Fostering a Risk Management Culture

It’s my first day on the job as the new municipal risk manager. I am excited for sure, but then I realize that the “Culture of Risk Management” is nearly absent. My excitement dwindled to an anxiety about how in the world can I turn around this huge ship of “That’s not my job" to a team of “I am the risk manager.”

My first piece of advice is to assess your current situation. Do employees know how and when they should report incidents and accidents? Do employees actually follow that procedure? Is compliance training up to speed? Are policies in place that support my organization’s goals and objectives? Are incidents and accidents reviewed by peers, and then the message of prevention shared? How is risk management perceived by my supervisor, directors, and the broader employee base? Maybe the most critical question is: who do the employees think the risk manager is?

Other signs that a risk management culture was seriously lacking were also obvious: a high experience modification factor, a number of frequent flier claims, late reporting of incidents and accidents, a lack of near-miss reporting, and a view that risk management was... over there somewhere.

And so it began. I had to slow down and recognize that this is a three to five-year change process. I first had to start with what is most important and will have the most significant positive impact with the least amount of resistance. Small wins early on build credibility and foster inclusion of risk management.

I have come to learn that the secret to building a positive culture is, you guessed it, people. Begin by sitting down with directors and key leadership to talk about risk management. Find out what they believe it has been, what they see it as today, and how they envision risk management in the future. To be clear, this meeting is NOT about risk management but about building the foundation of a working relationship and teamwork with the organization’s leadership.

The side benefit is that you will get to learn about their department and to educate them on how, when, and where risk management can help them meet their objectives. At the same time, invest a few hours every month in “ride-alongs” with the employees on the ground, such as police, fire, sanitation, public works, and other departments you serve. Always keep in mind that to achieve desired results, you must have the support of the employees, or progress will be severely impaired.

Then, policies must be current and in place to provide direction to employees and assist in meeting the organization’s goals. Remember, small steps. This is a three to five-year plan of teamwork. Networking and a series of small wins is the course.

The reporting of incidents and accidents is also most critical. Make your reports short and easy to understand in a form that can be easily emailed. When I first arrived at my entity, the ONE and ONLY report form was 13 pages long and contained sections that seemed to duplicate each other. A large percentage of time the reports were not completed, nor sent to risk management promptly. The structure today is outlined in a how-to manual broken into specific loss sections. The instructions are on one page and the corresponding report form is one or two pages long. The objective is to be in the loop as soon as is practical, and make it easy for employees to make that happen.

When a new training program is first designed, polished, and ready to roll out, the first audience is the department director. After reviewing, look for input into making changes, additions, deletions, and most importantly, ask the key questions.

We, professional risk managers, are essentially risk consultants. Our role is to grow and nurture employees to understand their role as risk managers and encourage concepts like “Stop Work Authority," “I am the Risk Manager," and “My Voice Matters” to move the needle to a culture of risk management.

I did not realize how far we had moved the needle until one day, in a large auditorium filled with employees, I approached the podium and asked a question. “So, who is the risk manager?” Over the background music, the resounding reply of hundreds of employees was “I AM!" It brought a tear to my eye, for in that moment I realized we were there.