Sage Journals: Discover world-class research

Abstract

Risk culture shapes individual, group, organizational, and societal risk perception, and behavior, and, therefore, is a promising concept in risk analysis. Risk culture concepts are popular among practitioners since they have the potential to integrate different research strands and provide practical guidelines. However, such concepts are still ill-defined, and their empirical foundations are limited. We introduce a new framework for risk culture derived from research on organizational culture and risk climate that aims to overcome the shortcomings of current models. The Risk Culture Framework is a 3 × 3 matrix that differentiates three influence domains (i.e., person, social context, and risk situation) and three cultural layers (i.e., observable, non-observable, and implicit factors). The framework can be applied in different contexts and fields of risk research. Each cell of the matrix can be filled with specific, proven factors relevant to the context of interest. The framework aims to enable the integration of different disciplines and approaches, to enlarge the understanding of mechanisms that shape risk perception and behavior, to navigate the conception of research studies, to provide a blueprint for comprehensive risk measures, to guide practical risk analysis, and to facilitate benchmarking for appropriate risk cultures. Considerations for the application of the Risk Culture Framework, as well as its validation through future research, are outlined.

Keywords

risk culture framework risk analysis risk science integration

How can uncertainty and complex risks be addressed more comprehensively, more consistently, and thus, more successfully? Emerging or systemic risks like climate change, financial crises, or the COVID-19 pandemic exemplify various factors’ complex interdependencies. Accordingly, research focusing only on single aspects often falls short of explaining, predicting, and practically approaching complex risks. Furthermore, risk as such is a vast and diverse research field, which is why even well-established approaches are rarely transferable from one risk domain to another. Hence, there is a need for new integrative and comprehensive concepts and approaches that allow for transfer between different domains and practical applications (Aven, 2019; Aven & Flage, 2020; Schweizer, 2019). This article introduces such a new concept based on the idea of risk culture.

Risk culture is a comprehensive approach, which considers a social entity’s specific understanding of risks. To conceptualize, address, and manage complex risks, the concept of risk culture has received some attention (e.g., Ashby et al., 2012; Carretta et al., 2017; Sheedy & Griffin, 2018; Wood & Lewis, 2017). However, the current state of risk culture concepts is equivocal: it is popular amongst risk management practitioners (e.g., Sinha & Arena, 2020), as it deals with a comprehensive understanding and management of risks’ relevant factors, and regulatory requirements demand its use in some fields (Ashby et al., 2012). However, it remains relatively novel and ill-defined, and published research on conceptual clarity and methodological detail is limited (Ring et al., 2016; Zeng et al., 2020). One major reason for these shortcomings stems, at least in part, from the focus of research on, for example, the practical application in a single industry or company (Power et al., 2013; Sheedy & Griffin, 2018). Moreover, practitioners have little agreement regarding the concept of risk culture (Power et al., 2013; Sinha & Arena, 2020). In this article, current perspectives on risk culture are discussed, and a new Risk Culture Framework (RCF) is introduced. This Framework is a proposition to the field of risk research on how to conceptualize risk culture. It is based on aspects of both risk and organizational culture research and enables the integration of critical findings from psychological risk research and other disciplines. Thus, the RCF provides a conceptual foundation for the operationalization of risk culture studies in different fields and/or with different perspectives. The RCF particularly aims to benefit risk assessment and interventions in complex situations on a societal, organizational, and individual level. To illustrate the potential application of the RCF, we describe three hypothetical examples, and we outline suggestions for validation and future research.

Risk Culture and Shortcomings of Current Concepts

Risk culture is a particularly complex and abstract construct from both a theoretical and practical perspective. It is based on two multilayered concepts: risk and culture (McConnell, 2013; Previati, 2017). Taking human subjective assessments into account, risk can broadly be defined as “uncertainty about and severity of the events and consequences (or outcomes) of an activity with respect to something that humans value” (Aven & Renn, 2009, p. 6). This definition implies that evaluations can be aligned or shared between people; but also, that different individuals, groups, organizations, or societies can have different definitions of what is of value and, therefore, can have different understandings, assessments, perceptions, and handling of risks in general and of specific risks. Accordingly, risk is not seen as an independent objective truth or ontology by itself, but as, at least in part, socially dependent and culturally embedded (Jasanoff, 1999).

There is little consensus on a cohesive and satisfactory definition of risk culture. Generally speaking, risk culture comprises social entities’ (e.g., a group, organization, society) values, norms, and traditions that determine how risk is identified, understood, evaluated, and handled (Institute of International Finance, 2009). As culture generally drives situational understanding and, thereby, indirectly shapes perception, assessment, attitude, and behavior (Schein, 2017), risk culture specifically shapes risk perception, assessment, attitude, and behavior (Gupta & Liu, 2017; Sheedy & Griffin, 2018). Hence, risk culture can be defined as shared values, beliefs, knowledge, and understanding of risks for a specific social entity (Ring et al., 2016). This means that different social entities (e.g., groups, organizations, societies) and their members can have numerous implicit and explicit convictions on how to deal with the many aspects of risks, which can be labeled as risk culture.

One major challenge facing risk culture is the identification and examination of relevant factors that contribute to risk culture. On the one hand, risk-relevant factors can vary in different contexts. Thus, different factors with different relationships can be decisive in different contexts. On the other hand, other effects like groupthink (Janis, 1972) or biasing (Tversky & Kahneman, 1974) tend to occur across different contexts. As such, current risk culture concepts can be criticized as being too narrow because they are either limited to one context, such as the financial industry (e.g., Ring et al., 2016), or are too one-sided, for example, if they only consider single aspects or determinants such as very general dimensions of culture (e.g., Zeng et al., 2020).

