Tone at the top is very important for risk culture development. Executives and Board members play a vital role in driving the risk management agenda. Nowadays many executives and Board members have a basic understanding of risk management. Auditors, risk management professional associations and regulators have been quite influential in shaping the Board’s perception of risk management.

Unfortunately, not all the messages communicated by the auditors and regulators are sound and some are downright wrong. For example, one of the government agencies in Russia published a guidance document that encourages companies to have a standalone risk management process and in many ways contradict the core principles of ISO31000:2018. Despite our best effort to block the document, it was approved by the government and now most government owned corporations in Russia have to create two parallel risk management frameworks, one for the regulator and one for the decision makers.

It is important for the risk manager to take the lead on forming the Boards and senior managements view on risk management by providing risk awareness sessions and relevant information. Here are some of the most important messages risk managers need to include in their communication with the Board:

• 
  
• Decision quality and how people make decisions under uncertainty;
  
• Positioning risk management as a tool to help management make decisions;
  
• Risk management should be an integral part of existing business processes and regular management reporting, not a standalone quarterly or annual activity;
  
• Risk management is not about avoiding or minimising risks, it’s about making informed decisions.
  

It may be appropriate to bring in an independent advisor to conduct risk awareness training for the Boards and senior management to reinforce the messages shared by the risk managers internally.