Managing Risk with a Cultural Perspective

Jorgen Ellingson

|

December 1, 2009

Have you ever heard of Geert Hofstede? If you have taken any multicultural communication courses in school you most likely would have come across him and his famous study of IBM employees around the world that found that a person's risk appetite can differ depending on where he or she is from.

From this study, Hofstede developed what he called the Uncertainty Avoidance Index (UAI), which measures a society's tolerance for uncertainty and ambiguity-in other words, its appetite for risk. The results show that uncertainty appetites differ across the world's cultures. By examining two countries (United States and Japan), each representing opposite ends of the UAI scale, we can better understand how different cultures relate to risk and customize our risk management approach to the host country's cultural risk appetite. Obviously, not all people belonging to these cultures will behave in a way that is consistent with Hofstede's study results, but UAI scores can provide a starting point for any risk management efforts in these areas.

In Hofstede's study, UAI scores can range from 0 (pure risk takers) to 100 (pure risk avoiders). Americans, with a low UAI score of 46, are considered risk takers, while Japan's high UAI score of 89 suggest a culture that is more risk averse. To put these scores in perspective, the world average is 64.

In general, a low score on the UAI is indicative of a society that has fewer rules and does not attempt to control all outcomes and results. It also has a greater level of tolerance for a variety of ideas, thoughts and beliefs.

The characteristics of high UAI societies, on the other hand, trend toward high levels of control in order to eliminate or avoid the unexpected. As a result, these cultures do not readily accept change and are very risk averse.

Therefore, based on the results suggested by UAI scores, we can consider the cultural characteristics of different nations in our risk assessment program. Fundamentally, most risk assessment methodologies include five steps: defining context, risk identification, risk assessment, risk response, and risk reporting and monitoring. Let us examine how UAI scores can influence how we approach each of these steps.

Defining Context
No matter where in the world you are, all companies, departments and functions should have key business indicators (goals), visions and/or strategies. The culturally dependent variable may be whether these business objectives are long-term or short-term. In Japan, most business objectives are cast at a minimum of five-year increments whereas U.S. corporations have a shorter-term horizon, arguably due to their quarterly reporting commitments.

When dealing with Japan and other cultures with a high UAI score, risk managers should concentrate on the short-term obstacles (risks) to achieving the business objective in question. Note that your audience has a cultural tendency to value less uncertainty and will accommodate this by taking a longer view of business activities, goals, objectives and strategies.

For the United States and other cultures with a low UAI score, risk managers should take just the opposite approach. Focus the assessment of risks on the long-term viability of the firm's business objectives and strategies to compensate for the cultural predisposition to shorter-term results.

Risk Identification
Risk identification can be conducted in a number of ways. One way is to make use of risk questionnaires, which are sent out to individual participants who then fill in both open-ended and more structured questions based on a provided business risk model (e.g., examples of risks as they relate to various categories such as operations, strategy or financial).

Additionally, one-on-one interviews can be conducted to inquire about known risks. This method depends highly on the interviewer's knowledge of a particular market, function and  business process in addition to their level of business acumen.

Other methods used to identify risks are workshops and brainstorming sessions, which can be conducted to bring participants together to discuss various risks. There are a number of methods that can be used to facilitate these sessions including the Delphi method and open discussion, such as white boarding.

For high UAI cultures like Japan, a high acceptance of authority is a key value. Consequently, group discussions would be quite difficult to conduct if there are people of power in the session. Participants are more inclined to listen to authority, resulting in little communication from lower levels. Any form of anonymous voting or sharing of information is ideal. Furthermore, since internal or company-specific risks often grow out of strategic and operating decisions made by managers, the interviewer should consider this when identifying risk assessment participants, including both top-down and bottom-up risk identification.

In low UAI level cultures like the United States, a low acceptance of authority is a common trait. Low UAI level cultures appreciate open debate and discourse whether it comes from people of authority or not. Therefore, all three risk identification methods can offer constructive results.