A second major challenge facing risk culture refers to the consideration, conceptualization, and operationalization of both the different cultural layers and, more specifically, less accessible characteristics like implicit assumptions (Corneille & Hüter, 2020; Gawronski et al., 2020). Cultural layers describe different levels of accessibility of a social entity’s shared values and attitudes from observable to implicit characteristics (Schein, 1988). The search for relevant factors of risk culture needs to consider factors on all cultural layers. In our view, current risk culture concepts remain superficial and conceptually ill-defined as they are restricted either to observable behavior or structures, such as risk climate (e.g., Sheedy et al., 2017), or provision of easily quantifiable measures to outsiders such as statements for an organization or the constitution of supervisory boards (Fritz-Morgenthal et al., 2016). In contrast to, for example, safety culture, broadly defined as shared beliefs, norms, values, practices, and structures concerning safety in organizations (Aven & Ylönen, 2021), risk culture has a broader scope. First, risk culture is not limited to organizations or a specific context. Accordingly, risk culture exists in, and can be applied to, different forms of social entities on a macro (e.g., societies), meso (e.g., organizations), and micro level (i.e., individuals as members of social entities). Second, risk culture can incorporate other related concepts such as safety culture as a specific, safety-orientated form of risk culture. However, risk culture research would benefit significantly from a comprehensive and conceptually well-defined identification and assessment of all cultural layers.

A third challenge for risk culture concepts refers to construct validity. Conceptual clarity implies that the construct of the pronounced risk culture concept can be empirically validated. To the best of our knowledge, no construct validation has yet been undertaken for a context-agnostic risk culture concept. The only relevant study of which we are aware that tests and conforms to the factor structure of the pertinent concept used a model of risk climate that is limited to the financial industry (Sheedy et al., 2017). The lack of validated concepts and measures that can be applied more broadly to different risk contexts may stem from the vital interest of practitioners in risk culture concepts and their focus on the application in mainly the field of organizational risk management (Nguyen et al., 2019; Sinha & Arena, 2020). Sometimes, practitioners may not prioritize addressing the issue of validation if a certain concept is effective for them. Moreover, existing models are often built on practical demand and specific contexts rather than theoretical considerations or existing empirical research.

From a scientific point of view, validation should take place before application. To increase the likelihood of successful validation, it is advisable to consider existing research and relevant theories independent of the potential context of an application. If a risk culture concept is theoretically well-founded and applicable to a wide range of contexts, it can bridge the gap between theoretical foundation and practical usefulness, as exemplified in Lewin’s (1943) famous reference to an unknown businessman’s statement that “there is nothing as practical as a good theory” (p. 118). In the long run, construct validation will foster practical usefulness by facilitating standardized measures, increasing the comparability of results, and establishing benchmarks.

Finally, published research on risk culture often has either a rather retrospective and descriptive approach, such as exploring corporate failures (e.g., McConnell, 2013) or public disasters (e.g., Banks, 2012), or superficially sketches why different risk cultures emerge without exploring the underlying factors (e.g., Cimini, 2021). In our opinion, this outline two further shortcomings of current concepts. First, risk culture concepts should also have predictive validity and, therefore, be capable of making predictions by linking characteristics of a risk culture with future outcomes, such as resilience to risk or specific risk behavior. For example, a risk culture concept should allow for the assessment of future health risks for a social entity based on the entity’s current health-related risk culture. Second, to comprehensively explore, understand, and measure different risk cultures, a framework is needed that enables the consideration of all relevant underlying factors.

In summary, to date, existing risk culture research has missed clarifying the underlying construct (Hartnell et al., 2011) and consequently lacks consistent operationalizations that differ from related concepts such as risk climate (e.g., Schneider et al., 2013; Sheedy et al., 2017, 2021). Along this line, past research disregarded risk culture’s full conceptual and methodological depth (Cimini, 2021; Ring et al., 2016; Zeng et al., 2020). Accordingly, there is a need for a definitional or theoretical basis to improve consistency in empirical research on risk culture (Ostroff et al., 2013; Palermo et al., 2015). The theoretical incoherence and lack of an exemplary framework for the implicit and explicit factors of risk perception, assessment, and management, drive a need for culture-sensitive risk measurement methods (Schmidt et al., 2020). However, considering the risk culture’s breadth of content, no unique risk culture methodology seems to exist (Cimini, 2021). In our opinion, the latter is a significant research gap, because a common agreement on the methodological framework is the basis for comparable and reliable empirical research. These shortcomings call for a theoretically orientated and integrated framework, which considers all cultural layers of observability, provides guidelines for factor selection, accounts for different effects of handling risks, applies to both different contexts and social entities, and is capable of not only explaining past events but also of making predictions. Creating such a framework is the aim of this research.

Research Questions and Methodological Approach

The primary research question addressed in this study is to develop and propose a new risk culture framework that advances our understanding of how organizations can effectively assess and manage risk. Specifically, the framework aims to pave the way for future empirical research to address key research questions such as: What are the core components and dimensions of risk culture? How can those general core elements of risk culture be structured to allow conceptual models about specific risk cultures to be empirically tested and, in turn, translated into practice-oriented studies? How do individual risk factors, the social context, and the specific risk situation interact to shape organizational risk culture? How can an organization’s risk culture be measured and evaluated? How can the insights from the psychology of risk and organizational culture be integrated into a comprehensive risk culture framework? By keeping the background of these research objectives in mind, the paper aims to contribute to the existing literature on risk culture by providing a robust and practical framework that enables groups, organizations, and societies to enhance their risk management practices, improve risk literacy, and foster a proactive risk culture that aligns with their values and objectives.

