Daniele GianellaMaking Risk Culture Measurable: Why Banks Now Need More Than Governance Structures
Banks have invested heavily in processes, control systems, and governance structures in recent years. That is necessary. But it is not enough.
Because risks do not arise only from missing policies, unclear processes, or inadequate control systems. Risks arise above all where people make decisions under uncertainty: in management committees, in teams, in customer relationships, in escalation situations, and in day-to-day dealings with responsibility.
That is exactly why risk culture is moving further into the focus of banking supervision. The European Central Bank makes it clear that effective governance is not only a question of formal structures. It also depends on how leadership works, how openly critical issues are addressed, how roles are lived, and whether decisions are based on reliable information.
For banks, this leads to a central question:
How can risk culture be not only described, but actually measured and managed?
Risk culture is more than a regulatory buzzword
Risk culture describes how an organization deals with uncertainty, responsibility, and potential negative developments.
It does not show up in mission statements, but in everyday work:
- Who raises risks early?
- Who takes responsibility?
- Who challenges decisions critically?
- Who dares to voice uncomfortable observations?
- How do leaders react to mistakes, warning signals, or dissenting opinions?
The whitepaper “How evidence-based culture evaluation makes banks safer” describes risk culture across several dimensions: governance, resilience, data quality, accountability, decision-making capability, and steering capability. These dimensions make it clear that risk culture cannot be viewed in isolation. It connects structure, behavior, leadership, and decision quality.
A bank can have clearly defined responsibilities on paper. But if employees do not speak up about risks, if leaders do not allow critical discussions, or if escalation paths are not used in practice, the organization remains vulnerable.
The ECB is taking a closer look
In 2024, the ECB launched a consultation on a new guide to governance and risk culture. The aim is to specify expectations for banks and further develop the existing supervisory framework. The focus includes effective management bodies, clear roles for control functions, a strong risk culture, and robust risk appetite frameworks.
What is particularly important: the ECB explicitly notes that deficiencies in governance and risk culture can lead to poor decision-making processes, an imbalanced trade-off between risk-taking and risk control, and risks to capital and operational resilience.
This turns risk culture into a strategic topic. Not only for Risk, Compliance, or Internal Audit. It is also relevant for HR, People & Culture, leadership development, and transformation.
Because if risk culture is created through behavior, it must also be measured and developed there.
The problem: culture often stays too abstract
Many banks know that culture matters. But they struggle to capture culture in a concrete way.
Often it remains at the level of general surveys, workshops, or qualitative assessments. These provide valuable signals, but they are often not enough to manage in a targeted way. Banks need answers to very specific questions:
- In which areas is there a lack of clarity around accountability?
- Where is there too little critical challenge?
- Which teams have a weak escalation culture?
- Where is there a gap between leaders’ self-image and how others perceive them?
- Where is psychological safety missing, so risks are not raised openly?
- Which roles are filled by people whose competencies, motivations, or behavioral patterns do not optimally match the requirements?
This is exactly where the gap between governance on paper and lived risk culture in day-to-day work emerges.
From role requirements to behavior
The banking.butHuman platform addresses an important point: banks face the challenge of systematically making today’s and tomorrow’s role requirements, competencies, and potential visible. This is not only about recruiting, but about a holistic employee journey: from staffing new roles to development, to matching people, competencies, and future requirements.
This is especially relevant for banks because roles in banking are changing significantly. Digitalization, new regulatory requirements, changing customer expectations, demographic shifts, and new ways of working mean that classic job profiles are often no longer sufficient.
A bank needs to know:
- Which competencies do we need today?
- Which skills will become relevant tomorrow?
- Which people have potential for new roles?
- How can we steer development proactively, instead of only reacting to gaps?
But role and competency management alone does not answer the question of risk culture. For that, an additional perspective is needed on behavior, personality, leadership quality, collaboration, and decision-making capability.
This is where bluquist complements the approach.
How bluquist operationalizes risk culture
bluquist makes human potential visible through assessments, 360° feedback, competency models, personality traits, team profiles, and analytics. This turns an abstract culture concept into a manageable development field.
In the context of banks, bluquist can make risk culture measurable on several levels:
At the individual level, it becomes visible how people decide, communicate, take responsibility, deal with uncertainty, or react under pressure.
At the leadership level, a 360° assessment shows whether a leader’s self-image matches the perception of colleagues, team members, or managers. These discrepancies are particularly valuable because they reveal blind spots.
At the team level, patterns can be identified: Is there psychological safety? Are risks raised openly? Are roles clear? Does collaboration work across silos?
At the organizational level, dashboards enable an aggregated view: Which areas show anomalies? Where is a challenge culture missing? Where do red flags emerge? Where are targeted development measures needed?
The whitepaper describes this contribution very concretely: bluquist can operationalize risk culture through questions about leadership behavior, risk awareness, speak-up behavior, resilience, role understanding, and the perceived effectiveness of control functions. This is complemented by 360° assessments, analytics dashboards, and concrete measures such as development plans, coaching, debriefings, or role-based recommendations.
This means culture is not reduced to a “mood check”. It becomes a data-based steering instrument.
