Responsibility instead of regulation – risk culture lays the foundation for effective governance in the lending business

What exactly is risk culture and what elements does it include?

Risk culture describes the collective way of thinking, norms and behavior in dealing with risks at all levels of an institution. It is therefore far more than just a set of rules, it is the behavior exhibited in everyday life, which is reflected in decisions, communication behavior and leadership style.

The ECB defines risk culture as the combination of formal governance structures (e.g. guidelines, processes, control mechanisms) and informal behavioral patterns (e.g. decision-making behavior, group dynamics, communication style). This culture works under the surface – comparable to the invisible part of an iceberg – and has a significant impact on whether strategies and processes are actually implemented effectively.

Figure 1: Visible vs. invisible components of risk culture

Why is risk culture of strategic importance in the lending business?

The lending business is characterized by complex decisions that have to be made in an area of uncertainty. Business interests (e.g. sales, profitability) meet controlling functions (e.g. back office, risk controlling). Risk culture becomes evident when different interests collide.

Typical conflicts in the lending business include:

• business pressure vs. risk awareness
• sales targets vs. compliance
• efficiency vs. documentation requirements
• return vs. sustainability

This area of tension is not only unavoidable, it is essential for a healthy balance between business success and risk awareness. The risk culture bridges the gap between strategy and operational implementation and creates a consistent framework for responsible action and for risk handling.

Figure 2: Risk culture bridges the gap between strategy and implementation

Which four levers does regulation provide for an effective risk culture?

The Minimum Requirements for Risk Management (AT 3) call for management boards to develop and promote a proper risk culture. This responsibility covers all levels – from the management board to employee level – and also applies to outsourced processes and the group level. Supervisory authorities are increasingly drawing conclusions about the risk culture from procedural deficiencies, even if these initially only affect individual subprocesses. In audit practice, such shortcomings are gradually leading to sometimes significant findings in the risk culture area.

Based on the EBA Guidelines on internal governance, the ECB has identified four key levers:

I) Leadership and “tone from the top”

Managers shape the culture through their behavior, communication and decisions. They set standards for risk-conscious action and create trust. The “tone from the top” substantially influences whether employees address risks openly, take responsibility and feel confident to address critical issues.

II) Communication, challenge and diversity

An open culture, discussions and diverse perspectives prevent groupthink and promote well-founded decisions. Diversity in knowledge, experience and perspectives strengthens risk competence and improves the quality of decisions.

III) Accountability for risks

A clear allocation of responsibilities is essential. Employees must know and fulfill their role in risk management, especially along the three lines of defense (first line, second line, internal audit). Escalation mechanisms, transparent decision-making processes and a positive error management culture are key elements of a responsible organization.

IV) Incentives and remuneration

Remuneration systems should be in line with the bank’s risk strategy and long-term objectives. Variable remuneration must be risk-adjusted and avoid false incentives. Non-financial incentives, such as further training, career paths or recognition, also promote risk-conscious behavior and strengthen intrinsic motivation.

How is the risk culture implemented in the lending business?

Risk culture does not unfold its effect in concept papers or guidelines, but where risky decisions are actually made, especially in the lending business. This business area in particular shows whether cultural principles are embraced or whether they take a back seat to operational constraints. The following three examples are taken from typical everyday situations in banks and illustrate how the risk culture is or is not adopted.

I) Sales and risk – a structural conflict of objectives

In many institutions, sales is a key driver for the lending business. Employees are often remunerated based on their performance, which leads to a strong focus on sales figures. At the same time, they often lack an in-depth understanding of the risk dimensions. As a result, risks are not always assessed with the necessary objectivity when granting loans, especially if there are long-standing and emotionally charged customer relationships.

Cultural challenge: Being close to the customer can lead to employees neglecting or not escalating risks. In such contexts, an active risk culture means that employees openly address and objectively assess risks despite their proximity to the customer – even if they feel uncomfortable.

II) Error management culture and willingness to escalate

There is an implicit fear of making errors in many banks – especially in the lending area, where wrong decisions can quickly lead to financial losses. Employees avoid escalating risks or asking critical questions for fear of personal consequences.

Cultural challenge: A strong risk culture promotes a speak-up mentality: risks are addressed at an early stage, errors are seen as a learning opportunity and escalations are not a sign of weakness, but of a sense of responsibility.

III) Communication and transparency

The way in which risks are discussed – both internally and externally – has a significant impact on the risk culture. Non-transparent reporting, sugarcoated credit templates or selective communication are symptoms of a weak risk culture.

Cultural challenge: Transparency must be actively promoted through clear reporting structures, open feedback formats and communication that does not downplay risks, but honestly specifies them.

How can the risk culture be specifically enhanced based on actual practice?

The above examples from the lending business show how strongly the risk culture depends on behavior, communication and the routines established in the institution. But how can this culture be specifically developed and what can be used as a guide?

In its guidelines, the EBA describes specific requirements and recommended measures for credit risk culture, which are understood as good practices from a supervisory perspective. They serve as a guide for institutions to develop a structured risk culture and establish it effectively.

• Implementation of a dashboard for measuring the culture
• (Semi-annual) self-assessments and risk culture plans
• Integration of risk-related KPIs in target agreements
• Training on speak-up culture and psychological safety

At the same time, the supervisory authority identifies red flags that indicate cultural issues:

• Concentration of power in a few people
• Lack of escalation and sanction mechanisms
• Culture of fear and lack of error management culture
• Unethical behavior without consequences

These points clearly show that a lacking or weakly developed risk culture has a direct impact on the quality of decisions, the controllability of risks and ultimately on the stability of the institution. Where misconduct is not penalized, escalations are omitted or risks are systematically downplayed, banks produce a cultural vacuum that undermines governance structures.

Even if a risk culture often takes effect in hiding, it is by no means abstract – it is measurable and can therefore be shaped in a targeted manner. It determines whether governance only exists on paper or is actually effective in everyday life. A clearly formulated mission statement on risk culture forms the basis for this: it provides orientation and motivation, defines expectations in terms of attitude, communication and decision-making behavior, and serves as a cultural compass for the entire organization.

Using suitable measurement models, institutions can systematically record and assess the risk culture and use it as a basis for control and change. This way, both cultural and structural dimensions are visualized. These dimensions include, for example:

• Psychological safety
• Autonomy
• Leadership
• Team spirit and resilience
• Communication and awareness
• Compliance and acceptance of rules

Figure 3: Extract from the zeb measurement model for risk culture

Based on these findings, banks can develop targeted measures, such as management coaching, role workshops or culture guides, to build on strengths and effectively address areas of cultural development.

What is our conclusion on the importance of risk culture?

Risk culture is not just nice to have, but a strategic success factor. It works beneath the surface – in attitudes, routines and decision-making behavior. A strong risk culture combines governance with responsible action and creates the framework for sustainable, risk-appropriate action in the lending business.

The further development of the risk culture requires leadership, clarity and courage and thrives on the active participation of all employees. A consistent framework for responsible action can only be created if culture, strategy and implementation are dovetailed.