“The Role of Leadership in Establishing a Desired Risk Culture”

(1)

“The Role of Leadership in Establishing

a Desired Risk Culture”

Fenna de Jong S2183374 MSc BA Change Management Supervisor: Dr. I. Maris – de Bresser Co-assessor: Dr. J.F.J. Vos 15th January 2016 Words: 11.956

Abstract

Nowadays, many organizations focus on the establishment of a risk culture to prevent risk failures from happening again. In this study, the role of leadership in the establishment of the desired risk

culture as stated by the Institute of Risk Management (IRM) is investigated. This research was conducted in the advisory department of a multinational audit firm. It captures results from two leaders who were shadowed for three weeks, 18 interviews with both leaders and employees, as along

with 143 observations. This paper follows a practice based approach, wherein the results show that leadership in the context of risk culture is a concept that influences the establishment of the desired risk culture by influencing the workplace (monitoring and guiding employees), the creation of shared

(2)

2

1. INTRODUCTION

Responding to the ever-changing market is essential for the survival of today's organizations. Therefore, organizations are regularly faced with the challenge of developing effective strategies for implementing and managing change (Beer and Nohria, 2000). Change management deals with interventions that focus on people, organizational structures, and human resource management policies (Markus, 2004). Many change initiatives are dealing with organizational culture, since it is argued that culture is the prime determinant of organizational performance (Peters and Waterman, 1982). Furthermore, leadership plays an important role in managing and establishing this organizational cultural change (Burnes, 2014).

According to Handy (1986), strong cultures make strong organizations. However, not all organizational cultures suit all purposes or people. Many authors have attempted to categorize the various types of culture. For example, Handy (1986) distinguishes between a power culture, role culture, task culture, and a person culture. Another type of culture is risk culture, focusing on risk-taking and risk control activities (Power et al., 2013). Risk culture refers to the values, beliefs, knowledge and understanding about risks, shared by a group of people with a common purpose (IRM, 2012). It significantly affects strategic risk decisions and therefore influences the performance of the organization. All organizations face risks due to unexpected changes in their environment, and have to take risks in order to be innovative and to survive (Hain, 2011). Therefore, managing the risk culture of an organization is very important. Some even blamed the financial crisis on a “failure of conventional risk management in financial institutions” (Fraser and Simkins, 2010, p. 27). To prevent risk failures from happening again, to a larger extent the focus in risk management has become the human factor variables, such as ethical behavior of employees (IRM,2012).

Although much is written about the role of leadership in managing a culture, little has been written about the influence of leadership in the field of establishing a risk culture (Murray-Webster and Simon, 2006). Since risk culture is a relatively new concept in academic literature and the impact of leadership in risk culture deserves more attention, in the following section arguments are given for why this is needed.

1.1 Theoretical gaps and research aims

(5)

5

concretely. Therefore, one of the aims in this research is to study how the everyday work practices of leaders modify employees’ behavior.

As mentioned above, in the change process of creating the desired culture for the organization, leadership plays an important role (Burnes, 2014). There are different types of leadership, and different leadership styles have different effects on the management of organizational change (Higgins et al., 2003). For example, transformational leaders motivate followers to change by being an example and creating an inspiring vision for change (Cho et al., 2011). Moreover, transactional leaders use rewards to enforce the appropriate behavior (Bass et al., 2003). However, there is little and conflicting empirical evidence illustrating which observable behavior of leaders influences successful cultural change. Therefore, this study aims to discover which leadership styles are present in the organization under study, and which observable behavior plays a role in establishing the desired risk culture.

Although the topic of leadership has dominated the management literature for over 50 years, it still remains an elusive concept, which has spawned many different and conflicting theories resulting in a confusing picture (Burnes, 2014). Therefore, this research also aims to give new insight in the topic of leadership by investigating the role of leadership in cultural change.

Because of the interaction with the leader, employees can also influence the role of the leader, for example by resisting change. Therefore, different ways are found how leaders can influence the change process regarding this resistance. For example, Reicher et al. (1997) argued that keeping people informed and involved about ongoing changes led to higher commitment and lower cynicism of employees. This study attempts to clarify how leaders use tactics in practice and how employees will receive these tactics. Moreover, it is mentioned that two-way communication is helpful in the change process, seeing change from the employees’ perspectives (Treviño et al., 2006). Therefore, the perceptions of the employee regarding risk culture will also be considered.

Organizations need to possess the appropriate risk culture for their organization, since culture, and especially a risk culture, plays a significant role in the effectiveness of an organization (Ernst & Young, 2014). However, changing and managing a culture in order to create the desired culture is an extremely complex process since cultural change involves changing people’s minds as well as their behavior (Belias and Koustelious, 2014). However, culture exists of multiple layers ranging from artefacts to basic assumptions (Burnes, 2014). Therefore, it is said that culture as a whole cannot be changed but certain key elements, such as norms of behavior, can be influenced (Chatman and Cha, 2003). Smith and Graetz (2011) also note that once the right elements are changed, they will have a cumulative impact on deeper value structures.

(6)

6

However, cultural change is a social process where one should account for the interaction between leader and employee. Therefore, this research will aim to investigate how the steps of managing cultural change really unfold in actual behaviors, and in which way interaction between the leader and employee hinders or facilitates the establishment of a desired risk culture. Furthermore, the concept of interaction between leaders and employees is investigated many times using quantitative research methods (See: Ogbonna and Harris, 2000; Buch, 2014). This study addresses this concept using qualitative research methods in order to study the actual behaviors that make up the risk culture within this organization.

For this research, a case study has been conducted within the advisory department of a multinational audit firm.