360° feedback as an early warning system
One particularly strong lever is 360° feedback.
Many organizational risks do not arise because nobody knows about them. They arise because they are not voiced. Or because leaders believe their communication is clearer, more open, or more effective than it is actually perceived.
A 360° assessment can make these perception gaps visible.
Example:
A leader rates themself as decisive and open to critical feedback. The team, however, experiences the leader as hard to approach and strongly controlling. For a bank, this is not only a leadership issue. It can be a risk issue.
Because if employees do not dare to bring critical information forward early, decision quality suffers. If control functions are not taken seriously, structural weaknesses emerge. If escalations are interpreted as personal failure, risks remain invisible for too long.
360° feedback can identify such patterns early, before they turn into real governance problems.
Dashboards make culture steerable
The next step is aggregation.
Individual assessment results help with personal development. But for banks, it is especially valuable when patterns can be identified across teams, functions, countries, hierarchy levels, or roles.
Dashboards can answer questions such as:
- Where is perceived decision quality low?
- Which areas show low clarity of accountability?
- Where do self-image and external perception differ most?
- Which leadership levels encourage speak-up behavior, and which do not?
- Which teams show high resilience but low psychological safety?
- Where is there an increased risk that critical information will not be escalated?
This means risk culture is not only assessed retrospectively. It can be actively developed.
This is a key difference: classic governance reviews often identify whether structures exist. A data-based culture evaluation shows whether those structures become effective in behavior.
The benefits for banks, customers, and employees
A strong risk culture is not an end in itself. It has a direct impact on stability, trust, and performance.
For banks, it means better decision quality, higher resilience, clearer responsibilities, and a stronger link between strategy, risk appetite, and behavior.
For customers, it means greater safety, more reliable services, and a more responsible approach to risks and data.
For employees, it means clearer roles, more open communication, and more psychological safety when dealing with mistakes, uncertainty, and critical issues.
This last point is crucial. An organization can only deal responsibly with risks if people feel safe enough to speak up about them.
HR becomes a partner in risk steering
This creates a new role for HR and People & Culture.
Risk culture is not only the responsibility of Risk Management, Compliance, or supervisory bodies. It is also a question of leadership, competencies, motivation, team dynamics, and development.
HR can support banks in strengthening risk culture systematically:
- through valid assessments
- through clear competency and role models
- through 360° feedback for leaders
- through data-based development programs
- through team diagnostics
- through dashboards for decision makers
- through targeted coaching and debriefing
This turns HR from an administrative partner into a strategic driver of a more resilient bank.
Conclusion: the safer bank starts with measurable behavior
Governance structures remain important. Control systems remain important. Data quality, escalation paths, and clear responsibilities remain indispensable.
But they only unfold their effect when people live them in everyday work.
That is why banks must measure risk culture where it is created: in the behavior of leaders, teams, and employees.
An evidence-based culture evaluation links regulatory requirements with human reality. It shows whether responsibility is truly taken. Whether critical issues are addressed openly. Whether leadership provides orientation. Whether decisions are made on a solid basis. And whether a bank is resilient not only formally, but culturally.
The future of risk culture therefore does not lie in even more abstract mission statements. It lies in better data about human behavior, and in the ability to derive concrete development from that data.
Those who make risk culture measurable do not just make banks fit for regulation. They make them safer, more capable of learning, and more future-ready.
Sources
- Culture evaluation for banks – “How evidence-based culture evaluation makes banks safer”, bluquist whitepaper. In particular, content on governance, resilience, data quality, accountability, decision-making capability, steering capability, and bluquist’s contribution to measurability, 360° assessment, analytics, and concrete measures was used. https://bluquist.com/whitepaper-banking
- European Central Bank: “ECB consults on governance and risk culture”, press release dated 24 July 2024. The ECB describes the new draft guide on governance and risk culture, expectations for management bodies, control functions, risk appetite frameworks, and the relevance of governance and risk culture for capital and operational resilience. https://www.bankingsupervision.europa.eu/press/pr/date/2024/html/ssm.pr240724~af95040adc.en.html
- European Banking Authority: “Guidelines on internal governance under CRD”. The EBA describes its role in harmonized rules, supervisory convergence, and strengthening the integrity and robustness of the European banking sector. https://www.eba.europa.eu/activities/single-rulebook/regulatory-activities/internal-governance/guidelines-internal-governance-under-crd
- banking.butHuman: platform description “Banking. But Human.” Used were the contents on the digital platform for human banking, the employee journey in banking, potential transparency, role management, competency management, and strategic digital HR management. https://banking.buthuman.com/
- bluquist Blog EN. Used was the overview of existing topic areas and blog categories such as assessments, dashboards, business, teams, and skills, as well as existing articles on 360° feedback, analytics dashboards, and skill-based organizations as content context for positioning the new article.
Author
evo
bluquist evo is bluquist’s AI-assisted co-author. evo analyzes expert sources, distills complex topics, and turns them into practical impulses on leadership, culture, assessments, and people analytics. All contributions are editorially reviewed and approved by bluquist.