Risk culture development and its impact: the case of the Caribbean Development Bank

Previous risk culture research has concentrated on the regulated commercial banking and insurance sectors in developed economies. The paucity of studies for developing economies has prompted this research. The objective of this paper is to examine risk culture development and its impact within the Barbados-based Caribbean Development Bank. Given the unregulated nature of development banking, it was anticipated that the risk culture environment within this type of institution would be different to the risk culture environment inherent in regulated entities and will provide a good platform for new findings. Primary data were collected via an interview with the Chief Risk Officer in August 2015 and a three-month field observation at the Bank. The paper utilizes the KPMG risk culture maturity model in conjunction with an adapted version of the Horst Simon risk culture maturity scale to classify the maturity level of risk culture within the Bank. An important finding from the research is that accountability, awareness, communication and leadership have become strong indicators of the Caribbean Development Bank’s risk culture and have contributed to increased uniformity in risk management knowledge, improved coordination of risk data collation and better escalation of risk management issues. Thus, there has been enhanced efficiency of risk management practices within the Bank. Corresponding author: Anthony Wood Email address for corresponding author: anthony.wood@cavehill.uwi.edu First submission received: 12th February 2018 Revised submission received: 20th March 2018 Accepted: 20th March 2018

Singapore on the grounds of an unacceptable risk culture; this case lends credence to the argument that successful risk management and ultimately the survival of an organization is directly related to its risk culture efficiency. This contention is supported by Mavrakis and Smythe (2016) who noted that a poor risk culture can pave the way for substantial compensation and fines. According to statistics by Thomson Reuters, published in Slater (2015), over USD $235 billion in fines related to misconduct have been levied on twenty of the world's largest banks since the 2008 financial crisis.
Previous risk culture research has concentrated on the regulated commercial banking and insurance sectors in developed economies. The paucity of studies for developing economies has prompted this research. The Caribbean Development Bank, a regional development banking institution headquartered in Barbados, is the entity selected for the conduct of this study. Given the unregulated nature of development banking, it was anticipated that the risk culture environment within this type of institution would be different to the risk culture environment inherent in regulated entities and will provide a good platform for new findings.
The Caribbean Development Bank is entrusted with reducing poverty across nineteen Caribbean countries. The Bank, which once embraced a siloed approach to risk management, experienced a downgrade in sovereign credit rating by Standard and Poor's, and Moody's in 2012 because of deterioration in its credit profile and inefficiency in risk management practices. The Bank responded by engaging Oliver Wyman, an international risk management consultancy firm, to review its risk management practices and offer recommendations. Subsequently, a Chief Risk Officer was appointed who initiated the implementation of an enterprise risk management framework in May 2013. This programme gave impetus to risk culture development within the Bank.
The objective of this paper is to examine risk culture development and its impact within the Bank. Primary data were collected via an interview with the Chief Risk Officer in August 2015 and a three-month field observation at the Bank. The paper utilizes KPMG (2015) risk culture maturity model in conjunction with an adapted version of Horst Simon (2012) risk culture maturity scale to classify the maturity level of risk culture within the Bank. An important finding from the research is that accountability, awareness, communication and leadership have become strong indicators of the Caribbean Development Bank's risk culture and have contributed to increased uniformity in risk management knowledge, improved coordination of risk data collation and better escalation of risk management issues. Thus, there has been enhanced efficiency of risk management practices within the Bank. The remainder of the paper is organized as follows: Section 2 reviews the literature on risk culture; Section 3 discusses the methodology adopted; findings are presented in Section 4, whilst the discussion of the findings is the focus of Section 5; a concluding summary and recommendations are provided in the final section.