1.2 A practice based study of leadership

Following these observations in theory and practice, the purpose of this research is to fill these gaps by providing insight into the role of the practice of leadership, ‘what they really do’, in establishing a desired risk culture. This will be studied through a practice lens (Corradi et al., 2010; Gherardi, 2009, 2010, Schatzki et al., 2001). The practice based approach states that practice consists of an array of activities, that leaders do things that are connected to each other in their everyday activities. Besides, it refers to people having a shared understanding of what they are doing, and by communicating, interacting and negotiating, this shared understanding is achieved (Corradi et al., 2010). Furthermore, practice is a social practice, which means that leaders continue the practice by performing activities in the organization. However, since it is said that practices are interconnected, these practices can affect the practices of others, such as of employees. In this research, the practice of leadership in establishing a desired risk culture is investigated in order to gain more insights into how leadership influences the establishment of a desired risk culture. Until now, leadership has been studied from a top down perspective (See: Gerstner and Day, 1997; Burnes, 2014) and therefore this study will bring a unique contribution to the management literature by studying leadership through a practice lens. The question that guides this research is:

What role does the practice of leadership play in establishing a desired risk culture?

(7)

7

1.3 Significance of the study

This research will firstly contribute to literature by answering calls to study the concept risk culture in itself (Murray-Webster and Simon, 2006). Furthermore, the role of leadership behavior in the social process of establishing a desired risk culture is an unexplored area in literature. By taking a practice based approach this research contributes to management literature by answering research calls to study behavior analysis, emphasizing the importance of organizational leaders in establishing organizational practices that support prosocial behavior and eliminate aversive conditions within cultural systems (Houmanfar et al., 2015).

From a practical point of view, this research presents opportunities to gain more insights in the behavior of leaders in establishing a desired risk culture. By exploring how the social process of leadership behavior influences the establishment of a risk culture, and by investigating what people actually do in the process of establishing a desired risk culture through interacting, important inputs for organization design can be provided. Risk failures can be prevented when leaders know which behavior ensures appropriate risk-taking behavior of employees.

The remainder of this paper is structured in the following way. First, a background of the relevant literature is provided, followed by the empirical method used. Then, an overview of the results is presented. Finally, a discussion about the results is provided, together with theoretical and managerial implications, limitations of this study, suggestions for further research and the conclusion.

2. LITERATURE REVIEW

This section provides a background of the relevant literature regarding change management, cultural change, desired risk culture, and leadership.

2.1 Change management

The organizational change management approach relies on interventions that focus on people, organizational structures, and human resource management policies (Markus, 2004). The purpose of change management is to improve the organizational culture and/or performance (Markus, 2004). It deals with aspects such as changing organization culture and managers’ attitudes and behaviors. It is said that the success of a change is dependent on the performance of internal and external organizational change consultants, and especially on the performance of organizational managers (Markus, 2004). The focus of this study is on managing changes in a risk culture.

2.2 Cultural change in organizations: planned or emergent?

(8)

8

Furthermore, Cummings and Worley (2001) categorize culture as existing of four levels of awareness: artefacts, the visible symbols of culture; norms, the unwritten rules of behavior; values, prescribing what is important to employees; basic assumptions, which are taken for granted and prescribe the members how to think and feel about issues. Culture affects everybody in the organization, not only the highest managers (Burnes, 2014). It legitimizes certain forms of action and proscribes other forms of behavior (Turner, 1971).

To change culture, one must first understand what it is you want to change (Pettigrew, 1987). Cultural change is concerned with beliefs, traditions and human behavior within the organizational structure. Therefore, changing or managing culture is a large-scale undertaking and eventually all of the organizational tools for changing minds are needed (Belias and Koustelios, 2014). It consists of changing people’s minds as well as their behavior. Logically, this cannot be achieved in a rapid way. Rather, it can be seen as an emergent change process.

Emergent change is a long- term complex and incremental process of shaping how change unfolds over time (Caldwell, 2006). The assumption of emergent change is that change is not a linear process or an isolated event but a continuous, open-ended, cumulative and unpredictable process of aligning and re-aligning an organization to its changing environment (Burnes, 2014). The change of the risk culture in this research is also emergent. It is a continuous process where incremental steps are taken. Moreover, the end of the change project is not known since the goal of keeping a fit between the actual and desired risk culture is an ongoing and endless one.

2.3 A desired risk culture

Because an organization’s success depends on its people, these people also pose some of the biggest risks in an organization (Power et al., 2013). Nowadays, the focus in risk management has shifted more to the human factor variables, mental states and decision making. Risk culture describes the values, beliefs, knowledge, attitudes and understanding about risks, shared by a group of people with a common purpose, in particular the employees of an organization (IRM, 2012). All organizations need to take risks to achieve their objectives, and the prevailing risk culture within an organization can support or worsen the management of these risks (IRM, 2012). Sitkin and Pablo (1992, p. 21) note that "organizational members come to view their world through the lens of their organization's culture, which can distort their perceptions of situational risks, sometimes by overemphasizing risks or underemphasizing risk." This can have significant influence on the organizational performance.

(9)

9

1. “A distinct and consistent tone and consideration from the top, from the board and senior management, in respect of risk-taking and avoidance;

2. A commitment to ethical principles, reflected in a concern with the ethical profile of individuals and the application of ethics and the consideration of wider stakeholder positions in decision making;

3. A common acceptance through the organization of the importance of continuous management of risk, including clear accountability for and ownership of specific risks and risk areas; 4. Transparent and timely risk information flowing up and down the organization with bad news

rapidly communicated without fear of blame;

5. Encouragement of risk event reporting and whistle blowing, actively seeking to learn from mistakes and near misses;

6. No process or activity too large or too complex or too obscure for the risks to be readily understood;

7. Appropriate risk-taking behaviors rewarded and encouraged and inappropriate behaviors challenged and sanctioned

8. Risk management skills and knowledge valued, encouraged and developed, with a properly resourced risk management function and widespread membership of and support for professional bodies. Professional qualifications supported as well as technical training; 9. Sufficient diversity of perspectives, values and beliefs to ensure that the status quo is

consistently and rigorously challenged;

10. Alignment of culture management with employee engagement and people strategy to ensure that people are supportive socially but also strongly focused on the task in hand.”

Any organization should have the goal to create a risk culture as stated above, since organizations with inappropriate risk cultures will result in people acting totally opposite with stated policies and procedures or operating completely outside these policies (IRM, 2012). In this research, the risk culture of the organization under study was compared with the desired risk culture as stated above to discover how leaders play a role in this process.

