David Buck examines why many organizations struggle to embed effective risk culture despite significant investment in governance and oversight. He argues that incentives, behaviors, and decision-making processes have a greater influence on outcomes than p
Financial institutions may have spent years refining
governance structures, risk frameworks, and oversight controls, but many organizations
still struggle to embed risk culture into everyday decision-making where it
matters most.
That is the view of David Buck, Head of Enterprise
Risk Management at T. Rowe Price, who argues that risk culture only becomes
effective when it moves beyond reporting exercises and becomes embedded in the operating
rhythm of a business.
“The shift happens when risk stops being something
you report on and starts being something you actually do,” Buck said. “The organizations
that get this right integrate risk into their existing operating rhythm — their
planning cycles, their business forums, their deal approvals — rather than only
standing up separate risk committees that run in parallel to the business.”
Buck believes one of the strongest indicators of a
healthy risk culture is when executives openly challenge assumptions and discuss
uncertainty as part of routine decision-making rather than treating risk as a
separate governance activity.
“When you hear senior executives ask ‘what are we
trading off here?’ or ‘what could we be wrong about?’, it signals that
uncertainty is a legitimate part of the conversation,” he said.
Drawing on behavioral economics, Buck argued that
organizations should focus on designing processes that naturally encourage
risk-aware decisions instead of relying solely on mandates or compliance
structures.
“The concept of choice architecture suggests that if
you design decision processes so that risk-aware choices are the default, you
don’t have to mandate good behavior,” he said.
“You just make it easier.” Buck also warned that
many institutions continue to struggle when translating board-level risk
appetite statements into operationally meaningful metrics.
“The core discipline is cascading architecture,” he
explained. “Taking enterprise-level appetite statements, focusing on the most
impactful risks, and translating them into specific tolerances with defined
thresholds, owners, and escalation triggers.”
However, Buck cautioned that firms frequently fall
into the trap of excessive measurement, creating dashboards so overloaded with indicators
that they generate a false sense of control.
“A dashboard with hundreds of metrics that no one
acts on is arguably worse than no dashboard at all,” he said, “because it
creates the illusion of oversight.”
According to Buck, organizations that are most
effective at embedding risk appetite directly connect risk indicators to
business planning and resource allocation decisions rather than treating them
as governance exercises reviewed once a year.
He also stressed that policies alone are
insufficient to influence behavior unless employees find them practical and
relevant to daily work.