The methodological approach of this paper involves the development of a novel risk culture framework through an extensive literature review on the concept of risk culture, incorporating insights from related disciplines, particularly the psychology of risk and organizational culture. To conduct a thorough review of risk culture, multiple databases such as PubMed, PsycINFO, Web of Science, and Google Scholar were utilized due to the vagueness and lack of a clear definition of the concept of risk culture in current research. A combination of keywords and search terms such as “risk culture,”“risk framework,”“risk culture framework,”“culture structure,”“risk culture structure,”“risk climate,”“safety culture,”“organizational culture,”“health culture,”“health risk culture,”“psychology of risk,”“risk perception,”“risk assessment,”“risk judgment,” and “risk management” was employed to identify relevant scholarly articles, books, and reports. The search was not limited to a specific time frame but focused on the most recent studies up until the present. Furthermore, the reference lists of the selected articles were carefully examined to identify additional sources not captured by the initial search. Finally, our results widely match the results of a systemic literature review on risk culture, which was recently published and carried out independently from our research (Cimini, 2021).

We carefully analyzed the chosen literature to identify important ideas, theories, and research findings about risk culture, paying particular attention to its psychological and organizational aspects. By synthesizing and integrating these diverse sources, the paper presents a comprehensive and robust risk culture framework that can serve as a valuable tool for organizations in assessing, understanding, and managing risk within their specific contexts.

Creating the Risk Culture Framework

As a first step toward building an integrative framework for risk culture, related theories, and models such as those from the areas of culture, risk theory, safety culture, and risk climate (for an overview, see: Guldenmund, 2000) should be assessed and incorporated. Different influencing dimensions can be both relevant and helpful in understanding the driving factors of a social entity and its members’ risk attitudes, perceptions, and behaviors. Such dimensions have a bidirectional nature as they can either be seen as the objects of attitudes and, therefore, describe how culture forms behavior, or as the structuring components on which a specific culture is built. While for example, different models of safety culture incorporated different dimensions like “software,”“people,” and “risks” (Cox & Cox, 1991), or “person,”“behavior,” and “environment” (Geller, 1994), they all acknowledged the impact of individual, social, and environmental factors. In line with other researchers (e.g., Carretta et al., 2017; Cornia et al., 2016; Power et al., 2013; Previati, 2017), we argue that risk attitudes, perceptions, assessments, and behavior are influenced by factors of the self, social context, and environment (for an overview, see: Raue et al., 2018). Accordingly, we propose three influence domains, specifically, the characteristics of the person, the social context, and the risk situation, as the first structural elements in our Framework.

The work of Schein (1988, 2017) is then used as a base to structure cultural elements. Schein introduced a well-established three-layered organizational culture model that differentiates between artifacts, espoused values and beliefs, and basic assumptions. These three layers of organizational culture are characterized by a reduction in observability and accessibility. Expanding on Schein’s model, which is based on the mechanism of shared learning, values, and beliefs, we further incorporate influencing factors of risk perception, behavior, and situation. To do this, we propose three layers corresponding to yet broader factors beyond the organizational context that drive risk perception and behavior, namely observable, non-observable, and implicit factors. Observable factors correspond to artifacts (Schein, 1988, 2017) and comprise all characteristics, which are accessible from the outside, such as visible behavior and structures (see Table 1 for examples). Non-observable factors correspond to the layer of espoused values and beliefs from Schein’s model. This layer is less visible from the outside but discernible to insiders (e.g., group norms), explicitly assessable (e.g., personality), or calculable from derived data (e.g., likelihood). The third layer, implicit factors, includes basic assumptions, which are often described as the essence or DNA of a group’s culture. Characteristics of this third layer are neither immediately recognizable to insiders nor outsiders but can be evaluated with indirect measures (Corneille & Hüter, 2020; Gawronski et al., 2020). Implicit factors shape perception, meaning, emotion, and behavior. Within one risk culture, behavior that contradicts such implicit factors is perceived as irrational or strange (Schein, 2017; Zeier Roeschmann, 2014). However, implicit factors can contradict formal structures, which can generally be routed to conflict and, specifically, to problematic risk culture.

Table 1.

Risk Culture Framework.

Cultural level	Person	Influence domain
Cultural level	Person	Social context	Risk situation
Observable factors	Risk behavior Judgment and decision Social demographics Routines Physical state …	Composition Hierarchy and leadership Narratives and legends Roles and responsibility Structures Formalized norms …	Domain Potential outcomes and severity Psychological distance Framing Time period of event …
Non-observable factors	Risk perception, awareness and attitude Values and beliefs Experience, knowledge, and competence Personality Self-efficacy and feelings …	Group norms and social identity Shared values and beliefs Trust in authorities Goals and expectations Shared experience and group history …	Likelihood Uncertainty Complexity Emotionality Ambiguity …
Implicit factors	Basic assumptions and worldview Basic needs Cognition Loss aversion Learned carelessness …	Social comparison Conformity and risk polarization Hidden profile Groupthink Social proof …	Anchoring Familiarity Information redundancies Selective exposure to information …

Note. Possible factors in all cells are not restricted to the listed examples, which are based on empirical research.