Risk Assessment
The risk assessment process requires the participants to rate the risks based on three key variables: probability of the event/risk happening, impact (financial and nonfinancial) and whether existing controls are in place to reduce or mitigate the inherent risk.

Cultures with high UAI scores tend to be more analytical and perhaps better at quantifying risk, especially those in the nonfinancial realm. The same cultures tend to place more trust in the control mechanisms. For example, cultures with a high UAI score rely heavily on employee integrity. The trust factor goes both ways: the employee and employer trust each other to do the right thing without having to resort to controls to safeguard assets. The idea of "saving face" to avoid the humiliation or embarrassment of disrupting harmony among the group helps to reinforce this shared bond of trust.

In terms of Japanese and other cultures with a high UAI score, risk managers should concentrate the risk assessment process on identifying inherent risks and spend less time trying to identify controls, precisely because the best control may be a cultural one.

For the United States and other cultures with a low UAI score, controls are more necessary as evidenced by the implementation of controls and regulations like Sarbanes-Oxley in the wake of numerous cases of corporate malfeasance.

Risk Response
You can respond to risks by reducing, sharing, avoiding or accepting a particular risk. Key steps involved in responding to risks include identifying root causes and evaluating possible responses to the risks. Risk response options can be evaluated based on the entity's or function's risk appetite, cost versus risk mitigation of response, and degree to which a response will reduce impact or likelihood.

Cultures with high UAI scores have a lower residual risk appetite, preferring to manage the uncertainty more conservatively, unlike the lower UAI cultures that celebrate ambiguity and are more susceptible to take on or accept increased risks.

Insurance is one of the most common ways to mitigate risk in Japan. Its environment and strict government regulations require companies and individuals alike to insure against catastrophic events like earthquakes. This may add a false sense of complacency against other forms of risk (e.g., strategic and operational) and provide little incentive to control risks using other methods.

Companies should expand the idea of risk management when dealing with such cultures. For example, companies could use risk management to provide a competitive advantage instead of thinking of it as a compulsory measure to protect against only catastrophic and other general risks, which are covered by insurance policies.

Remember, cultures with a low UAI score generally dislike rigid rules and laws. These cultures should formulate a risk response that directly mitigates the risk by, for example, installing a specific control, instead of immediately installing sweeping policies and procedures. Policies and procedures are required, but your quest to reduce risk may be better served by keeping the attention focused on the specific risk and less on implementing new rules and regulations.

Risk Reporting & Monitoring
Creative methods of risk reporting and monitoring can be incorporated depending on the culture's UAI score. Embedding risk management may be an excellent complement to a centralized risk management approach if it is implemented effectively.

For example, instead of centralizing the scorekeeping of risks in the risk management department, it can be rolled out to the operations department. This way, the risk ownership and monitoring squarely lies within operations, thereby eliminating any degrees of separation in the process. The risk management department then serves as a coordinator or bridge across multiple functional silos and an objective party to validate the risks. This method should be attempted no matter what the UAI level due to the significant benefits that can be obtained if fully implemented.

If the data is presenting information that is actionable and comprehensive (i.e., connects the dots and breaks down the silos by presenting risk correlations across functional areas) then, whether you are a Japanese or American businessperson, the information will be valuable.

Adapting to Cultural Differences
Our appetite for risk and uncertainty shapes our decision making, and as Hofstede's findings show, one's cultural perspective affects how much risk and uncertainty is acceptable to them. This is precisely why it is so important to take culture into account when managing risk. No one risk management approach will work optimally in all environments or cultures. But just as a marketer might adapt their product strategy to the local consumer's tastes and preferences, risk management practices also need to be adapted to a host countries' cultural traits and values if they are to be effective.
Jorgen Ellingson is a risk manager with TECOM Investments, a subsidiary of Dubai Holdings that develops and manages businesses that support the growth of knowledge-based industries in Dubai.