked him how he approached that individual

to sell the change, but he did not directly answer. He admitted that he pushed the change through

after the leader left the organization.

Joey

Joey did not intend to work in the risk management profession after college. He earned a

degree in human resource management but took a job with an insurance company handling

51

workers’ compensation claims. After six years in the insurance industry, Joey took his first role

as a risk manager in the public sector. Before becoming the risk manager for a large furniture

manufacturer, he had another job in the public sector.

Joey discussed a claim that occurred earlier in his career when he was a risk manager in

the public sector. The claim involved a child in their care (custody) and control of his

organization and who was seriously injured. Joey discussed how the organization had risk

management policies that should have prevented the incident, but they were not effective in that

division.

faced a lot of resistance to any change he tried to implement.

Stacey

Stacey started her career in risk management right after college, where she majored in

business administration (she later earned a Master of Business Administration). She indicated

that a friend worked for a large insurance company and helped her get a job. She was successful

in that job, but she accepted a job as a risk analyst with a publishing company after three years.

She spent 10 years in that role and then accepted her current role with a global manufacturing

company.

52

Stacey shared a significant occurrence resulting from a contractor getting into a motor

vehicle accident in her organization. Stacey answered most of the interview questions from a

traditional risk management perspective, where she discussed insurance coverage, claims

management processes, and managing contracts. After some probing, some organizational issues

with selecting contractors were discussed. She indicated that many of their employees would hire

their friends for contact work and that the contractors did not always have the proper contracts to

cover their exposures.

Stacey was the only interviewee to believe that subcultures did not impact the

a big-three consulting firm and then took a position with her current employer in accounting. She

worked with Sarbanes Oxley compliance and had the opportunity to work with the risk

management team in that role. After some time in her role, she was offered the lead risk

management role in the organization.

Annie discussed a boating accident where the organization lacked adequate control over

mergers and acquisitions and unintentionally maintained the ownership of a boat. Annie

indicated that she did not think the organization had adequate risk management controls before

the event. She said that the prior risk manager had a background as an insurance agent, so most

53

of his work focused on insurance procurement, which led to gaps in the enterprise risk

management process.

Annie discussed some of her work to improve the organization’s risk culture. Still, she

did not offer specifics about how they attempted to accomplish the change outside of training

and providing information. Annie said that her organization rotates leaders and that sometimes it

creates problems with implementing and executing their risk management program.

Mason

Mason planned to be a lawyer in college but took a job in insurance after graduating with

management practices before the accident were lacking, and they had to make some changes

after the event. He mentioned that some risk managers spend too much time focusing on claims

management and do not do enough to be proactive.

Mason did discuss the priorities and focus of an organization driving the lack of risk

management policies. He said that there was a belief that risk management may slow down the

business and keep them from achieving their objectives. In addition, Mason and I discussed

when he was trying to implement change in an organization. The organization was slow to

change, which caused him some issues with the implementation.

54

Stewart

Stewart is an attorney who started risk management through the contract review process.

He started his risk management career in the insurance industry and transitioned to corporate risk

management in the professional sports and hospitality industry. He discussed holding positions

with organizations with a rich history and a new organization.

Stewart discussed incidents with accessibility to his organization’s venue as an event that

significantly impacted the company. He explained that these events were unforeseen, and the

events involved several internal and external stakeholders that led to a claim against the

with the decision-makers to make the program successful.

Kaden

Kaden began his career in law enforcement. While working in law enforcement, he

completed a master’s degree in accounting. After he retired from law enforcement, he began a

second career in the risk management profession. He started working for an insurance company

during the Great Recession, and his accounting work during that time grew into a risk

management role.

During the interview, Kaden discussed an operational risk that led to a massive financial

loss for his organization. He discussed the reputational impact the incident had on the

55

organization and how the incident occurred. He admitted that they had effective risk

management practices to avoid these situations, but they were ineffective in this part of the

organization. He discussed the fact that one division implemented a program outside of the

organization’s tolerance for risk, and he believed that it stemmed from business relationships that

the leader had before working for his current employer.

Kaden talked at length about how his organization attempted to hold division leaders

accountable for the organization’s risk culture. They had performance measures built into annual

reviews tied to bonus compensation. He discussed the long journey to implement the program

He later obtained a master’s degree in enterprise risk management, which grew into executive

roles in risk management.

Ryan discussed an acquisition that had a significant impact on the organization. He

indicated that the acquisition had a significant negative impact on the company’s reputation and

finances. He also discussed how the acquisition harmed the organization’s culture and its

willingness to take future risks. Ryan said that they were implementing risk management

practices in other parts of the organization that would have reduced the negative impact of the

acquisition. Still, they were not implemented at the time of the event.

56

Ryan said that this event helped advance the enterprise risk management program at his

organization because it showed value to the leadership team. They worked hard to implement an

enterprise risk management program across the organization. The leadership support helped

make the program effective because leaders who did not engage in the process were not retained

on staff.

Lily

Lily has a bachelor’s degree in industrial relations. She said that she fell into risk

management and insurance. She was working for a large bank early in her career, and her

program. Lily also spoke at length about how the event impacted their insurance procurement

process.