The proposed integrative Risk Culture Framework combines the three domains of risk influences (i.e., person, social context, and risk situation) with three layers of culture, which represent decreasing accessibility (i.e., observable, non-observable, and implicit) in a 3 × 3 grid (see Table 1). Each influence domain contains all cultural layers, and all layers can be applied to all domains. To map a specific risk culture (e.g., a population’s risk culture regarding health and longevity; an organization’s risk culture regarding emerging risks and market changes), this matrix comes alive by filling each cell with relevant factors from different research strands, disciplines, and approaches. To list all the possible hypothetical factors would be excessive and beyond the scope of this article. Instead, a shortlist of evidence-based examples of potential influence factors is presented that stems mainly from psychological research. Accordingly, factors displayed in Table 1 are exemplary and descriptive for the respective levels, without being generally valid for all fields of risk cultures. Cells of the grid are neither intended to contain selectively restricted factors nor to be understood as rigid units but are designed to be continuums.

Risk culture can be understood as a dynamic model in which all aspects can mutually interact (cf. Zeier Roeschmann, 2014). Consequently, none of the suggested variables is dependent or independent per se. Instead, the respective scope of interest determines whether a particular variable is seen as dependent or independent. For example, since risk culture shapes risk behavior, most practitioners and researchers might be interested in risk culture as a means to understand and steer risk behavior and resulting outcomes. Consequently, they can focus on risk behavior as a dependent variable of a respective risk culture (e.g., Gardner & Steinberg, 2005; Jessor, 1992). Alternatively, risk behavior can function as a declarative characteristic and, therefore, is an independent variable of risk culture since past behavior shapes beliefs and basic assumptions of what is appropriate. For example, a particular health behavior could be viewed as a determinant of a risk culture affiliation or subgroup. Consequently, the aspect of risk behavior could be used as a dependent or independent variable of risk culture.

In addition, risk culture itself is dynamic. Social groups and organizations change the way they perceive, assess, and handle risk so their risk culture thereby changes over time. Recently the COVID-19 pandemic has shown how social groups and organizations adapt their perception, assessment, and management of risk over time, leading to changes in their overall risk culture. Similar events and developments can occur in various forms. For example, seat belts were rarely used in most Western countries before the 70s (cf. Fhanér & Hane, 1973). The societal risk culture accepted the risk of driving without a seatbelt at that time, and an adequate behavior was not to buckle up. Traffic-related risk culture changed dramatically over the following decades, mainly due to compulsory seat belt use and its enforcement by law (Steptoe et al., 2002). Although risk culture is quite stable over time and has fixed structures, it is a dynamic construct as it is changeable and adaptive to situations. Accordingly, risk culture not only shapes risk perception and behavior but understanding, assessing, and influencing risk culture could provide a powerful risk analysis and management tool. Understanding a current risk culture will allow for effective intervention and, in so doing, affect sustainable changes in risk culture.

Moreover, the introduced RCF enables integrations of existing approaches to risk management in general and risk culture in particular. For example, the practice of enterprise risk management, that is the assumption that risks are measurable, determinable, and calculable in a rational manner, comes along with specific conditions like organizational guidelines, structures, and understanding of risks (Mikes, 2009). These conditions can be understood as part of a risk culture and integrated into the grid of the RCF. Up to now, both the understanding of risk culture and its application in research have a strong background in organizational culture and corporate risk culture, and encompass corporate workflows or processes (cf. Lo, 2015; Palermo et al., 2015; Shefrin, 2016; Wood & Lewis, 2017). However, existing models of risk culture often describe only single factors to distinguish between different risk cultures. Such distinguishing factors comprise group cohesiveness, power distance (Douglas & Wildasvsky, 1982), disaster framing, trust in authorities, or blaming (Cornia et al., 2016). These models regularly provide a narrow view of risk culture by, for example, lacking implicit factors. The RCF interprets these guidelines, structures, and understanding as elements of the organization’s risk culture but aims for a more comprehensive view of risk culture and enables integration of such distinguishing factors.

In summary, risk culture comprises different cultural layers of accessibility such as shared observable, non-observable, and implicit factors concerning risk within social entities like societies, organizations, groups, or individuals as members of the social entity. The shared cultural understanding and handling of risks stem from factors of the person, the social context, and the risk situation. Risk culture is dynamic since the specific risk culture of a social entity is stable and structured yet changeable over time. This dynamism accounts for a reciprocal interaction: social entities can construct and adapt their risk culture so that risk culture has an enduring impact on risk perception, assessment, and behavior of social entities and their members.

Exemplary Applications of the RCF

Three hypothetical examples are given below to demonstrate the potential applications of the RCF and highlight different scopes (i.e., society, organization, individual) and contexts (i.e., health, business, outdoor activity) of the Framework. Furthermore, the examples illustrate the modus operandi of the RCF in different scenarios from intervention planning, post-hoc analysis, and benchmarking, to individual decision-making. It should be noted that to increase validity, the evaluation of the RCF structure should be part of a broader data analysis when applying a new measure for a specific risk culture.