2.4 Leadership behavior

(10)

10

managerial effectiveness is success in influencing people and developing their commitment to task objectives (Yukl, 1989). According to the reinforcement theory, behavior is a function of its consequences and leads people to pull toward behaviors that offer positive incentives and push away from behaviors associated with negative incentives (Luthans and Kreitner, 1985). Leaders can modify behavior through positive reinforcement, negative reinforcement, punishment and extinction (Miltenberger, 2011). An overview of these strategies is given in Table 1.

Table 1: Behavior modification strategies (Miltenberger, 2011)

However, for employees starting to change their behavior and opinions, it is the role of the leader to define the new vision and behave according to this vision (Cummings and Worley, 2001). Podsakoff, et al. (1996) and Schein (1992) also mention actions such as fostering the acceptance of group goals, high performance expectations, individualized support, intellectual stimulation, reacting to crises, giving formal statements and telling stories, legends and myths. Burnes (2014) argues that Senior Management often has a great influence on cultural changes. He explains that although successful cultural change is likely to emerge from a host of initiatives that arise in response to changes in the environment, elements of deliberation and guidance from Senior Management is necessary. In addition, Kotter (1996) believes that the overall direction of change is decided in a directive-coercive manner by Senior Management, and its implementation is played out in a collaborative-consultative manner by empowered managers and employees at all levels. In this process, leaders can conduct many leadership styles. Some well-known styles are shortly presented in Table 2. Keeping these different leadership styles in mind, this research examines which leadership behavior is present in establishing the desired risk culture, whereas I allow the discovery of new actions that are performed by leaders.

Strategy Description

Positive reinforcement Reward desirable behavior with a pleasant consequence

Negative reinforcement Reward desirable behavior with the avoidance of an unpleasant consequence Punishment Punish undesirable behavior with an unpleasant consequence

(11)

11

Table 2: Different types of leadership styles

2.5 Change, leadership and a desired risk culture

The role of leaders in change management is to initiate the change effort and to change their own management styles and behaviors in ways to lead the desired behaviors (Markus, 2004). People have a tendency to attribute much of the success of change processes to the actions and personality of individuals (Burnes, 2014). Sitkin and Pablo (1992, p. 22) state that top managers and organizational leaders play a particularly important role in influencing perceptions of risk-taking behavior and “even subtle cues from leaders about their preferences regarding risk can powerfully affect the risk perceptions of other decision makers”.

Burnes (2014) found that culture can be seen as an organizational variable, as something which can be manipulated. Therefore, the nature, direction, and impact of such manipulation is dependent on the skills and abilities of the leader. Schein (1986) found that leaders who encourage continuous learning and favor change help to define a flexible organizational culture. Furthermore, leaders exert a dominant influence on the direction of cultural norms and basic assumptions in institutional settings (Knippenberg and Hogg, 2003). In this research, the behavior of leaders and their

Leadership style Explanation

Transactional leadership Reflects the use of praise, rewards and resources to which followers agreed and worked for. It clarifies expectations and offers recognition when goals are achieved (Bass et al., 2003).

Transformational leadership Not based on a ‘give and take’ relationship, but on the leader’s personality, traits, and ability to make a difference through e.g., articulating of an energizing vision, and challenging goals. It helps followers believe in themselves and in their mission. It is about inspiring the values and ideals of followers and ultimately motivate followers to perform beyond expectations (Sun et al., 2014; Cho et al., 2011).

Directive leadership The leader defines, directs, and structures the roles and activities of employees toward the attainment of goals. It is about providing employees with a

framework for decision making and action alignment with the supervisor’s vision (Bass, 1990).

Participative leadership The leader makes employees feel free to participate actively in discussions, problem-solving, and decision making where employees have increased autonomy, power sharing and information sharing (Lawler, 1986).

Vertical leadership One individual leader emerges as the principal leader in a team. It is seen as a top-down influence process, where leadership is dependent upon the wisdom of an individual leader (Ensley et al., 2006).

Distributed leadership Leadership is carried out by the team as a whole, or with employee members

(12)

12

interactions with the employees will be studied to explore the role of leadership in establishing the desired culture.

3. METHODOLOGY

This chapter describes the research methodology of this study. First, the research approach is discussed, followed by the research method, data analysis and the quality criteria of the research methodology.

3.1 Research approach

The aim of this study is to gain insight into the role of leadership in establishing a desired risk culture. This research leads to the exploration of the influence of leadership behavior on establishing a desired risk culture. Therefore, this study is an explorative study (Merriam, 2002). To analyse and answer the main research question, qualitative research methods were employed.

According to Patton (1985), qualitative research is an effort to understand situations in their uniqueness as part of a particular context and the interactions there. Furthermore, it provides the platform to interpret and construct meanings from data, phenomena, and especially human behavior. As Merriam (2002) notices, the researcher can expand his understanding through nonverbal as well as verbal communication, process information immediately, clarify and summarize material, check with respondents for accuracy of interpretation, and explore unusual or unanticipated responses.

When little is known about a specific subject, or when a business phenomenon has not yet been addressed in academic literature, such as in this research, a theory development study is appropriate (Gill and Jonson, 2006). Furthermore, Aken et al (2012) state that the trigger for a theory development research is a business phenomenon that is generally recognized in companies, as in this research. Therefore, this research is a theory development study.

The theoretical approach used is a practice based approach (Corradi et al., 2010; Gherardi, 2009, 2010). All research methods were aimed on gaining insights in the real practice of leadership, focusing on the daily actions and interactions with leaders and employees in the organization.

(13)

13

The organization under study was an audit firm providing also advisory services, which is active worldwide. The case study was conducted within one department in organization X providing advisory services. Following a series of scandals, such as Enron (IRM, 2012), this department is very aware of risks and wants to help clients understand and address today’s most critical financial and reporting issues. When behaviors regarding risk culture are not appropriate, the consequences within this department are significant, such as reputation loss. Therefore, this department was perceived as suitable for this research.

3.2 Research methods

In this section, the research methods used in this study, being interviews, observations, and shadowing, are discussed.

