Understand your culture and you stand a better chance of managing risk to your human capital


Your people are your business and failing to manage this properly is a serious risk for companies of all sizes. Here, Simon Constance, people advisory services partner at EY and John Marsh, director of talent and people advisory at EY, look at the issues in detail.

Q. How does mismanaging human capital present a risk to a business?

EY: People and the culture of an organisation are critical to robust risk management, particularly in terms of risk ownership, identification, escalation and mitigation. We know that culture provides the norms of behaviour and failure, helping businesses to take into account how the organisation’s culture will affect the ability to identify, understand and act on organisational risks. For example, a culture of fear or blame will inhibit critical risk escalation, which could prevent timely decision-making and corrective mitigating actions or effective continuity planning.

Mismanagement of human capital can occur for a number of reasons, the most fundamental being a mismatch of expectations between employee and employer. In addition, a breakdown in the ‘psychological contract’ could be a problem.

Although remuneration may be a key reason why people join an organisation, how employees are treated, often relative to others, drives performance and behaviour.

Finally, the work environment is also a factor in managing human capital. This extends to utilisation of human capital, and poorly managed shift planning, for example, can lead to higher absences and reduced productivity.

Q. Are human capital risks increasing as firms become more complex and more global?

EY: Large and diverse companies will have a number of different cultures even without the additional complexity imposed through multinational territorial cultural differences. The failure to account for these in terms of risk control design and implementation will limit a company’s effectiveness and robustness. For example, does the culture support a rules-based or a principles-based control approach?

The risks are potentially greater with more complex supply chains. Although firms might previously have delivered their objectives through their own employees, this is rarely the case now. Most organisations are reliant on outsourced services and contractors. Having long supply chains undoubtedly presents risks to organisations and it is crucial that the risk from mismanagement of human capital is also managed in the supply chain.

Q. What can be done to better mitigate human risk? Does the correct approach differ from sector to sector or across departments and is there a gold standard?

EY: It important to understand whether there is organisational alignment on values, behaviours and purpose, within both the organisation and specific teams where risk is greater – for example in supply chains, people operating within the financial control framework and health and safety. The level of risk is dependent on company size, sector, shape and complexity.

Also, incidents or regulation controls can, over time, build up in a way that creates a complicated, hard-to-understand control framework.

A lack of clear accountability and ownership of key risk controls could lead to a degree of disempowerment and disengagement, especially in environments that favour a principles or values-based control environment.

So in essence, an understanding of organisational culture informs the following: risk mitigation action, risk control design and implementation and the level of second and third-line oversight.

If organisational culture is not correct, then behavioural or values-based transformation may be required to mitigate the risk brought in by having the wrong culture, values and behaviour.

In other words, culture trumps compliance or controls.

This piece first appeared in Reward’s sister magazine, StrategicRISK’s new publication, Guide to People Risk. To read the guide in full, CLICK HERE