The first example addresses a macro level and uses obesity as a complex risk, which not only affects the well-being of the individual but also has societal and macro-economic consequences, like additional costs for healthcare, days absent, and tax revenue (OECD, 2019). Obesity is on the rise despite increased awareness of its downsides and improved availability of preventative measures. In the context of the RCF, one assumption could be that the weight-related risk culture of people at risk of being overweight differs from people who are not at risk. Based on existing empirical research, a measure of weight-related risk culture can be constructed by applying the most influential factors (e.g., based on reported effect sizes in meta-analyses, expert elicitation, or their fit to a theoretical or methodological definition) to the 3 × 3 grid of the RCF. If cells of the grid remain either uncovered or unrepresented—which seems particularly likely for the implicit layer—according measures need to be created and pretested (Corneille & Hütter, 2020; Gawronski et al., 2020). Data analysis could either focus on the differences in the risk culture between overweight and non-overweight participants or further explore the sub-risk-culture/s (e.g., level of education, region, or age). Network analyses (e.g., Thoma et al., 2020) could facilitate the detection of central relevant factors, interdependencies of factors, and differences between risk cultures of subgroups. Furthermore, exploring the risk culture of different sub-groups could unravel potential gaps between scientific knowledge on weight-relevant factors and convictions of sub-groups regarding their weight. Knowledge of both the central factors and knowledge-conviction differences for the different subgroups should facilitate decision-makers in customizing intervention measures and communicating relevant information.

The second example addresses the meso level and illustrates problematic risk culture in organizations. Organizations like companies face various internal and external risks, which in the case of a fictitious medium-sized biotech enterprise can be related to a lack of skilled workers, the fast transformation from a small start-up to medium-size, changes in regulations or an unreliable supply chain (cf. Brustbauer, 2016). Regardless of the specific risks that a company could face, the risk culture of the company needs to recognize and address the risks for effective risk management in the organization (Nguyen et al., 2019; Sinha & Arena, 2020). Otherwise, the company will lack resilience and face fundamental problems in handling these risks in the future. Application of the RCF in this case would provide a comprehensive measure of how the company assesses and handles risk. Comparing potential risks with the existing risk culture works like a stress test and enables the detection of areas for improvement. Using the RCF in this context would provide a thorough analysis of past corporate failures or establish benchmarks for appropriate risk cultures at particular branches.

The third and final example addresses the risk perception and behavior of an individual as a social group member. Imagine an individual skier planning to freeride an off-piste mountain hillside where she has the risk of triggering an avalanche. The risk of avalanches can be roughly estimated by simple rules of thumb based on the current risk level provided by the regional avalanche report and the steepness of the mountain hillside in question. However, as research suggests (e.g., McCammon, 2004; Raue et al., 2017), many non-snow factors such as biases in perception, group dynamics, or bodily states can deteriorate decision-making in the mountains. Applying the RCF, in this case, could help improve personal decision-making by considering relevant influencing factors in the decision-making process beyond just the avalanche risk level. The skier in our example can work through the 3 × 3 grid of the RCF and reflect on the importance and influence of each cell on his current decision-making process. About herself, the skier could reflect on her general risk propensity, competence, current physical fitness, past experiences, or willingness to abstain. About social context, that is, her membership in the social entity of skiers, she could reflect on group norms, social recognition for wild rides, group rituals, group pressure, or shared learning experiences. About the risk situation, she could reflect on the severity and consequences of an avalanche on this specific hillside, familiarity with similar snow conditions, the level of complexity of the situation, exposure to information, and potential biases about that information. These reflections should improve the overall quality of decision-making by reducing the likelihood of overlooking important influential factors. In this example, the RCF serves as an ad hoc tool. Furthermore, an RCF-based study could also explore the most important factors for decision-making in a specific context like avalanche assessment. It is envisaged that completing the RCF grid accordingly would provide an effective decision-making tool, which can be used as a tick-list in a standard operating procedure.

Discussion

Limitations and Future Research

This research comes along with two limitations worth considering of which the most important for future research is its lack of empirical validation. Though founded on empirical research, one should keep in mind that the RCF provides only a theoretical framework. Therefore, as an avenue toward validation, there is a need for further research to focus on the empirical evidence for the structure of the RCF and its replication in different contexts. During the course of comprehensive validation, the inclusive nature of the RCF allows for testing the overall structure of the framework as well as for exploring the amount of explained variance of single factors. Low-performing factors can be easily replaced with sufficiently performing factors.

Construct validation of the RCF was beyond the scope of this manuscript and is suggested as a next step for research. Issues that should be considered in such research are outlined here. The first consideration is to include a subject of risk. Options are, at least in part, dependent on variations in the relevant risk culture. Furthermore, the risk should stem from multiple and interacting factors at different levels of accessibility. Existing empirical research on the subject would be beneficial in identifying and measuring these relevant factors. For example, risks that are related to road traffic, health or sustainability, and environmental protection would be suitable. Many (if not all) people (and, therefore, potential participants) are affected in these scenarios, the issues are well researched, and they comprise many aspects of risk assessment and behavior, which are transferable to other contexts. A second consideration should be the scope of the risk subject: this should not be too narrow and, therefore, affect only a specific group of people (e.g., misuse of Whiskey) and yet not too broad (e.g., consuming beverages) to allow for test economy and transferability of results to other contexts. A very general scope also contains the risk of evening out the structures of specific risk cultures. A third consideration is the distinction of risk culture, which can specifically relate to a social entity (e.g., parents with young kids), refer to time (e.g., the course of a pandemic), or an outcome (e.g., body mass index). Having a narrow focus on a specific risk culture enables the detection of specific features endemic to this risk culture but could hamper transferability to other contexts. Therefore, a first validation study should choose a wider focus. A fourth and final consideration refers to methodology. In general, the framing, focus, and wording of the measures need to reflect the scope and distinction of the selected risk (e.g., the relevance of nutrition on longevity in one’s region). Moreover, the means of measurement needs to fit the cultural level of accessibility. Observable factors can be assessed with accessible data (e.g., the constitution of the board, formal structure) and/or with structured interviews or self-reported, explicit questionnaires (e.g., risk behavior). The latter measures are appropriate for non-observable factors as well (e.g., risk perception). In contrast, implicit factors cannot be measured explicitly, which is why implicit measures are needed. This leads to the second limitation.