Lily discussed how her organization is growing rapidly through acquisition early with the

organization. She said they did not have good risk management processes for acquiring

businesses. However, they changed their approach since the incident. She said they assess the

business culture they plan to acquire and make sure that the business can fit into their corporate

culture while also maintaining their current culture that allowed them to be successful.

57

Bruce

Bruce has a bachelor’s degree in strategic management. He began his career in risk

management 30 years ago when he worked for a hotel chain. Since then, he has worked in risk

management in the private sector. He is very active in professional risk management

organizations and spends a lot of time discussing his professional development.

Bruce discussed a workplace incident that resulted in a fatality that significantly impacted

his organization. He went into detail about the risk management programs they had to prevent

the incident and why those processes did not work. He discussed a lack of engagement by

positions in the organization.

Themes

Three themes emerged during the coding of the data. The themes included traditional risk

management, leadership and change, and organizational culture. The participants did not identify

any of Schein and Schein’s (2017) three elements of organizational culture by title, but they did

identify the concepts of each element. I presented the leadership theme in many contexts in

detail. The traditional risk management theme focused on the risk management process, claims

management, and contractual risk transfer. Table 2 shows the themes, corresponding codes, the

64

Bruce also mentioned that a change in mayor every couple of years at a public entity where he

worked harmed their risk management program.

Leadership Skills. Two participants indicated that poor leadership skills impacted their

risk management programs. Liam mentioned a leader who was not getting results and how his

replacement helped his organization succeed. Bruce saw poor leadership impacting the safety of

the employees at his organization. Annie also ran into situations where poor leadership impacted

her risk management program.

You know, not clear guidelines and instructions. Failure to adhere to policies, procedures,

million company to close to a $3 billion company in that period. And when you have

change that occurs that rapidly and you expand. You have a lot of people who, you know,

haven’t mentally made the jump from, you know, we’re kind of a small almost mom and

pop operation to okay, we’re starting to play with the big guys. And when you’re starting

to play with the big guys, the rules do change, and you need to start doing things

differently; you need to have a lot more.

Joey discussed an incident where the organization overpromised to a customer, which led to

some bad products making their way through the risk management process and causing claims

65

for the organization. Lily also discussed that rapid growth had a significant impact on the risk

management program at her organization.

Stacey combined the challenges that come from turnover and change. She worked for a

large organization with high turnover and said, “I think it is difficult implementing change is

very difficult, especially in large organizations, and especially during times like these because

there is a lot of turnover.” Stacey referenced communication and executive support as necessary

to help overcome these obstacles.

Partnership. Six participants discussed the importance of building partnerships with

Joey agreed that it takes time to build relationships in an organization. However, he

believed that laying the groundwork early can positively impact the risk management program.

He said:

And once you build those relationships, you know you can coexist with the processes and

policies and help, but you know it; I hate to say it is not an excuse, it takes such a long

time to build those relationships, so you are involved.

Stacey agreed that building relationships helped with the effectiveness of the risk management

program.

66

But I think we have a lot of respect within our organization in general, and I’ve seen this

across the board, you know, from when I first started out and risk management, until, you

know, today. It’s really, you know, building up that trust and respect and, you know,

communicating your processes, so that when that happens, that, you know, you, they

know what to do.

Ryan added that the partnership impacted the effectiveness of his risk management program as

well, saying, “So, from that point to making them risk owners or be more aware of the risk-based

decision making, that was a huge shift.”

the subculture’s impact on their risk management programs by sharing experiences across

divisions and other silos in their organization.

Artifacts. Four of the participants referenced artifacts of organizational culture in the

interviews, but none of them used the term artifact. Two of the references focused on the union

environment and how it impacted the organization. Both Liam and Annie discussed issues

relating to managing people because of union relations. The other artifacts mentioned in the

interviews focused on the organization’s maturity. Stewart discussed the differences between

working for mature organizations and a start-up. Additionally, Ryan discussed how it was hard to

implement risk management programs in his organization because of its maturity.

67

Underlying Beliefs. All the participants identified underlying beliefs during the

interviews, but none used the term. Joey discussed how implementing risk management

programs at his organization was difficult because of two underlying beliefs. He discussed how

many employees had a long tenure with the organization and did not believe they should be told

what to do. He also referenced the attitude toward leadership turnover, stating, “We will just go

with his because you know it will change soon.”

Liam discussed the challenges of bringing new people with new knowledge into his

organization. There were long-held beliefs of the tenured employees in his organization, which

risk management programs. He said, “I remember when I took over my last role. You know,

there was this old, like, oh, you know, people do not like to change here, and you got to just be

careful and, you know, take it slow.”

Other participants discussed the beliefs that their organizations held toward the discipline

of risk management. They discussed a dynamic where leaders and employees viewed the risk

management process as a hindrance to business development. Ryan discussed how the leaders of

different subsidiaries felt about risk management. He said:

68

So, at the end of the day, it boils down to the group of leaders within each subsidiary, so

they had a few of them who were mentally opposed to the concept of enterprise risk

management because they are generating money.