Interviews

Interviews have been used, since only by talking to people, or reading what they have written, researchers can find out what they are thinking, and understand their thoughts (Myers, 2009). In total, 18 semi-structured interviews were conducted. Six interviews were conducted with Partners and Executive Directors since they were seen as leaders. Leaders who were seen by the Management Team as having totally different leadership styles were chosen, and were therefore suitable for creating a comprehensive picture of leadership behaviors. In literature, employees are treated as a homogeneous group (Burnes, 2014). However, in reality this group is not homogeneous and therefore this research distinguished between the different functions of employees, being Advisors, Senior Advisors, Managers, and Senior Managers. Three employees per layer were interviewed to get a diversified group of interviewees.

Semi-structured interviews were used in order to use an interview framework while allowing some flexibility and freedom in answering questions. Both leaders and employees were interviewed to compare different perspectives of the same concepts. The interviews had a duration of approximately 1,5 hour and were conducted within organization X. They were recorded to stay as close as possible to the data while transcribing. The transcripts were checked by the interviewees to review their correctness (Hagens et al., 2009). The interview questions were designed based on theory and using an interview scheme according to Emans (2004). The interview protocols can be found in Appendix A and B. The central concepts that were discussed were the interaction between leaders and employees, behavior of leaders, the influence of these actions on employee behavior, and diversity. For example, a question was: ‘How do leaders behave when your behavior is below minimum standards?’

Observations

(14)

14

joining trainings, client visits, meetings, working together in the same flex places, lunch breaks, coffee talks, and so on. The observations were conducted in a structured form, noticing who was observed when and where, and what was observed. An observational protocol was used where the focus points of the observation were mentioned. However, there was room for allowing new insights. This led to the observational protocol and codebook in Appendix C. All observations were transcribed into field notes and an outline of these notes was made. By doing observations, I became more aware of important social processes (Saunders et al., 2008), which is very helpful in the practice based approach. Furthermore, Saunders et al. (2008) suggest that a good explanation and interpretation can be made of the situation by conducting observations. These contributions are also applicable to the shadowing technique.

Shadowing

Shadowing is a research technique whereby a researcher closely follows a member of an organisation over a lengthy period of time (McDonald, 2005). In this research, two leaders were shadowed for three weeks when no interviews and observations were planned. Shadowing contributed to this research by viewing connected activities of the leader directly in the context where behavior was shown. This led to a more comprehensive and clearer picture of the practice of leadership, seeing in real life the array of activities leaders perform. While shadowing, important notes were made of the behaviors of the two leaders and an outline of these notes was made. The goal was to create an understanding about the leadership practice and its array of activities.

3.3 Data analysis

(15)

15

3.4 Quality criteria

In doing qualitative research, it is important to assure the quality of the gathered data. The quality is determined by both internal- and external validity and reliability (Aken et al., 2012).

Internal validity

Internal validity has been ensured by adding an overview of how the results are generated. Besides, triangulation, the use of multiple sources of data, has been used to maximize valid information (Jick, 1979). Furthermore, data gathering and data analysis can be biased by the researcher (Aken et al., 2012). Therefore, the questions of the interviews were cross-checked by two research experts, which resulted in some adjustments. Moreover, two pilot interviews were conducted in order to verify that the questions were clear and easily understood (Turner, 2010). This pilot interview was discussed afterwards with the supervisor within organization X leading to final adjustments. Furthermore, the research findings of the observations and shadowing were also discussed with her to ensure accurate findings.

External validity

External validity has been ensured by selecting leaders in such a way that all leadership behaviors could be researched, and by selecting employees randomly per layer. In this way, the results of the sample can be generalized to the population at large. Furthermore, by conducting research in the field, behaviors were studied in a natural setting and were therefore more accurate in terms of applying the results in the real world (Aken, 2012). The results are generalizable to the practice of leadership in the context of establishing a desired risk culture.

Reliability

(16)

16

4. RESULTS

This section provides an overview of the empirical findings of this research. First, the practice of risk culture is discussed, followed by the array of activities leaders execute. Then, the creation of shared understandings through interaction between leader and employee is presented, followed by the social effects of both practices (Corradi et al., 2010). To guarantee anonymity, leaders and employees are referred to through a number/letter allocation (Appendix D).

4.1 Practice of risk culture

This section describes the characteristics associated with the current risk culture. The change was not a radical change with a clear beginning and end. Rather, it was a continuous change, wherein some elements were appropriate already, and wherein some elements needed to be revised. I report a section of the continuous process as it is currently.

Since the organization is an audit firm, all projects are confidential. A3 illustrated this by stating that they sell trust, and therefore being risk averse is important. The majority of the interviewees recognized the importance of continuous risk management, where the incidents that happened at comparable organizations and the increase in close monitoring of regulators were the most heard causes to strengthen the risk culture. The majority of the interviewees saw reputation loss as one of the biggest risks for the organization. Therefore, the focus is highly on delivering quality to the client. L4 stated: ‘Next to a few computers and tables, knowledge is the only thing we have, so

what’s left is our name and we do everything to keep it high.’

In general, communication took place in an open and informal manner, and leaders were seen as easily approachable. People felt comfortable within the positive, helpful ambience of the risk culture. This was experienced as pleasant.

However, the information flow of risks and bad news was communicated very limitedly and not always directly, but was communicated indirectly in trainings to learn from. SM3 stated: ‘If it’s

something we all should learn from, it would be communicated in trainings to prevent it from happening again. It’s not like they share it in detail with everybody, making a fool of that person and creating anxiety within the department.’ The idea of not making a fool of anybody is friendly.

However, interviewees mentioned it is better to share risk information without mentioning the one who was responsible for the risk, to become aware of risk behavior. While shadowing a leader giving training, I observed him mentioning mistakes from the past in an anonymously way.