A second limitation that will further emerge whilst applying the RCF concerns the measurement of implicit factors. On the one hand, implicit factors can have a crucial influence on attitudes and behavior and, therefore, must be considered in any risk culture approach. On the other hand, from a methodical point of view, implicit factors require implicit measures. In the absence of standardized methods and only limited transferable measurement instruments, a transfer of the RCF to survey instruments needs to account for differing accessibilities and the methodological peculiarities of implicit factors. Therefore, developing easy-to-use measures for implicit factors might, in some fields, present some challenges (see Corneille & Hütter, 2020; Gawronski et al., 2020; Hahn & Goedderz, 2020). One recommended approach is to address implicit factors by using vignettes (Johnson & Swedlow, 2019). These vignettes usually comprise text describing a specific situation and can be illustrated with pictures. Specific aspects of the situation can be evaluated by questionnaire items (e.g., “How important/relevant is the following regarding your own XY behavior?”).

After testing the full structure of the RCF in different contexts, future research could also address variations of risk cultures and their effectiveness in handling risks in specific contexts such as health and longevity, environmental protection, financial crisis, or globalization. When sufficient data and measurements or guidelines for the measurement of context-specific risk cultures are available, the RCF could be used to align methodological consistency in risk culture research and, thus, define benchmarks for adequate “risk-culture-ship,” for example, those demanded by the financial regulatory authorities (Ashby et al., 2012). Such benchmarks for risk cultures will serve the need for practical risk analysis guidance (Aven & Flage, 2020): they enable the detection of potential pitfalls and weaknesses in a specific risk culture and guide evidence-based, customized intervention to foster resilience and improvement. However, we acknowledge that there is no such thing as a perfect and everlasting risk culture, and the measure of any specific risk culture of a social group or organization needs to evolve to fit current and emerging risks. Therefore, benchmarks can only reflect a snapshot and need continuous evaluation.

Implications

This work holds great importance for both theory and practical application. To effectively manage and conceptualize risk, it is essential to have a comprehensive understanding of all the factors that impact stakeholder involvement with it. Therefore, a holistic and integrated approach is necessary. Considering only selected factors in theory, research, or practice is warranted to understand specific mechanisms and effects but is prone to produce fragmentary results. To achieve a holistic understanding, the suggested risk culture framework proposes considering various influencing dimensions, such as the individual’s risk factors, the social context, and the specific risk situation (Raue et al., 2018). Additionally, it is crucial to acknowledge the different levels of accessibility that these risk factors can possess, namely observable, non-observable, and implicit factors (Schein, 1988, 2017). As illustrated with three hypothetical examples above (see heading: Exemplary Application of the RCF), by adopting this comprehensive understanding, societies, organizations, and individuals can gain insights into their risk situations and derive effective measures for assessing and managing risks. The suggested risk culture framework facilitates the identification of context-specific risk drivers, while also considering cross-contextual factors identified by previous risk research. Integrating context-specific and cross-contextual elements enhances risk literacy within specific industries and enables synergies and learning opportunities across different sectors.

Conclusions and Outlook

In conclusion, the RCF provides a fruitful approach to improved theoretical clarity on risk culture. It helps to analyze risks in complex contexts and offers a basis for comparing risk culture research. This is achieved by the Framework’s ability to integrate different research strands and approaches. Relevant factors that contribute to a topic’s risk culture can be identified through a literature review on a specific topic and then assigned to the matrix of the RCF. In doing so, vacant or under-represented cells become evident. Factors within a cell can be ranked to attain an appropriate measure. New findings on context-relevant factors can be added ad-infinitum, and, thus, both the framework’s content of a specific risk culture and its applications can be further developed. The framework can even facilitate learning from disciplines beyond those commonly used (e.g., developmental evolution; Laubichler, 2019; Renn et al., 2022). Hereby, the matrix of the Framework serves as a blueprint for assigning new approaches. In addition, in the future, the RCF can facilitate the development of comprehensive measurements, help detect effective and inappropriate risk cultures and guide decision-making.

Footnotes

Declaration of Conflicting Interests

The author(s) declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.

Funding

The author(s) disclosed receipt of the following financial support for the research, authorship, and/or publication of this article: Part of this research was supported by grant F.16776/5-2019 from the Tyrolean Science Foundation, Austria.

Ethics Statement

Not applicable.

ORCID iD

Bernhard Streicher

References

Ashby

Palermo

Power

(2012). Risk culture in financial organisations: An interim report (pp. 1–25). Center for Analysis of Risk and Regulation, The London School of Economics and Political Science.

Aven

(2019). The call for a shift from risk to resilience: What does it mean? Risk Analysis, 39(6), 1196–1203. https://doi.org/10.1111/risa.13247

Aven

Flage

(2020). Foundational challenges for advancing the field and discipline of risk analysis. Risk Analysis, 40, 2128–2136. https://doi.org/10.1111/risa.13496

Aven

Renn

(2009). On risk defined as an event where the outcome is uncertain. Journal of Risk Research, 12(1), 1–11. https://doi.org/10.1080/13669870802488883

Aven

Ylönen

(2021). How the risk science can help us establish a good safety culture. Journal of Risk Research, 24, 1349–1367. https://doi.org/10.1080/13669877.2020.1871056

Banks

(2012). Risk culture: A practical guide to building and strengthening the fabric of risk management. Palgrave Macmillan.

