Why Risk Culture Cannot Be Measured in Isolation

When organisations talk about improving risk culture, the conversation often turns quickly to measurement. Surveys are commissioned. Scores are benchmarked. Heat maps are produced. Results are tracked over time. Culture becomes something that can be quantified, monitored, and reported to the board.

This is appealing. Culture feels elusive. Measurement promises control.

The problem is that culture does not exist independently of the system in which people operate. When it is measured in isolation, it is almost always misunderstood.

Risk culture is not a property of individuals. It is an emergent feature of incentives, authority, information flow, and consequence. It is shaped less by what people believe than by what they experience. Asking people how they feel about risk, without reference to how decisions are actually made, produces data that is tidy but shallow.

This is why so many culture initiatives feel disconnected from reality. Survey results suggest moderate or improving scores, while behaviour tells a different story. Issues continue to be escalated late. Bad news is softened. Challenge is selective. Surprises still occur.

The measurement is not wrong. It is incomplete.

Culture is often treated as something that sits alongside governance, rather than something that is produced by it. Surveys ask whether people feel able to speak up, but not whether speaking up has ever changed an outcome. They ask whether risk is discussed openly, but not whether uncomfortable issues survive contact with senior forums. They capture sentiment, but not consequence.

As a result, organisations end up managing perceptions rather than dynamics.

This is particularly visible in high-performance environments. Where targets are demanding and success is highly rewarded, people may genuinely report confidence, clarity, and engagement. At the same time, they may also learn which risks are welcome and which are inconvenient. The culture is not dishonest. It is adaptive.

In such settings, culture scores can improve even as risk accumulates.

Another problem with isolated measurement is that it treats culture as stable. Surveys freeze a moment in time. But risk culture is highly sensitive to context. It shifts under pressure. It responds to leadership behaviour in specific situations. What people say they would do in principle is often quite different from what they do when delivery is at stake.

Boards often assume that a positive culture score implies resilience. In reality, it may simply indicate alignment. Whether that alignment is healthy depends on what the organisation is aligned around.

This is why risk culture cannot be separated from risk appetite. Appetite sets the boundaries of acceptable behaviour. Culture reflects how those boundaries are interpreted and enforced. Measuring one without the other produces misleading comfort.

It is also why culture cannot be divorced from escalation mechanics. If escalation routes exist only on paper, culture will adapt accordingly. If challenge is welcomed rhetorically but penalised informally, people will notice. No amount of training will override lived experience.

None of this is an argument against listening to employees. It is an argument against mistaking listening for understanding.

Culture measurement has value when it is used diagnostically rather than declaratively. It can surface tensions, inconsistencies, and points of friction. But it cannot, on its own, explain why those tensions exist or how they are resolved in practice.

The danger arises when culture metrics become targets. When improvement is expected quarter on quarter, the organisation learns what answers are safe. Culture becomes performative. The measurement starts to shape the behaviour it is meant to observe.

At that point, culture initiatives risk becoming another ritual. They demonstrate attention and intent, but they do little to change how risk is actually lived.

Boards seeking genuine insight need to ask different questions. Not “how do people feel about risk?”, but “what happens when risk is raised?”. Not “do people feel safe to speak up?”, but “what has happened the last three times someone did?”. Not “is the culture improving?”, but “where does the organisation still struggle to hear itself?”.

Risk culture is not something that can be extracted, scored, and fixed in isolation. It is the visible expression of how power, incentives, and information interact. Until those interactions are examined directly, culture will remain well-measured and poorly understood.

The challenge is not to measure culture more precisely, but to stop pretending it can be understood on its own.