Risk Culture Definition of Risk Culture
The 2008 global financial crisis and corporate scandals to date have highlighted ethical issues in the business practices of financial institutions. Regulators, rating agencies and other pertinent stakeholders have conceded that the substantial financial losses incurred by these institutions originated from their weak organizational cultures which undermined the effectiveness of their risk management frameworks. In recent times there has been an increasing focus on organizational cultural reforms to effect better risk management results; this has brought to the forefront the concept of risk culture.
Influenced by an organization's characteristics and operating environment, risk culture is defined in different ways (Protiviti, 2014;Power et al., 2015). Academics, regulators, practitioners, consulting firms and risk associations have all offered their perspectives on how risk culture should be defined. As early as 1998, Bozeman and Kingsley characterized risk culture as a manager's perception of the organization's propensity to take risks and of the organizational leadership's propensity to either reward or punish risk taking. Several years later, with the advent of the global financial crisis, the concept of risk culture garnered tremendous attention. Influential organizations such as the Institute of International Finance 1 (IIF) refer to risk culture as "the norms and traditions of behavior of individuals and groups within an organization that determine the way in which they identify, understand, discuss, and act on the risks the organization confronts and the risks it takes" 2 .
This definition is noteworthy given that it has been referenced by several authors (Risk Management Society, 2012;McConnell, 2013;Financial Stability Board, 2014;Elena andJohnson, 2015 andYoung, 2016) and has formed the basis upon which other definitions have emerged. For example, the definitions by Barnabei (2008), Basel Committee on Banking Supervision (2011), Deloitte (2012), Institute of Risk Management (2012), and Sheedy and Griffin (2014) fully support the IIF's view that risk culture is concerned with the attitudes and behaviors of individuals toward risk taking and risk control.
There is growing support for the perception that risk culture is a balance between qualitative behavioral traits and quantitative control structures. Bowers was among the first practitioners to make this distinction during a presentation at a 2012 operational risk conference. KPMG's contribution to this topic affords a comprehensive insight into the components of risk culture. As stated in KPMG (2013, p.12), "risk culture is the sum total of the strategy, organization, processes, systems, people, incentives, etc. expressed through how people think, feel and behave relative to risk and risk management". This is the central tenet of Roschmann (2014) who suggested that risk culture is a cognitive, dynamic concept with psychological and behavioral aspects interacting with organizational aspects such as systems, processes and structures. Further support for this view is provided by Boissel et al. (2015) and the CRO Forum (2015).
While several authors have articulated what risk culture encompasses, the global consulting firm Protiviti has focused their attention on detailing how risk culture should not be defined. According to them, risk culture is not a mere component of a risk management framework, neither is it independent of an organization's culture. "It is a dynamic set of behaviors and attitudes toward risks and risk management that reflect an organization's shared values, goals and practices, and are embedded into the organization's daily operations" (Protiviti, 2014, p. 6).

Importance of Risk Culture
In addition to the foregoing discussion on what is risk culture; of equal importance is the dialogue on the role it plays. There is a general consensus that risk culture is crucial to successful risk management. Statements such as "effective development of a risk culture throughout the firm is perhaps the most fundamental tool for effective risk management" (IIF, 2008, p.33), "risk culture is extremely important for risk management practices of a financial organization" (Bostanci, 2013, p.2), "risk culture affects all risk management related aspects and ultimately affects whether risk management structures, methods and procedures will benefit or damage an organization" (Paalanen, 2013, p.9) and "focusing on the cultural aspects provides context for technical modelling and reinforces the importance of a risk management function that enables and empowers individuals to act in a decisive and preemptive manner" (Cole, 2014, p.16) provide confirmatory support. Further support for the importance of risk culture in risk management is provided by Kaeslin (2008), Sitnikov (2008), De Haan et al. (2015 and WillisTowerWatson (2016).
Further, the literature takes a wider view of the importance of risk culture. Through an aggregation of studies, Figure 1 outlines other aspects of the qualitative importance of risk culture.  (2015) established that a firm's risk culture significantly improves its ability to make transparent, well-coordinated, strategic decisions which are in alignment with its goals.
Adherence to rules & policies "Firms with inappropriate risk cultures will inadvertently find themselves allowing activities that are contrary to stated policies" (CRO Forum, 2015, p.16). Conversely, an integrated risk culture 3 guarantees that employees operate within the boundaries of acceptable risk.
Enhanced governance Caputo (2014) indicated that a sound risk culture throughout the organization reduces the need for onerous governance control mechanisms which can stifle creativity and incur expenses.