Brustbauer

(2016). Enterprise risk management in SMEs: Towards a structural model. International Small Business Journal, 34(1), 70–85. https://doi.org/0.1177/0266242614542853

Carretta

Fiordelisi

Schwizer

(2017). Risk culture in banking. Palgrave Macmillan Studies in Banking and Financial Institutions.

Cimini

(2021). A systematic and bibliometric review on risk culture: A novel theoretical framework. Journal of Risk Finance, 22(2), 153–168. https://doi.org/10.1108/JRF-06-2020-0123

10.

Corneille

Hütter

(2020). Implicit? What do you mean? A comprehensive review of the delusive implicitness construct in attitude research. Personality and Social Psychology Review, 24(3), 212–232. https://doi.org/10.1177/1088868320911325

11.

Cornia

Dressel

Pfeil

(2016). Risk cultures and dominant approaches towards disasters in seven European countries. Journal of Risk Research, 19(3), 288–304. https://doi.org/10.1080/13669877.2014.961520

12.

Cox

(1991). The structure of employee attitudes to safety: A European example. Work and Stress, 5(2), 93–106. https://doi.org/10.1080/02678379108257007

13.

Douglas

Wildavsky

(1982). Risk and culture: An essay on the selection of technical and environmental dangers. University of California Press.

14.

Fhanér

Hane

(1973). Seat belts: Factors influencing their use: A literature survey. Accident Analysis & Prevention, 5(1), 27–43. https://doi.org/10.1016/0001-4575(73)90003-1

15.

Fritz-Morgenthal

Hellmuth

Packham

(2016). Does risk culture matter? The relationship between risk culture indicators and stress test results. Journal of Risk Management in Financial Institutions, 9(1), 71–84.

16.

Gardner

Steinberg

(2005). Peer influence on risk taking, risk preference, and risky decision making in adolescence and adulthood: An experimental study. Developmental Psychology, 41(4), 625–635. https://doi.org/10.1037/0012-1649.41.4.625

17.

Gawronski

De Houwer

Sherman

(2020). Twenty-five years of research using implicit measures. Social Cognition, 38, S1–S25. https://doi.org/10.1521/soco.2020.38.supp.s1

18.

Geller

E. S.

(1994). Ten principles for achieving a total safety culture. Professional Safety, 39(9), 18–24.

19.

Guldenmund

F. W.

(2000). The nature of safety culture: A review of theory and research. Safety Science, 34(1–3), 215–257. https://doi.org/10.1016/S0925-7535(00)00014-X

20.

Gupta

Liu

(2017). Addressing the risk culture challenge in banking using text analytics (pp. 1–32). Lally School of Management at Rensselaer Polytechnic Institute.

21.

Hahn

Goedderz

(2020). Trait-unconsciousness, state-unconsciousness, preconsciousness, and social miscalibration in the context of implicit evaluations. Social Cognition, 38, 115–134. https://doi.org/10.1521/SOCO.2020.38.SUPP.S115

22.

Hartnell

C. A.

A. Y.

Kinicki

(2011). Organizational culture and organizational effectiveness: A meta-analytic investigation of the competing values framework’s theoretical suppositions. Journal of Applied Psychology, 96(4), 677–694. https://doi.org/10.1037/a0021987

23.

Institute of International Finance. (2009). Risk culture.

24.

Janis

(1972). Victims of groupthink: A psychological study of foreign-policy decisions and fiascoes. Houghton Mifflin.

25.

Jasanoff

(1999). The songlines of risk. Environmental Values, 8(2), 135–152. https://doi.org/10.3197/096327199129341761

26.

Jessor

(1992). Risk behavior in adolescence: A psychosocial framework for understanding and action. Developmental Review, 12(4), 374–390. https://doi.org/10.1016/0273-2297(92)90014-S

27.

Johnson

B. B.

Swedlow

(2019). Cultural theory’s contributions to risk analysis: A thematic review with directions and resources for further research. Risk Analysis, 40(3), 429–455. https://doi.org/10.1111/risa.13299

28.

Laubichler

(2019, July 23–26). Evolution: 3.5 billion years of risk management [Keynote]. Society for Risk Analysis Europe Conference, Potsdam, Germany. http://www.sraeurope.eu/Content/Images/ContentImages/20191124-13110872.pdf

29.

Lewin

(1943). Psychology and the process of group living. Journal of Social Psychology, 17(1), 113–131. https://doi.org/10.1080/00224545.1943.9712269

30.

A. W.

(2015). The gordon gekko effect: The role of culture in the financial industry (pp. 1–46). National Bureau of Economic Research.

31.

McCammon

(2004). Heuristic traps in recreational avalanche accidents: Evidence and implications. Avalanche News, 68(1), 42–50.

32.

McConnell

P. J.

(2013). A risk culture framework for systematically important banks. Journal of Risk and Governance, 3(1), 23–68.

33.

Mikes

(2009). Risk management and calculative cultures. Management Accounting Research, 20(1), 18–40. https://doi.org/10.1016/j.mar.2008.10.005

34.

Nguyen

D. D.

Nguyen

Sila

(2019). Does corporate culture affect bank risk-taking? Evidence from loan-level data. British Journal of Management, 30(1), 106–133. https://doi.org/10.1111/1467-8551.12300

35.

OECD. (2019). The heavy burden of obesity: The economics of prevention. OECD Health Policy Studies, OECD Publishing. https://doi.org/10.1787/67450d67-en

36.

