The general attitude taken by an organization towards risk.
(National Audit Office, 2004, Managing Risks to Improve Public Service, p. 30)-------------------------------
The culture of an organization - that is the values, ethics and ethos underpinning its management style and approach can have a strong influence on how staff perceive and approach risk management. An organization with a risk averse culture is less likely to realize the improvements in service delivery which advances in technology, or experimenting with new ways of doing things, make possible. Conversely, an organization that has little regard for risks is less likely to be able to respond effectively to the unexpected and in the worst case scenario may suffer financial loss and impropriety. Some balance is required whereby organizations have a strong awareness that risks need to be identified and managed while at the same time have the confidence to take well thought through risks to realize the benefits of change.
The Oxford Risk Research and Analysis organization defines risk culture as : "The social and organizational determinants of individual risky decisions." They note that some organizations will intentionally create high risk cultures (e.g. financial trading firms) and others will favour a more conservative, risk-averse culture. A example is egulators.
The National Audit Office has encouraged the public service to create: "a management culture that encourages openness when problems arise and errors occur and rewards well managed risk taking."
National Audit Office (UK). "Supporting Innovationa: Managing Risk in Government Departments." 2000, p. 77.