The yellow flag problem: Most risk functions fail at culture before they fail at technique

In the second year of her country risk role at an Indonesian insurer, the reporter found herself in a senior management meeting discussing a proposed product with high credit risk, novel operational risk, and ambiguous regulatory positioning. Despite raising three concerns, the CEO approved the product without addressing them. Two weeks later, the proposal reached the Risk Committee, which unanimously approved the product. Eighteen months later, the product experienced the predicted loss event.

The reporter, with fifteen years of experience in risk functions across banking, insurance, and multifinance, now believes that most risk failures in financial institutions are not technical but cultural. The frameworks have improved over the years, but the culture surrounding them has not. The three cultural failures she frequently observes across institutions, sectors, and geographies are the marginalised CRO, the rubber-stamp committee, and the yellow flag problem.

The marginalised CRO reports to the CFO instead of the CEO, has performance-based compensation, and is not part of the executive committee that decides strategy. This signals to the organization that risk is a function rather than a counterweight. The Risk Committee meets monthly, with materials prepared in advance and reviewed by management.

Committee members ask polite questions, and minutes record consensus, leaving no room for challenge. Risk officers learn the professional cost of raising red flags, which are seen as stopping deals, projects, or requiring disclosures. Yellow flags, while important, are tolerated and become "acceptable with monitoring." This culture of politeness allows institutions to accumulate losses.

Healthy risk cultures have three distinguishing patterns: the CRO sits at the executive table, reports directly to the CEO, and has independent compensation. Disagreement is rewarded, with risk officers who challenge the room's status quo being promoted. The institution studies public losses, conducting a written post-mortem that does not assign individual blame but maps the decisions, assumptions, and cultural mechanisms leading to the loss. Institutions that do this consistently accumulate fewer losses over time.

CEOs and boards should watch for signals indicating the institution's position on the cultural line. If the CRO consistently leaves risk meetings more agitated than they arrive, the meetings are not effective. The institution should not have promoted a risk officer solely on the strength of a disagreement. After a significant loss event, the existence of a written post-mortem is crucial.

If there is no thorough analysis, the next loss event is inevitable. The institutions that consistently trust the reporter are those where the risk officer in the back of the room feels empowered to voice concerns and challenge the status quo.