Mason had similar experiences to Ryan. He said, “There’s a lot of competing priorities around

things like this, and so risk management does not want to be the thing that is slowing the

business down.” Stacy added:

That’s the biggest thing I find that the biggest challenge for risk management is really,

you know, arguing with the business over, taking the cost-cutting aspect of it for using

resume outside of the company.

Stewart felt that there were beliefs in his industry that made risk management difficult. He said,

“I wonder if this is just not common in all hospitality.” Lily discussed the challenges of mergers

and acquisitions and uncovered the beliefs that came with the organizations her company

purchased.

Espoused Values. Eight of the participants discussed the espoused values’ impact on

their risk management programs, but none of the participants used the word espoused values.

Annie discussed the organization’s values of keeping its customers healthy and secure. She felt

that these values supported her risk management program. Stewart added that his organization

69

valued customer experience over sales, which helped him implement risk management programs.

While Annie and Stewart benefited from the corporate values, Ryan did not have the same

experience. He said, “There was a lack of a common mission” that impacted the organization’s

culture and his risk management program.

Lily discussed how they onboard new organizations into theirs when they acquire them.

She said:

When we bring in new companies into the fold when we do acquisitions, we have a much

more robust integration process that makes it make things a little easier with this

Subcultures. All the participants discussed subcultures’ impact on their risk management

programs. The respondents focused on the impact of organizational silos. Liam discussed the

issues that they have at one plant in their organization. He said:

But every single person in the organization will point to that plant and say that is the

problem. They are the only ones who they just cannot seem to get anything done. That

does not matter if it is HR [human resources], does not matter if it is legal, regulatory

risk, you know finance, they are going to go their own way, and for whatever reason, we

cannot seem to stop that.

70

Stewart added that his organization had large silos, and some departments’ communication was

better than others. He said, “I do find within those silos that some communicate better than

others with your department.” Ryan added, “Information was collected in silos, but not every

function or not every member within the organization who had to sell that purpose back to

them.” Kaden discussed communication issues in the silos as well. He said, “Huge, huge cultural

differences (between divisions), massive, we all speak English, but we do not all think English

the same way.”

One of the participants saw differences in the effectiveness of their risk management

used to overcome the issue of silos. Ryan’s organization used cost allocation to create

accountability for risk management. They allocated the cost of claims to the different

subsidiaries in their organization. He said, “So that that is holding company level of capital

allocation and transparency in terms of low resource allocation that happened across the

enterprise without siloed decision-making.” Lily added that her organization successfully

implemented a program that provided national oversight. They did not have it when they started,

but the implementation of national oversight had a strong impact on their risk management

program.

71

Gaps Closed by the Results

The results of this study closed some of the gaps in the current risk culture literature. The

results showed that risk managers could articulate Schein and Schein’s (2017) levels of

organizational culture that impact their risk management programs. While none of the

participants have read or studied Edgar Schein’s (2016) work, they spoke about his theory’s

three levels of organizational culture. However, questions remain about the ability of risk

managers to assess the organizational culture and eventually change it. Additionally, the

participants who mentioned risk culture in the interviews struggled to define it. Past research

the transcripts from semistructured interviews. The themes included traditional risk management,

leadership, and organizational culture. The participants’ responses provided a rich context for the

study and allowed a detailed discussion of the research question.

The themes provided a view, from the lived experience of the risk managers, into the

factors that they believed impacted the effectiveness of their risk management programs. The

risk managers provided examples of leadership, risk culture, and other factors that impacted their

risk management programs. The risk managers discussed the issues in leadership, risk culture,

and the other factors in the context of a significant loss that their organizations suffered. Probing

72

questions allowed me to develop a deeper understanding of the lived experience of the

participants.

The participants in the study had diverse backgrounds in risk management and worked

for diverse organizations, which added to the depth of information obtained during the

interviews. The differences in background, education, and experience allowed their lived

experiences to provide a deep insight into risk managers’ understanding of risk culture.

73

Chapter 5: Discussion, Conclusions, and Recommendations

The role of risk culture on the effectiveness of an organization’s risk management

program can be significant. Weston et al. (2018) found that the risk managers who participated in

their survey did not understand risk culture or change it. Other researchers found that a lack of

clarity in the definition of risk culture also led to inconsistency in risk management effectiveness

(Agarwal & Kallapur, 2018; Ring et al., 2016; Roeschmann, 2014; Storer, 2016, 2018; Viscelli et

al., 2017; Weston et al., 2018). This interpretive phenomenological analysis study used

semistructured interviews to understand the lived experience of risk managers.

This chapter will discuss the findings and their relationship to the research question. I

will also provide implications for the practice of risk management and recommendations for

future research.

Discussion of Findings

The findings of this study provide a rich context for how risk managers experience risk

culture, how they assess risk culture, and their awareness of its impact. Study participants

showed varying levels of their understanding of risk culture. Some of the participants focused on

the core roles of traditional insurance. They had a difficult time discussing the elements of risk

culture, and others discussed the impact of culture but had a challenging time defining it, which