(17)

17

In addition, observations showed that diversity in the department is present in all forms: cultural background, personality, experience and many more. Besides, employees had different roles and therefore more than one leader. For example, Advisors primarily executed tasks they received from Senior Advisors or Managers who then reviewed this work. Surprisingly, a risk culture with diversity is not automatically stronger because of different perspectives, since diversity also caused different perceptions and lack of understanding. Diversity could also prevent sharing information because of not feeling comfortable with each other, as L4 suggested. This influenced the ambience at the workplace negatively. However, diversity was also seen as helpful in creating risk appropriate behavior by creating more perspectives of how to approach a project successfully.

Furthermore, the risk culture was characterized by flex places. A3 explained that people can sit everywhere in the building, and they are even allowed to work at home. However, this also created possible risks because of the lack of monitoring. A2 explained that people had the possibility of doing nothing when working at home, and nobody was there to monitor them. Therefore, trust was seen as another important characteristic of the risk culture.

Besides, risk management systems are present to guarantee quality because the times at which people worked could not be controlled. L5 explained that people are not rewarded for doing the right things, but for delivering the right results. The systems begin already in the hiring process, for example the fact that every potential new employee needs to conduct a personality test. L1 explained that the systems influenced work, by making choices following rules instead of working intuitively. In general, this was appreciated amongst the employees. However, critical questions were never asked anymore since the procedure was just being followed without thinking about the usefulness of actions. Besides, the systems were time consuming. This caused some projects to be less efficient or of less quality than would otherwise be possible, creating risks for the firm by delivering no such quality as the competitor did.

Moreover, observations showed that responsibilities of projects are shared amongst the team members in order to also share the possible risks associated. Therefore, everybody filled in their own tasks during the day. However, sometimes this was inefficient. Employees did tasks that were already done by someone else, which cost extra time and therefore created risks for exceeding the budget for that project.

Furthermore, observations showed that leaders not always had a comprehensive overview of the workplace causing different perceptions, because they were not aware of what really happened at the workplace. This resulted in stress and anger of the employees since they felt like they were not understood.

(18)

18

4.2 Leaders’ arrays of activities and styles

This section presents the activities leaders do to establish the desired risk culture. The majority of the interviewees were distinct about the important role leaders had in the establishment of a desired risk culture. The discovered array of activities are said to have one goal: creating commitment of ethical principles.

First, leaders played a large role in creating a pleasant ambience in the department. SA2 stated that by living the values, the leader created a positive feeling within the employees in order to motivate them. This proved the presence of transformational leadership in establishing a desired risk culture. As SA3 explained, the leader was always there for you, and simply took a break from his work to help you. They were seen as easily approachable and motivating.

Furthermore, to overcome the limited information flow of risks, observations showed that leaders organized weekly calls and meetings where information was openly shared and where everybody was updated about projects and issues at the workplace. Besides, shadowing illustrated that leaders shared mistakes and expressed the difficulty of tasks and talking about particular issues. However, still not all risk information was openly shared.

Moreover, leaders often did a self-evaluation to create consistency in messages about risk behavior. I observed this by witnessing that two leaders did a self-evaluation of the message conveyed during a risk management training. They criticized each other about what they said during the training and thought about what should be said next time in order to make the message more consistent. This led to a more consistent tone at the top.

However, leaders were not consistent in everything, since they influenced the fit between the risk culture and the people involved. They influenced the composition of the workforce by hiring appropriate people for the risk culture and firing people who were not able or not willing to comply to the desired risk behavior. I observed leaders adjusting their message to diverse people. L6 illustrated that leaders were in this way consistent in living the organisation’s values, however they adjusted the manner of how to bring the message. Besides, they organized informal events to let diverse employees feel comfortable being together.

Furthermore, to overcome the lack of monitoring, leaders embedded rules and procedures in the risk culture and provided incentives to employees such as feedback moments, ratings, bonuses, compliments, sanctions and resignations to motivate appropriate risk behavior and demotivate inappropriate risk behavior. This means, transactional leadership was recognized in the form of using positive reinforcement and punishment. However, L4 stated that forgiveness should always be present:

‘Without forgiveness, you create a punishment culture where nobody dares to share mistakes and where actions will become hidden.’ Incentives were based on delivered results and compliance to rules

and procedures.

(19)

19

and motivated employees to follow trainings. For example, I observed a leader impose an employee to do a training within two days and make clear that otherwise consequences for the employee would follow. Directive leadership was present here in the form of decision making by using rules and procedures and by imposing activities to employees. Besides, observations showed that leaders explained the importance and reasons of rules and procedures, and made clear what consequences decisions had for the organization and for employees’ own career path. For example, a leader explained the importance of always having a signature of the client before starting with a project.

To solve the problems created by shared responsibility, end responsibility always fell upon the leader and he therefore always reviewed work of employees and carried out the final check. Furthermore, he influenced the schedule of employees when needed, based on priority. However, his decisions were combined with extensive consultation, updating and alignment by involving employees. Employees had a significant autonomy in decision making by actively participating in discussions and in guiding lower levels, indicating participative and distributive leadership. Furthermore, leaders acted according to the values in order to create a feeling of shared responsibility. I shadowed a leader saying: ‘We are a firm together, thus we should help everybody making decisions.’ In this way the leader motivated employees to help each other during tasks, illustrating transformational leadership.

Furthermore, to create an overview of the business, leaders established an information flow going up and down, for example by telling employees to be the eyes of the department and asking them to tell the leaders everything that happens at the workplace. Besides, he organized weekly calls to prevent inefficient work practices and to stay updated about the projects and issues everybody was involved in.

Moreover, leaders minimized the possibilities of missing potential risks in projects. Leaders always had an overview of the whole project, which gave them the opportunity to give employees clear roles so that they knew what to do and to minimize ambiguities. I observed leaders having meetings where roles, prices, and time tables of project proposals were discussed. Here, directive leadership was present in the form of employees receiving instructions from the leader about what to do and when to hand in things. The leader made clear that employees should consult someone when things were not clear about rules or laws. Furthermore, leaders asked clients for clarification of the project in order to clarify ambiguities towards the employees. L4 illustrated his role by saying: ‘I

always break up the total project into pieces, so that the project becomes manageable. In this way, I can also create intermediate milestones, which is good for the motivation of the team.’ Besides,

leaders were familiar with particular issues because of guiding similar projects in the past and used this expertise to create clarity. Finally, leaders modelled appropriate risk behavior to express what risk behavior was expected. L4 noted: ‘Should I be more Catholic than the Pope? Maybe I do.. Then I can

(20)

20

4.3 Shared understandings through interaction

Within the department, no shared understandings were made about how the risk culture should look like, but shared understandings were reached about appropriate risk-behavior. In this section, the tactics that were used to influence the creation of shared understandings are presented.