Better communication
Risk culture promotes information sharing (Protiviti, 2014) which encourages a unified awareness of risks and risk management, and this enables effective risk control (Cole, 2015).

Greater accountability
Within an environment where there is a strong risk culture, employees at all levels are motivated to contribute to the risk management process. Escalation of threats and concerns are handled in a more efficient manner (Protiviti, 2014).

Good regulatory relationships
Since the global financial crisis, regulators and rating agencies have placed a strong focus on risk culture. "A good risk culture can help provide confidence as well as reduce the risk of regulatory fines" (Caputo, 2014, p.7). Organizations will find it easier to be in compliance with regulatory requirements and can benefit from enhanced credit ratings. According to Standard and Poor's (2016), very strong scores are assigned to re/insurers with positive enterprise risk management (ERM) subfactors such as risk culture, risk controls, emerging risk management, risk models and strategic risk management.
While there is extensive literature on the qualitative importance of risk culture, the quantitative evidence is limited. This situation is not due to a lack of interest among researchers but "the challenge of carefully observing and quantifying corporate culture" (Boissel et al., 2015, p.2). Sheedy and Griffin (2014) are early contributors to the quantitative assessment of risk culture. In a period of eighteen months, they examined the risk culture in one hundred and thirteen business units across two major banks headquartered in Australia and one headquartered in North America. They provided evidence that validated the importance of risk culture; specifically, a strong risk culture was associated with more desirable risk-related behaviour, for example, speaking up, promoting risk management and knowing how to report a risk event.
Influential research in the area was conducted across eighty-one European banks by Fritz-Morgenthal et al. in 2015. They developed a risk culture score based on nine risk culture indicators 4 and utilized the European Central Bank's 2014 stress test results to examine how risk culture impacts stress testing. Their analysis indicated that banks with better stress test results have better risk cultures and are represented by a better overall capitalization as well as lower overall risk exposure. "On average, an increase of the leverage ratio by one percentage point corresponds to an increase of the risk culture score of approximately 0.3219 points. On the other hand, increasing the relative risk exposure by 10 percentage points corresponds to a risk culture score that is lower by 0.4519 points" (Fritz-Morgenthal et al., 2015, p.77). In a wider context, Lo (2016) explored several recent financial debacles (Long-term Capital Management, American Investment Group, Lehman Brothers, rogue trader Jerome Kerviel of the French Bank Société Générale, Bernard Madoff) that demonstrated corporate culture is clearly an important factor in financial failure, error and malfeasance.
While there is extremely strong support for the view that risk culture is important for successful risk management, a few writers have expressed a contrary position. For example, McConnell (2013) posited that changes in organizational culture and not risk culture are required to resolve risk management issues. Along similar lines, the Group of Thirty (2015) maintained the view that risk culture is a part of organizational culture and cannot be abstracted and addressed in isolation. Further, Tuveson and Ralph (2016) contended that risk culture is divorced from business relevance and cannot sustainably govern corporate behavior, and a more realistic focus should be on personal accountability.

