{
  "id": 5454891,
  "title": "The yellow flag problem: Most risk functions fail at culture before they fail at technique",
  "url": "https://urgent.news/2026/09/04/the-yellow-flag-problem-most-risk-functions-fail-at-culture-before",
  "topic": "business",
  "section": "Business",
  "published": "2026-09-04T01:00:11.000Z",
  "source": {
    "name": "e27",
    "slug": "e27",
    "url": "https://e27.co/the-yellow-flag-problem-most-risk-functions-fail-at-culture-before-they-fail-at-technique-20260903/"
  },
  "original_language": "en",
  "account": "In the second year of her country risk role at an Indonesian insurer, the reporter found herself in a senior management meeting discussing a proposed product with high credit risk, novel operational risk, and ambiguous regulatory positioning. Despite raising three concerns, the CEO approved the product without addressing them. Two weeks later, the proposal reached the Risk Committee, which unanimously approved the product. Eighteen months later, the product experienced the predicted loss event.\n\nThe reporter, with fifteen years of experience in risk functions across banking, insurance, and multifinance, now believes that most risk failures in financial institutions are not technical but cultural. The frameworks have improved over the years, but the culture surrounding them has not. The three cultural failures she frequently observes across institutions, sectors, and geographies are the marginalised CRO, the rubber-stamp committee, and the yellow flag problem.\n\nThe marginalised CRO reports to the CFO instead of the CEO, has performance-based compensation, and is not part of the executive committee that decides strategy. This signals to the organization that risk is a function rather than a counterweight. The Risk Committee meets monthly, with materials prepared in advance and reviewed by management. Committee members ask polite questions, and minutes record consensus, leaving no room for challenge. Risk officers learn the professional cost of raising red flags, which are seen as stopping deals, projects, or requiring disclosures. Yellow flags, while important, are tolerated and become \"acceptable with monitoring.\" This culture of politeness allows institutions to accumulate losses.\n\nHealthy risk cultures have three distinguishing patterns: the CRO sits at the executive table, reports directly to the CEO, and has independent compensation. Disagreement is rewarded, with risk officers who challenge the room's status quo being promoted. The institution studies public losses, conducting a written post-mortem that does not assign individual blame but maps the decisions, assumptions, and cultural mechanisms leading to the loss. Institutions that do this consistently accumulate fewer losses over time.\n\nCEOs and boards should watch for signals indicating the institution's position on the cultural line. If the CRO consistently leaves risk meetings more agitated than they arrive, the meetings are not effective. The institution should not have promoted a risk officer solely on the strength of a disagreement. After a significant loss event, the existence of a written post-mortem is crucial. If there is no thorough analysis, the next loss event is inevitable. The institutions that consistently trust the reporter are those where the risk officer in the back of the room feels empowered to voice concerns and challenge the status quo.",
  "summary": "In the second year of my country risk role at an Indonesian insurer, I sat in a senior management meeting where a proposed product was on the table. The credit risk was material, the operational risk was novel, and the regulatory positioning was ambiguous. I raised three specific concerns. The chief executive listened, nodded, thanked […] The post The yellow flag problem: Most risk functions fail…",
  "key_points": [
    "Most risk failures stem from cultural issues, not technical flaws",
    "CRO often marginalized, reporting to CFO instead of CEO",
    "Yellow flags tolerated, leading to accumulation of losses"
  ],
  "editors_take": "Weak risk cultures in financial institutions, marked by marginalised CROs and rubber-stamp committees, allow losses to accumulate by tolerating yellow flags and penalising risk officers who raise concerns.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}