Creating and embedding behavioural and cultural change across a
global IT function in the oil and gas sector.

Very professional and definitely worthwhile workshop. I will ensure the rest of the team get to attend whenever they possibly can.

Workshop attendee

The challenge

Having designed a new set of tools and processes for managing risk in its 3000 plus IT function in 2011, our client wanted to bring them to life for its employees at a strategic and tactical level.

On the macro business level for example, digital security is critical for the organisation. A major virus that disabled its email system or crashed its datacentres could have global business-wide implications.

Part of the challenge was helping employees understand risk at a micro level too. For everyone in the function, risk management is part and parcel of running operations and infrastructure and providing applications and services to the business. And while not everyone will be involved at every stage of the risk lifecycle process, the leadership team want risk to be embedded as part of everybody's day job, not something that only Risk Managers do.

"The goal of the risk culture workshops is to understand our attitudes and behaviour relating to risk and to work out how to address the blockers and habits that sometimes stop us recognizing, raising and managing our operational risks".

After discussing requirements with the programme sponsor, we developed and piloted a half day workshop using a simple model and surveys that we created to make the content of the programme personal to each set of workshop participants.

Our approach

In practice

The workshops are highly interactive as they are not about giving people answers. Instead, we create the environment for different groups to review the output from the surveys and discuss the way they think about and act on risk in a non-critical way. The activity is engaging, practical and grounded in day to day experience.

The first half of the workshop explores the fact that the amount of effort and energy people are prepared to invest in identifying and managing operational risk is partly influenced by their own mindset and attitude. Understanding this leads to more diverse and robust discussion about risks already identified, as well as increasing the chances of identifying new operational risks.

The second half of the workshop focuses on how the organisation culture is influencing the extent to which people are willing and able to invest time and effort in raising and taking action on risks they have identified.

Participants are encouraged to think about and commit to specific small changes they can make to influence the organisation culture, as well as identifying the top down changes required by leadership. And because a lot of the information we gather through the surveys and workshops relates to culture and behaviour, the emerging themes are relevant more broadly than the risk agenda.

Following the initial pilot phase, an additional 700 participants attended more than 50 workshops primarily in the UK and US during 2012.

Feedback from participants has been extremely positive, with individuals committing to a number of different actions such as putting risk on regular meeting agendas, actively seeking input and feedback on risks from a wider variety of people and being more aware of the impact of their own actions on different teams and parts of the business.

Some of the most improved indicators from the internal employee survey run late last year relate to employees reporting that their managers are listening and positively responding to safety and risk issues, are emphasising doing the right thing under pressure and are seeking out and valuing diverse views.

While the risk culture workshops were just one element of a whole set of activities and leadership focus on the risk agenda in 2012, we saw similarly encouraging results when we re-ran the risk culture survey for the function involved in the initial pilot workshops.

With respect to the overall culture of the organisation less people believe that competing objectives, leadership or communication are barriers to actively engaging in and managing risk and on a day to day basis more people are reporting that they know what is expected of them with respect to risk management, that risk is at the forefront of people's minds and that it is explicitly considered before making decisions.

We are now in the process of reviewing the output from all workshops run last year with each leadership team, with the aim of identifying a few actions to address barriers identified and reinforce positive actions and behaviour. The culture survey will then be run again later this year to assess progress.

The results