Methodology
This paper examines risk culture development and its impact within the Caribbean Development Bank. A qualitative research methodology was employed to ascertain the data for the analysis. As noted by Ereaut (2011, p. 1), "qualitative research is used to gain insight into people's attitudes, behaviours, value systems, concerns, motivations, aspirations, culture or lifestyles". Data were obtained via a structured interview with the Chief Risk Officer in August 2015. The interview approach was preferred over a self-administered questionnaire for the following reasons. The interviewer can explain questions that the respondent has not properly understood and there is the opportunity to probe respondents to elaborate on answers (Seale et al., 2011). Thus, the interviewer can pursue in-depth information around the topic. However, we should note that interviews may be subject to the influence of the interviewer (Bryman, 2012).
The Chief Risk Officer was identified as the preferred participant because of his intimate knowledge of the risk management function at the Bank since he has direct responsibility for the Office of Risk Management. Further, the Officer is very knowledgeable in the area of risk management, having served in excess of twenty years in senior risk management roles.
The interview was guided by fourteen questions which were classified in four sections 5 . These questions were compiled by extracting information from risk culture surveys documented in the literature. The first section includes two questions which focus on the demographic profile of the Chief Risk Officer. The next three questions assess the Caribbean Development Bank's enterprise risk management framework and risk portfolio. Section three contains seven questions focusing on the Bank's risk culture environment and the final section includes two questions examining the benefits of effective risk culture development.
Two triangulation methods were used to validate the research findings: data triangulation and methodological triangulation. Data triangulation involves the use of different sources of information. Potter (1996) asserts that findings derived from data collected from many sources will be more reliable than those based on observations from one source. To effect data triangulation the views of the Chief Risk Officer were compared with the information collected during a three-month field observation within the Office of Risk Management. This internship allowed the researcher to gain first-hand knowledge of the Bank's risk culture environment. Methodological triangulation is the use of multiple research methods to study a phenomenon. Methodological triangulation was  (2015) risk culture maturity model (see Appendix 1) and an adapted version of Horst Simon (2012) risk culture classification levels (see Appendix 2). KPMG's model identifies four attributes of risk culture (knowledge and understanding, belief and commitment, competencies and context, action and determination) assessed along a continuum from weak to advanced levels. Similarly, the adapted version of Horst Simon's methodology identifies five attributes of risk culture (policies and limits, strategies and goals, risk management structure, risk control processes, people and competence) assessed along a continuum from bad to ultimate risk culture. The adaptation of Horst Simon risk classification methodology was undertaken by the authors in order to make the attributes of risk culture more explicit. Other risk culture assessment models were developed by Levy et al. (2010), Griffin et al. (2014Griffin et al. ( , 2017 and Fritz-Morgenthal et al. (2015)

Findings
Established on January 26, 1970, the Caribbean Development Bank (CDB) is the premier vehicle for development financing, technical assistance and policy advice to its borrowing member countries throughout the Caribbean. The Bank is owned by 27 member countries: 22 members from the Region, divided into 19 borrowing member countries and three non-borrowing member countries; and five non-regional members (CDB, 2014). In 2012 the Bank experienced a downgrade in sovereign credit rating by Standard and Poor's, and Moody's because of deterioration in its credit profile and inefficiency in risk management practices. The Bank responded by contracting Oliver Wyman, an international risk management firm, to review its risk management practices. Based on the consultant's recommendations, a designated risk function was created and, on this basis, a Chief Risk Officer was recruited and the Office of Risk Management was established in May 2013. Further, the siloed approach to risk management was replaced through the adoption of an enterprise risk management (ERM) framework. ERM provides a structure that combines all risk management activities into an integrated framework which facilitates the identification of the interdependencies of these activities (Hoyt and Liebenberg, 2011) and raises the discipline of risk management to a more strategic level within the organization (Hardy, 2009). It is important to note that its successful implementation is rooted in cultural change.
The Office of Risk Management has established short-term and long-term risk management objectives within the Bank, and implemented processes to identify, prioritize, control, monitor and report risks. The Chief Risk Officer identified internally-driven and externally-driven risks that impact the Bank's operations. From an externally-driven standpoint, financial risks such as worsening fiscal condition of borrowing member countries and termination of membership from AAA-rated non-borrowing member countries compromise the Bank's operations. From an internallydriven standpoint, operational risks such as lack of diversification in the nature and location of projects, and developmental risks such as inefficient monitoring of projects also compromise the Bank's operations. The Chief Risk Officer underscored the need to constantly reinforce the relevance and importance of risk management.

Definition of Risk Culture
The Chief Risk Officer stated that risk culture within the Caribbean Development Bank is classified as the perceptions and actions of staff towards risk and risk management, and the tools, processes and systems implemented for risk management control.

