Risk culture is the way people behave about risk. But people, organizations, and risk are all complex and dynamic. It’s important to have a formal concept of risk culture, but perhaps the best way to explain it is through examples.

Dan Sparks at Goldman Sachs

In 2006, Dan Sparks was the partner in charge of mortgage trading at Goldman Sachs, and by mid-year he was troubled by growing risks in the mortgage markets. For the next six months he tried to escalate his concerns.

In Sparks’ words: ”It was tough…and I mean tough…the rigor that Goldman Sachs puts on people is unbelievable…especially when there’s a concern…I went up there to the 30^th floor…five times…’We’ve got a problem…Here’s what’s going on. Here’s what I don’t understand. Here’s what I’m worried about.’ As soon as you do that…they get the risk controllers and all kinds of people involved…I mean they’re all over it.”

In December David Viniar, Chief Financial Officer, convened a meeting to discuss Sparks’ views. The decision was to “get smaller, reduce risks, and get closer to home.” As a result, Goldman ultimately gained $4 billion from hedging its mortgage exposures. For more on risk management at Goldman read Money and Power by William D. Cohan.

Madelyn Antoncic at Lehman Brothers

Madelyn Antoncic was Chief Risk Officer at Lehman Brothers from 2005 to 2007. Before joining Lehman, she’d been a mortgage trader at Goldman Sachs, head of market risk at Goldman Sachs, and head of market risk at Barclays. In 2005 she was Risk Magazine’s risk manager of the year, and in 2006 she was named one of the 100 most important women in finance.

As the mortgage market crisis began to develop in 2006, Dick Fuld, Chairman and CEO, saw an opportunity for growth. He proposed an increase in the firm’s overall risk limit from $2.3 billion to $3.3 billion. Antoncic was concerned about market conditions and argued for a an increase to only $2.7 billion.

Lehman pushed hard into leveraged finance in 2006 and 2007, regularly exceeding its own risk limits. Antoncic opposed many of the deals and the firm’s total exposure to leveraged loans, but the Executive Committee overruled her. Lehman also moved aggressively in commercial real estate lending, routinely ignoring risk limits once again.

Antoncic’s concerns grew. As she told the Financial Crisis Inquiry Commission, “At the senior level, they were trying to push so hard that the wheels started to come off.” The seniors responded by excluding her from Executive Committee meetings, and in September 2007 she was demoted to a regulatory policy position. Within a year, Lehman was bankrupt.

Measures of risk culture

It’s clear that risk culture matters for good and bad. But how is a board member or a senior manager or an outside analyst to know if a company’s risk culture is working or failing? We think the best indicators are these.

• Risk access to board
  Senior risk officers have regular, unrestricted opportunities to talk to directors about risk
• Risk-adjusted compensation
  Pay should be adjusted for the risk incurred and for contributions to risk management
• Risk funding
  Spending on risk systems and personnel in terms of trend and relative to peers
• Business people working in risk
  To advance into management, risk originators have to do a tour as risk managers
• Risk manager turnover
  The percent of risk managers leaving the firm in terms of trend and relative to peer
• Risk escalation score
  The number of times risk originators or risk managers formally escalate risk issues

Risk culture is too important to ignore. And if it’s important enough to matter, then it needs to be measured. We think these are metrics that would be meaningful to outside analysts, but that’s just our opinion. What do you think?