Ostroff

Kinicki

A. J.

Muhammad

R. S.

(2013). Organizational culture and climate. In Weiner

I. B.

Schmitt

N. W.

Highhouse

(Eds.), Handbook of psychology. Industrial and organizational psychology (Vol. 12, pp. 643–676). Wiley.

37.

Palermo

Power

Ashby

(2015). Searching for risk culture: Sites and dynamics (pp. 1–41). London School of Economics, Department of Accounting.

38.

Power

Palermo

Ashby

(2013). Risk culture in financial organisations: A research report (pp. 1–103). London School of Economics, Centre for Analysis of Risk and Regulation.

39.

Previati

(2017). People first: Risk culture swings into action. In Carretta

Fiordelisi

Schwizer

(Eds.), Risk culture in banking (pp. 125–154). Palgrave Macmillan Studies in Banking and Financial Institutions.

40.

Raue

Lermer

Streicher

(Eds.). (2018). Psychological aspects of risk and risk analysis: Theory, models, and applications. Springer. https://doi.org/10.1007/978-3-319-92478-6

41.

Raue

Streicher

Lermer

Frey

(2017). Being active when judging risks: Bodily states interfere with accurate risk analysis. Journal of Risk Research, 20(4), 445–462. https://doi.org/10.1080/13669877.2015.1057206

42.

Renn

Laubichler

Lucas

Kröger

Schanze

Scholz

R. W.

Schweizer

P.-J.

(2022). Systemic risks from different perspectives. Risk Analysis, 42, 1902–1920. https://doi.org/10.1111/risa.13657

43.

Ring

P. J.

Bryce

McKinney

Webb

(2016). Taking notice of risk culture – the regulator’s approach. Journal of Risk Research, 19(3), 364–387. https://doi.org/10.1080/13669877.2014.983944

44.

Schein

E. H.

(1988). Organizational culture (pp. 1–50). Massachusetts Institute of Technology, Sloan School of Management.

45.

Schein

E. H.

(2017). Organizational culture and leadership (5th ed.). John Wiley & Sons.

46.

Schmidt

Heffernan

Ward

(2020), Why we cannot explain cross-cultural differences in risk assessment. Aggression and Violent Behavior, 50, 101346. https://doi.org/10.1016/j.avb.2019.101346

47.

Schneider

Ehrhart

M. G.

Macey

W. H.

(2013). Organizational climate and culture. Annual Review of Psychology, 64, 361–388. https://doi.org/10.1146/annurev-psych-113011-143809

48.

Schweizer

P.-J.

(2019). Systemic risks: Concepts and challenges for risk governance. Journal of Risk Research, 24(1), 78–93. https://doi.org/10.1080/13669877.2019.1687574

49.

Sheedy

Garcia

Jepsen

(2021). The role of risk climate and ethical self-interest climate in predicting unethical pro-organisational behaviour. Journal of Business Ethics, 173, 281–300. https://doi.org/10.1007/s10551-020-04542-0

50.

Sheedy

Griffin

(2018). Risk governance, structures, culture, and behavior: A view from the inside. Corporate Governance: An International Review, 26(1), 4–22.

51.

Sheedy

Griffin

Barbour

J. P.

(2017). A framework and measure for examining risk climate in financial institutions. Journal of Business and Psychology, 32(1), 101–116. https://doi.org/10.1007/s10869-015-9424-7

52.

Shefrin

(2016). Behavioral risk management: Managing the psychology that drives decisions and influences operational risk. Springer.

53.

Sinha

V. K.

Arena

(2020). Manifold conceptions of the internal auditing of risk culture in the financial sector. Journal of Business Ethics, 162, 81–102. https://doi.org/10.1007/s10551-018-3969-0

54.

Steptoe

Wardle

Fuller

Davidsdottir

Davou

Justo

(2002). Seatbelt use, attitudes, and changes in legislation: An international study. American Journal of Preventive Medicine, 23(4), 254–259. https://doi.org/10.1016/S0749-3797(02)00513-5

55.

Thoma

M. V.

Höltge

Eising

C. M.

Pfluger

Rohner

S. L.

(2020). Resilience and stress in later life: A network analysis approach depicting complex interactions of resilience resources and stress-related risk factors in older adults. Frontiers in Behavioral Neuroscience, 14(216), 580969. https://doi.org/10.3389/fnbeh.2020.580969

56.

Tversky

Kahneman

(1974). Judgment under uncertainty: Heuristics and biases. Science, 185, 1124–1131.

57.

Wood

Lewis

(2017). Risk culture development within the Caribbean development bank. The Business and Management Review, 8(4), 221–233.

58.

Zeier Roeschmann

(2014). Risk culture: What it is and how it affects an insurer’s risk management. Risk Management and Insurance Review, 17(2), 277–296.

59.

Zeng

Jiang

Yuan

(2020). Environmental risk perception, risk culture, and pro-environmental behavior. International Journal of Environmental Research and Public Health, 17, 1750. https://doi.org/10.3390/ijerph17051750

The Risk Culture Framework: Introducing an Integrative Framework for Holistic Risk Analysis

Abstract

Keywords

Risk Culture and Shortcomings of Current Concepts

Research Questions and Methodological Approach

Creating the Risk Culture Framework

Exemplary Applications of the RCF

Discussion

Limitations and Future Research

Implications

Conclusions and Outlook

Footnotes

Declaration of Conflicting Interests

Funding

Ethics Statement

ORCID iD

References