Risk Culture Development
Since the establishment of an enterprise risk management framework within the Bank in 2013, risk culture has developed substantially. The Chief Risk Officer revealed that the Bank has adopted a culture-first 6 approach to risk culture development. The Office of Risk Management has actively ensured that members of the Board of Directors and senior staff are fully aware of their obligations and responsibilities in the risk management process. In this regard, an Enterprise Risk Committee comprising select members of the Board of Directors and senior staff from each of the Bank's departments was established. Board members of the Enterprise Risk Committee are furnished with a charter of risk management duties. Also, the Enterprise Risk Committee is supported by a team of Risk Champions who assists in the completion of annual risk control self-assessments and monthly risk-log reports, and liaises with members of the Office of Risk Management as required.
The Office of Risk Management has also focused its attention on implementing risk reporting mechanisms, maintaining a presence on various committees throughout the Bank and leveraging technology to create risk management efficiencies. The Chief Risk Officer stressed that risk culture is heavily dependent on the risk management infrastructure implemented within the organization and responsibility for its development resides not only with management but with all members of staff.
It was also revealed that risk awareness training for staff members is developed on an ongoing basis through mediums such as workshops and meetings. Staff members are educated in the areas of risk identification, risk mitigation and risk reporting.
The Chief Risk Officer also contended that risk culture development is heavily dependent on an organization's DNA 7 . It was elaborated that an organization's cultural status is a determinant of the importance given to risk culture and subsequently impacts the effectiveness of its development. The Bank's risk culture development efforts are however challenged by the constant need to reinforce the relevance of risk management to staff. The view is maintained that risk culture can only be effectively developed if its importance is well understood within the organization. The Chief Risk Officer highlighted that although risk culture development is initially guided by a top-bottom order, it is advanced from all angles within the organization. Furthermore, without the necessary tools and infrastructure in place, reform efforts would be futile.
When asked to evaluate if a single risk culture is sufficient or whether there is a need for multiple risk cultures within an organization, it was emphasized that risk culture practices vary pursuant to the job accountabilities of staff; however, the core values and objectives remain the same. In the case of the Caribbean Development Bank, at the administrative level, risk culture is concerned with understanding the Bank's risk portfolio, how to mitigate risks, how to report risks efficiently and understanding the implications of delaying to report risks or not reporting risks at all. In addition to these, at the professional or technical level, risk culture is also concerned with the efficient incorporation of risk management into the analysis of project proposals and project appraisals.
Although not publicly available, written policies and procedures have been established to govern risk management activities within the Bank. The Office of Risk Management governance initiatives are further consolidated by the Bank's longstanding code of ethical conduct, whistle blowing hotline and projects complaints system. Further, to support the implementation of the enterprise risk management programme, the Bank has established an Office of Integrity, Compliance and Accountability to reinforce ethical behavior throughout the Bank.

Risk Culture Maturity
According to the Chief Risk Officer, the accomplishments in risk culture development have set the foundation for an intermediate risk culture. However, he reiterated that there is still need for further improvement

The Impact of Risk Culture Development on Risk Management Practices
Two questions were asked relating to the importance of risk culture to risk management. First, do you believe that risk culture is a crucial component of a successful risk management framework? and second, how important and relevant is risk culture in the Caribbean Development Bank? In response to the first question, the Chief Risk Officer stated that a strong risk culture is truly the critical driver of a successful risk management framework; it facilitates identification and mitigation of emerging risks and drives the whole thinking process around risk issues. He also asserted that it is only when the culture has come to appreciate the issue of being able to identify the threats it faces and put in place mitigation mechanisms ahead of those threats, can risk management be truly successful.
With regard to the second question, the Chief Risk Officer acknowledged the need for a good internal risk culture since development banks technically do not have a regulator which could impose immediate penalties for engaging in high risk behavior. He also alluded to the fact that the Caribbean Development Bank is currently faced with risks of lending to countries which are experiencing economic and fiscal challenges, thereby reinforcing the need for a strong risk culture environment at the Bank.
The three-month field observation also provided evidence about the importance of risk culture in the Bank. Indeed, it was found that the active development of risk culture has contributed to increased uniformity in risk management knowledge, improved coordination of risk data collation and better escalation of risk management issues.