In general, the interaction between leaders and employees facilitated the establishment of the desired risk culture by creating shared understanding about appropriate risk-taking behavior. Throughout my observations, interactions happened in different ways, such as face to face, by telephone, e-mail, or Skype.

During a meeting, I observed leaders discussing the importance of the connection between colleagues for creating a pleasant ambience, using arguments and expressing own experiences. A leader made clear that this was now done in the form of informal events. He mentioned that because of the positive ambience within the department and feeling comfortable, employees became more willing to put effort in the search for risks during tasks, and dared to communicate more open about risk information since they created goodwill for their colleagues and leaders.

The organized calls and meetings were very helpful for creating an overview of the business, by updating each other about what was going on in the workplace, about experienced difficulties and to see where people could help each other. M1 and L6 stated that commitment will never come without awareness, so everybody should be up to date about the risks in the organization. SA1 explained that when one is aware of what is going on in the organisation, you can adjust your risk behavior appropriately. Open risk communication was also seen as important for accepting changes in procedures and systems. By expressing the difficulty of tasks and issues to talk about, employees dared to share more risk information and ambiguities about risk policies because they knew they were not blamed for asking those questions, rather they were accepted and encouraged. However, still not all information was openly shared. Mistakes were deliberately shared indirectly in trainings by leaders, to prevent the department from having an negative ambience, implying that not everything needs to be shared directly in order to create desired risk-taking behavior. L4 stated: ‘It’s like a parent-child

relation: you don’t tell your child every time you fight with your wife, because they directly think you will get a divorce. I don’t want anxious and panic people all around me.’

Moreover, when doing self-evaluations, leaders discussed how issues could be stated more consistently next time. Leaders pointed to the organization’s values to express what the appropriate behavior should be and messages turned out to be more consistent. Interviewees experienced consistent messages as the basis for accepting risk management and for creating credible messages.

(21)

21

and procedures were present. Diversity existed also among leaders, all with their own personality and interests, where they adjusted their leadership styles to the employees, resulting in employees feeling comfortable in the organization. Besides, by organizing informal events, more goodwill for each other was created, becoming more willing to listen to the other’s criticisms and ideas about risk behavior, SA3 noted.

Furthermore, employees with little experience did not question anything the leaders said, creating a small chance of different perceptions about how risk behavior should look like. Employees with more experience more often argued with leaders, because the employees discovered their own thoughts of risk-taking behavior, leading to different perceptions instead of shared understandings. However, SA2 noted that experience could also create shared understandings by directly understanding what your leader means so that unnecessary risks created by misunderstanding won’t be taken. L1 stated that a leader, possessing more experience, should not think he already knows everything.

By explaining the usefulness and consequences of rules, procedures, behavior, and showing the right behavior, leaders created awareness about the risk-taking behavior employees are rewarded and sanctioned for. This motivated appropriate risk-taking behavior, said S2. Practicing was also helpful to see the usefulness of rules and procedures. SA2 noted that he understood the importance of following procedures because his leader sent him to a training where the consequences of decisions were pointed out, leading him to following the procedures always very strictly nowadays. Rules and procedures were also used to strengthen someone’s opinion during negotiations. I observed this when an employee told her leader he was not allowed to do a proposed project, referring to the rules of the organization, after which he stopped because he knew it was not allowed. Moreover, interviewees mentioned that by showing appropriate behavior, leaders created awareness of the expected behavior.

Moreover, leaders made final decisions and influenced employees’ schedule of the day. However, this interruption only happened when employees saw the usefulness of the extra task. Therefore, leaders had to convince employees about the importance of his decision. They did this by involving people in the projects. S3 stated people will try better and feel more responsible for appropriate risk behavior when they are up to date about risk policies and feel worthy in a project. This was also applicable for living the values. By expressing teamwork, one of the organization’s values, employees created stronger feelings of responsibility regarding helping each other in difficult situations, which could otherwise have caused risk behavior. Furthermore, I observed leaders and employees discuss how and when internal leaders and external people crossed the lines. Leaders talked about their own feelings and intrinsic motivations to trigger the feelings of others, by mentioning the influence of their conscience.

(22)

22

is to investigate if we have the right people in our team to be able to deliver this project successfully?’

By receiving a confirming response, he was sure he understood the other person. Furthermore, leaders explained concepts and terms used in a procedure when an employee did not know what was expected from him. This resulted in the employee following the procedure correctly since he knew what was meant with the steps. This was very helpful for eliminating ambiguity.

However, when shared understandings about appropriate risk-taking behavior were not reached, people consulted someone with a higher position who made the decisions. This means, still one of the two parties was not convinced and had to accept the decision. Second, risks were pushed off to someone else. In this case, also one of the two parties was not convinced. However, the party that was not convinced did not mind this because he was not responsible for the risks anymore.

There were different tactics in creating shared understandings, however all tactics included showing respect to the other party.

4.4 Social effects of both practices

This section describes the social effects of both leaders’ and employees’ practices in the risk culture. By showing the appropriate risk behavior, employees replicated the behavior of the leader. L1 recognized the importance of this role model function: ‘If I do not attend the weekly calls for three

times in a row, or I consistently show up fifteen minutes late, I set the standard on thinking that I don’t mind that they come in late or do not come at all.’ This implies that appropriate risk behavior is

replicated because of model behavior. However, it also caused contrasting behavior. M2 stated: ‘And

then I see him doing things of which I think, this is really not ok! I obviously don’t want to become like that.’ This means that leaders also acted as role models of how appropriate risk-taking behavior should

not look like. However, this also caused inappropriate risk behavior, when employees perceived this inappropriate risk behavior of leaders as appropriate risk behavior.