Discussion
The Caribbean Development Bank acts as a fulcrum of social development and its inefficiency can result in problems for several Caribbean economies. As a regional development bank, the project-centric scope of its work causes its operations to face an array of risks. Therefore, effective risk culture development is mandatory for its successful operation. The Bank's view of risk culture is congruent to the definition provided in current literature which states that risk culture is a balance between qualitative behavioral traits and quantitative control structures.
The appointment of a Chief Risk Officer, establishment of the Office of Risk Management and subsequent implementation of an enterprise risk management framework were necessary not only to restore the Bank's credibility of operations to regulators but also consolidate individual risks in the projects and operational areas of the Bank. Within three years of existence, the Office of Risk Management has not only exhibited strong adherence to enterprise risk management best practices but has also achieved several notable milestones. In terms of achievements, at a departmental level, there has been a seamless integration of risk management control measures across business lines. On the Office of Risk Management side, there has been significant progress in the adoption of technological systems to automate some risk management processes.
Consistent with the risk culture development programme adopted by the Canadian-based CIBC Mellon Bank 8 , members of the Office of Risk Management maintain a presence on all committees throughout the Bank and designated Risk Champions exist within every department to support two-way flow of risk information between the Office and individual units. The Caribbean Development Bank's implementation of Risk Champions is a great facilitator of risk culture development. This assertion is supported by Stubbs (2016) who noted that changing the culture within an organisation efficaciously requires key lieutenants and change champions in many parts of the business. It must be noted, however, that the appointment of Risk Champions may pose challenges if not implemented effectively. Bennett (2013) highlighted that the implementation of Risk Champions may convey to the rest of the organization that risk management should only be overseen by them. Therefore, it is incumbent that Risk Champions be selected on a rotational basis, thereby facilitating a higher level of accountability throughout the organization.
The Caribbean Development Bank's risk culture development practices are similar to those adopted by CIBC Mellon in other respects. For example, both organizations foster and reinforce a positive risk culture through control and risk awareness training, use of risk event logs, conduct of risk and control self-assessments (RCSAs) and adoption of risk committee reviews. In a similar vein, Deutsche Bank focuses on training and awareness. Indeed, risk culture awareness is mandatory for all employees. From 2010 to the end of 2015, there were over 550,000 risk culture training enrollments (Deutsche Bank, 2015). Other important features of the risk culture environment at Deutsche Bank are the establishment of a dedicated risk culture library of industry reports, articles on internal social media platforms, embedding of a "speak-out" culture and the Red Flags initiative which provides a link between risk-related conduct and performance management. According to Deutsche Bank (2015), Red Flags monitor adherence to certain risk-related policies and processes, whereby a breach leads to an appropriately risk-weighted Red Flag. In the further development of risk culture at the Caribbean Development Bank, consideration can be given to some of the elements in place at Deutsche Bank.
The Chief Risk Officer is of the view that a strong risk culture is a critical driver of a successful risk management framework through the early identification and mitigation of emerging risks. This view is supported by the evidence obtained during the three-month field observation at the institution. This evidence indicated that the active development of risk culture within the Bank has instilled strong practices of accountability, awareness, communication and leadership, and these have contributed to increased uniformity of risk management knowledge, improved coordination of risk data collation and better escalation of risk management issues throughout the Bank. The clearly established risk governance structure facilitates the ease of recognition of the risk reporting order. Also, the implementation of standardized risk reporting templates across all departments of the Bank prevents unnecessary discrepancies in the quality of risk information reported. Further, the appointment of Risk Champions within each department allows members of the Office of Risk Management to dedicate more time to analysis rather than collation. The finding that risk culture development impacts positively on the enterprise risk management deployment's effectiveness corroborates earlier research by De La Rosa (2006) and Kimbrough and Componation (2009).
It is well accepted in the literature that strong leadership and enterprise-wide accountability are essential for effective risk culture development (Cole, 2014;Sheedy and Griffin, 2014). Such acknowledgement is seen within the Caribbean Development Bank where there is a robust risk management leadership framework in place and accountability for risk culture development is promoted within the various departments. However, it is important to note that enforcing accountability at the departmental level does not guarantee individual accountability and should not solely act as a predicator of successful risk management. If there is consistent practical risk awareness then employees are better motivated to participate in the risk management process. To ensure continual enhancement and support of effective risk management practices, it is critical to have alignment across all behavioral and physical aspects of the risk management framework.
The Chief Risk Officer's statement "risk culture development is heavily dependent on an organization's DNA" is congruent with the view held by Ganapathy and Sivasubrananian (2016, para. 3) that "it is practically impossible to introduce and sustain a positive change in any function of the business without aligning the organizational culture to strategy". Further support for the position that an organization's culture is a key facilitator of its risk culture development is provided by Kleffner et al. (2003), Kimbrough andComponation (2009), Muralidhar (2010) and Thomya and Saenchaiyathon (2014).
Despite the recognition of the importance of risk culture, organizations continue to face challenges with its development. Indeed, the Risk Management Association (2014) and Protiviti (2014) remarked that a lack of understanding of risk culture and how it translates into tangible benefits are the two major challenges to developing risk culture within an organization. Similarly, Thakor (2016) noted that knowing how to diagnose and change the culture of an organization is vital to achieving optimal performance. Table 1 below shows the ranking of the list of challenges as provided by Protiviti (2014).
The discussion with the Chief Risk Officer highlighted that the Caribbean Development Bank is also experiencing challenges in translating risk culture development into actionable benefits. These challenges are related to rank 2 in Table 1.

Nature of Challenge
Rank Lack of clear understanding on what needs to be implemented to improve risk culture 1 Lack of clarity about how risk culture works within the organization and, most importantly, at the level at which employees perform their respective daily activities 2 Insufficient tools and processes to establish or drive needed risk culture change 3 Insufficient financial and human resources to give risk culture sufficient attention 4 Lack of clear understanding of current culture 5 Table 1: A list of challenges faced in risk culture implementation Source: Protiviti 2014 Culture is longstanding; it can outlast leadership transitions, changes in products and services, geographic footprint and other physical, measurable attributes of a company (Schein, 1992;Group of Thirty, 2015;Lagarde, 2015). While the task of reforming it may be formidable, it is critical that key stakeholders play an active role in its assessment and management for optimal organizational performance in the long-term. This can be achieved by utilizing culture maturity measurement instruments.
In the context of this research, KPMG's (2015) risk culture maturity model and an adapted version of Horst Simon's (2012) risk culture maturity scale were used to assess the maturity of the Bank's risk culture development process. When the Bank's risk culture practices were benchmarked against KPMG's maturity model, the outcome is that the Bank has achieved a sustainable level of risk culture maturity for some attributes and a mature level for others (Table 2). With respect to the benchmarking against the adapted Horst Simon's measurement tool, some practices reflected a typical risk culture and others a good risk culture (   Table 3: Benchmarking results of adapted Horst Simon's risk culture maturity assessment