Furthermore, leaders had many years of experience wherein, according to M2, they discovered which risk behavior was appropriate and what not. Still, leaders expressed an openness to new ideas and criticisms to learn from employees. Employees with little experience were involved in projects and issues because they had a fresh perspective. Leaders triggered them to be creative. L1 stated: ‘Then I don’t say, “I want a pipeline with columns A,B,C”, but I say “I want a pipeline”, and

then I hope I receive something good. Then, I receive things I never would have thought of myself.’

This implies that by giving employees autonomy and say, more creative ideas are formed of how to deliver projects with quality. However, experience also influenced the degree of guidance employees needed. L2 stated: ‘When I guide a very proactive team, I lead differently than when I guide a less

capable team where I continuously need to check everything.’ In this way, the composition of project

(23)

23

Furthermore, leaders largely influenced employees’ careers, said SA3. M3 illustrated that you are safe if you have a good relationship with the leader, and otherwise you have to watch out. It turned out that when leaders and employees communicated more often, they had a better relationship with each other, and dared to share more risk information which influenced their collective know-how. This means that less miscommunications and misunderstandings occurred because they both knew what was meant with things being said.

Furthermore, leaders were influenced by the degree of diversity, where they adjusted their way of knowledge sharing to people in order to bring it across as clear as possible. L6 stated: ‘I trigger

people who act as cowboys to be risk averse to let them see why it is important to comply to rules, whereas I make clear to someone who is extremely risk averse that he shouldn’t go too far in controlling everything.’ Leaders had to create an ambience wherein everybody felt comfortable and

wherein ambiguity of rules and procedures was not present. Furthermore, I shadowed a leader who was walking around full of energy. When a leader was enthusiastic, he transferred this feeling to the employees. This was also experienced vice versa. SA3 said he is very informal and enthusiastic and felt management also experienced that work is more fun when everybody is happy and feels comfortable. SA2 stated he was more motivated and more willing to comply to the rules and procedures because of feeling comfortable.

Furthermore, leaders had no comprehensive overview, which made their practice dependent on information received from lower layers. However, L4 stated that employees sometimes influenced decisions of leaders, since employees constantly work among the people at the workplace and really experience what is going on there. However, this information flow caused leaders to trust the employees, since employees influenced what the leader heard. For example, this happened when employees expressed their thoughts of who would be most suitable for a project. In this way, leaders’ knowledge and thereby their actions of creating the appropriate team for a project to prevent risks of not delivering results to clients, was influenced.

By having the ability to change each other’s schedules, leaders had to be flexible throughout the days. All interviewees mentioned they were interrupted almost every day by the leader to fulfil an extra task, based on priority and efficiency. L4 noted that this influence was stronger from the leader since he prioritized better than employees because of having more experience and already knowing what the best steps were in fulfilling particular tasks.

4.5 Summary

(24)

24

(25)

25

5. DISCUSSION AND CONCLUSION

This research has addressed the following research question: ‘What role does the practice of

leadership play in establishing a desired risk culture?’ In order to answer the question of what ‘doing

it’ does, a case study has been conducted in a large accounting firm. By combining interviews, observations and shadowing, the role of leadership in establishing a desired risk culture was proved to be related to an array of activities, the creation of shared understandings through interaction with employees, and social effects of practices based on Corradi et al’s (2010) work. It turned out that the activities of leaders were executed simultaneously or in sequence, at different moments in time. Furthermore, as identified in the findings, all the discovered arrays of activities of leaders, as illustrated in Figure 2, influenced the establishment of the desired risk culture.

In the remainder, the results of this study are discussed and compared with relevant literature. Then, theoretical and managerial implications are presented, followed by the limitation of this research and suggestions for further research. Finally, a conclusion is presented.

5.1 Literature confrontation

In this section, the most interesting findings are compared with existing literature, as being an essential feature of theory development (Eisenhardt, 1989).

First, as confirmed by Podsakoff et al. (1996) and Schein (1992), the findings showed that leaders often act as role models and were conscious about this role and its effect. Cummings and Worley (2010) argued that model behavior resulted in replicated behavior of employees. However, this research illustrated that model behavior in the context of establishing the desired risk culture leads to both replicated as well as opposite behavior. This might have several reasons. First, experience causes people to know a more effective behavior or one they favor more in carrying out a task. Hall (1997) found that a person’s knowledge is stored in cognitive schemas, and when a certain object or situation occurs again, this cognitive schemas will make people remember how they should act in certain situations and how they valued the situation before. In this way, people learn from their experiences and use these experiences as input for future actions. Second, the level of education that people possess in this firm is probably higher than the average level of education in firms. Therefore, it could be that people working in accounting firms are in general intelligent enough to identify inappropriate behavior and therefore will follow their own and opposite behavior as a response. However, the effectiveness of role model in this and other contexts should be investigated in further research.

(26)

26

best interests of the organisation and more to do with the best interests of those making the decisions. This paper identified similar findings but found that self-evaluations promote more rationality and therefore result in more consistent messages. Therefore, I argue that leaders hinder the establishment of the desired risk culture when conveying inconsistent messages, but that they can counteract this by doing self-evaluations. This should be investigated in further research.

Furthermore, of particular interest in this research are the results for using incentives. Regarding the encouragement of appropriate behavior and sanctioning of inappropriate behavior, leaders played an important role in behavior modification using incentives, confirming the findings of Yukl (1989). The goal was to create compliance of rules and procedures, in order to create risk averse behavior. However, findings showed that opposite risk behaviors resulted from these incentives. I was initially perplexed by these findings, as they are contrary to the majority of findings that incentives lead to desired behavior, as stated by the reinforcement theory (Miltenberger, 2011). Upon deeper reflection, however, I might deem these findings to be attributed to the nature of the incentives, which are based on results instead of behavior. The goal of the incentives was to create appropriate risk-taking behavior, whereas the incentives were focused on rewarding appropriate results, irrespective of the behavior that led to those results. Thus, employees were not rewarded for taking the right risks in an informed manner as deemed necessary by the IRM (2012), but were rewarded for results, and therefore these incentives hindered the establishment of the desired risk culture. I propose that leaders can hinder the establishment of a risk culture when the use of incentives is not well conceived.

Despite the unintended effects of incentives in this research, transactional leadership did motivate employees to reach a certain goal. This is interesting since transactional leaders are in general not looking to change the future (which was the focus in this research), but to maintain the current situation (Bass et al., 2003). The rewards and sanctions transactional leaders use are extrinsic motivators that are said to bring minimal compliance from workers (Bass et al., 2003). However, the findings showed that transactional leadership did motivate employees to reach certain results, although this turned out not to be the intended goal, being appropriate risk-taking behavior. Therefore, I suggest that transactional leadership is useful in establishing the desired risk culture when using appropriate incentives. Further research should investigate this leadership style in this context.

(27)

27

Moreover, the IRM (2012) found that the desired risk culture includes open risk communication. As described in the findings, employees were more willing in sharing risk information openly when they felt comfortable and had goodwill for the leaders. This is in line with Brown et al. (2005), arguing that followers’ willingness to report problems to management was associated with employees’ perceptions of their supervisor. Therefore, I propose that by creating a pleasant ambience and good relationship with employees by their ongoing interaction, leaders facilitate the establishment of the desired risk culture. This should be investigated in further research.

However, the findings of this research identified that not all risk information was shared openly in order to spare people. People make mistakes, and the findings illustrated that by not forgiving, a punishment culture can be created where nobody dares to share risks anymore, counteracting open risk communication. Furthermore, the findings showed that a negative ambience is created if all risk information is shared. Therefore, I argue that not all elements necessary for establishing the desired risk culture are included in the list of the IRM (2012). I propose that ‘forgiveness’ should be added as being one of the elements of the desired risk culture, and that leaders facilitate the establishment of the desired risk culture by creating a risk information flow that is handled with care and not completely open. These points should be investigated in further research.

Another point of interest is the presence of diversity. The desired risk culture should contain sufficient diversity, with reasons such as challenging the status quo (IRM, 2012). However, the findings showed that diversity only facilitated the establishment of the desired risk culture when leaders undertook activities to make people feel comfortable in the workplace. This implies that inclusion is needed for diversity to be effective in organizations, as recognized by Pless and Maak (2004) and Ogbonna and Harris (2000), meaning that diverse people are accepted and feel comfortable. Therefore, in contrast with the findings of the IRM (2012), I state that diversity is not always helpful in establishing the desired risk culture, and that leaders only facilitate the process when they incorporate inclusion in the workplace. Further research should investigate this role of diversity.

Furthermore, Gherardi (2012) states that knowledge does not reside in individuals’ heads, nor is it a production factor which can be easily stored, managed and used strategically. Rather, she argues that knowledge is seen as “a collective, situated activity” (2012, p. 199). Taking into account the findings of this research, I argue that this is also recognized in the practice of leadership in establishing the desired risk culture wherein leaders andemployees achieve the goal of knowing and learning the appropriate risk-taking behavior by engaging in a collective action.

(28)

28

trustworthy service to organizations’ clients, and therefore to upgrade their professionalism; from the employees’ point of view, it is a search for esteem and faith; from the leaders’ point of view, it is a search for certainty to create appropriate risk-taking behavior.

In summary, I propose that the practice of leadership in establishing the desired risk culture concerns three aspects: the workplace (monitoring and guiding employees), the ongoing interaction between leaders and employee to create shared understanding about appropriate risk-taking behavior, and regulative accountability (legislation) of leaders.

5.2 Theoretical implications

This study contributes to the literature streams of leadership, cultural change, social effects, shared understanding and risk culture. Different research calls were answered. The role of leadership and the context of risk culture are important parts of the theoretical contributions of this study. Existing literature currently fails to provide a comprehensive cultural change approach (Burnes, 2014). Although this research does not have the intention to develop such a method, it contributes to the cultural change literature by providing insight into the role of leadership in establishing the desired risk culture. Studying behavior analysis regarding supporting prosocial behavior and eliminate aversive behavior, this research made a unique contribution to management literature since this is the first research where the role of leadership in establishing a (desired risk) culture is investigated using a practice based approach. Although general tactics leaders use in managing cultural change are already recognized by earlier studies, this research is the first attempt to provide an overview of the role of the practice of leadership in the context of establishing the desired risk culture. Moreover, some leadership behaviors, such as being a role model (Schein, 1992) and using behavior modification strategies (Miltenberger, 2011), turned out to not always confirm findings of earlier research. Next, the concept of leadership and risk culture is embedded in practice by using qualitative research methods, contributing to academic literature about the actual behaviors of leaders in a risk culture.

5.3 Managerial implications

(29)

29

5.4 Research limitations and further research

This study has several limitations. First, using a single-case study limit the generalizability of this research (Yin, 2009). Data were gathered from one advisory department in an audit firm, meaning the results might not be transferrable to other firms because they are context-specific. Second, because the data methods used were time consuming methods, some perspectives might be underrepresented. Furthermore, since shadowing is a sensitive process and only two leaders gave permission to be shadowed, these leaders probably had different personalities and leadership behaviors than leaders who did not gave permission.

This research is one of the first to explore how the practice of leadership comes about in risk culture. However, in order to validate the findings of this study, further research is required to test if results are generalizable to other contexts. This might include other audit firms in the financial services sector, however other sectors would also be very interesting to study, such as a manufacturing firm where completely different risks are present. Furthermore, interviewees often mentioned a link between personality and commitment. It might be interesting to investigate how personality plays a role in the degree of commitment to ethical principles.

5.5 Conclusion

This study contributes to literature and practice in linking different fields of research. The aim was to investigate the array of activities leaders perform in establishing a desired risk culture and how the actual risk culture comes about in practice. Furthermore, the aim was to discover how, through interactions between leaders and employees, shared understandings of desired risk-taking behavior are achieved, and how the practice of leadership in establishing a desired risk culture leads to social effects.

“The Role of Leadership in Establishing a Desired Risk Culture”