Conclusion and Recommendations
In recent times there has been increased emphasis on the importance of risk culture to the functioning of organizations. Previous risk culture research concentrated on the regulated commercial banking and insurance sectors in developed economies. This paper therefore extended the literature through an examination of risk culture development and its impact within the Caribbean Development Bank, a regional development banking institution headquartered in the developing economy of Barbados.
Some important findings emerged from the analysis. First, accountability, awareness, communication and leadership have become strong indicators of the Caribbean Development Bank's risk culture and have contributed to increased uniformity in risk management knowledge, improved coordination of risk data collation and better escalation of risk management issues. Thus, there has been enhanced efficiency of risk management practices within the Bank. This improved situation has resulted in an upgrade of the Bank's sovereign credit rating from negative to stable by Standards and Poor's, and Moody's. Second, the acknowledgement in the literature of organizational culture as the foundation of risk culture development is substantiated by the findings of the study. Third, the findings also solidify our understanding that while senior management is responsible for setting the context for the culture within the organization, employees exert the most influence over the culture and act as indicators of the culture. Of equal importance is how effectively the processes, systems and tools are implemented within the organization as these serve to reinforce the culture. Fourth, the Caribbean Development Bank has made satisfactory progress with its risk culture development efforts as evidenced by the benchmarking exercise and the view of the Chief Risk Officer.
A few recommendations emerge from the analysis. The Caribbean Development Bank's recent establishment of the Office of Integrity, Compliance and Accountability is highly commendable since it complements the operations of the Office of Risk Management in optimizing performance within the Bank. However, for the consideration of enforcing individual accountability, it is recommended that through cooperation with the Human Resource Department, risk management indicators are included in the staff's performance appraisal reports and risk management accountabilities in their job descriptions. Also, emphasis should be placed on developing the practical aspects of employees' risk management competencies which can be achieved through their involvement in the facilitation of risk management workshops and opportunities to shadow Risk Champions.
The Caribbean Development Bank could benefit from the introduction of some of the important elements of the Deutsche Bank's risk culture environment such as the establishment of a dedicated risk culture library of industry reports, articles on internal social media platforms and the Red Flags Initiative. It would also be useful to keep an updated account of the risk management competencies of staff as part of an enterprise-wide talent management process. Further, to reinforce the value of risk management to an organization's survivability, it is recommended that real-life examples of events within the organization which triggered sound risk management decisions are highlighted.
Similar to a company's organizational culture, risk culture is dynamic and can simultaneously act as a driver and challenge to risk management efforts. Thus, to move the Caribbean Development Bank further along the trajectory of risk culture maturity, it is recommended that the Office of Risk Management be strengthened with the recruitment of a Culture Development Manager or Chief Cultural Officer. Proposed accountabilities of this officer are presented in Figure 2 below.
Act as a mediator between staff and management Make cultural values visual Solicit feedback from staff to identify cultural weakness Implement programs which recognize and reward staff that positively impact culture Advise HR regarding the recruitment and dismissal of employees in accordance with cultural values Implement a structured approach to culture assessment and improvement Figure 2: Proposed accountabilities of the Culture Development Manager Act as mediator: The Culture Development Manager is the trusted person who will facilitate internal cohesion by liaising between employees who experience workforce challenges and management or leadership as needed.
Make values visual: By visually representing risk culture throughout the organization with many different mediums, the culture is reinforced internally and well observed externally. The Culture Development Manager can define a few cultural values which can be represented as a graphic and then incorporated onto office supplies, communications and physical building elements.
Solicit feedback from staff: From a committee of diverse staff, the Culture Development Manager can ascertain if any implemented procedures, products etc. need to be redesigned and work with key stakeholders to achieve this. Implement reward programs: A monthly, quarterly or yearly awards program can be developed to reward individuals who not only embrace and embody the values but foster new ideas which help to execute the organizational strategy.
Advise Human Resources: The Culture Development Manager can support the Human Resource personnel during the recruitment process to ensure that employees are a cultural fit within the organization.
Oversee culture assessment and improvement: The implementation of culture assessment and improvement initiatives should underscore the core accountabilities of the Culture Development Manager. During the initial months the Culture Development Manager should carry out an analysis of the current risk culture environment, formulate the metrics and measurement for the development of a culture scorecard and produce templates for management reporting. In due course a system should be implemented to monitor the acceptance and movement of cultural issues throughout the organization. On an ongoing basis the Culture Development Manager should act as coach for senior leaders in helping them fulfill the role of cultural leaders.
Though the study provides an interesting account of risk culture development and its impact in an unregulated financial institution, it is recommended that a more in-depth study be undertaken in the near future. This effort should involve the participation of all staff members of the Bank. Such a study will provide more comprehensive data to assess the true status of risk culture maturity and its impact within the organization. Most staff are trained in risk management. There is a proactive approach to risk management.
Enterprise-wide risk awareness. All staff are knowledgeable and skilled in risk management. Risk management is seen as a source of competitive advantage.