What Gets Rewarded Gets Done: Risk Culture Beyond the Framework.

After the financial crisis of 2008, a term that had barely concerned anyone before moved to centre stage. If banks had taken risks that nobody would admit to having wanted, the cause apparently lay not only in models and limits but also in something softer. It was called risk culture. In 2014 the Financial Stability Board published guidance to help supervisors assess it and defined it as “the institution’s norms, attitudes and behaviours related to risk awareness, risk taking and risk management”. Four indicators were to guide the assessment: tone from the top, accountability, effective communication and challenge, and incentives that reinforce the desired behaviour.

With that, risk culture had become something that could be described and assessed by supervisors. Banks wrote it into mission statements, codes of conduct and risk appetite frameworks. As early as 2013, Michael Power, Simon Ashby and Tommaso Palermo at the London School of Economics observed a whole industry forming around it, “fuelled by a mix of advisors, regulators and professional associations”. The idea behind it was reasonable: what can be written down can also be enforced.

There is one bank that shows how far this idea holds up. Credit Suisse had all of it. It had the three-lines-of-defence model that is standard in banking, risk limits at client level, committees that dealt with breaches, and a risk function that wrote warnings. It also had a supervisor that scrutinised it more closely than almost any other bank. Between 2018 and 2022 FINMA conducted 108 on-site supervisory reviews at CS and recorded 382 items requiring action. In 2020 it moved the bank into the highest of its four rating categories, “intensive and permanent supervision”. In March 2023 the bank was finished.

Identified, Reported, Overridden

The most thoroughly investigated case is Archegos. In 2021 the CS board brought in the New York law firm Paul, Weiss to examine it, and for a report the bank commissioned itself, it is remarkably blunt. Archegos, Bill Hwang’s family office, began breaching its limits at CS in spring 2020. In July 2020 its exposure under the relevant scenario stood at USD 828 million, against a limit of USD 250 million. From that point on, the report says, Archegos “remained in breach of its scenario limits virtually every week until its March 2021 default”.

What the bank did during those eight months is more revealing than what it failed to do. From September 2020 it measured the exposure against a milder scenario. Archegos remained over the limit even under that one. In January 2021 the client was downgraded internally, and at the same time its limits were raised, one from 20 to 50 million, the other from 250 to 500 million. The responsible committee had discussed Archegos in September 2020, agreed on action without setting a deadline, and then not put the case back on its agenda for almost six months. As late as 11 to 19 March 2021, the bank paid Archegos USD 2.4 billion in excess margin, approved by the risk function. According to the report, the head of the investment bank and the group’s chief risk officer first heard of Archegos on 24 March. A few days later Archegos defaulted. In 2020 the client had earned CS around USD 16 million in revenue. The loss came to about USD 5.5 billion.

The decisive sentence comes right at the start of the report. This is not a case, Paul, Weiss writes, in which staff acted fraudulently or with ill intent. It goes on: “Nor is it one where the architecture of risk controls and processes was lacking or the existing risk systems failed to operate sufficiently to identify critical risks and related concerns. The Archegos risks were identified and were conspicuous.”

So the systems had worked. They had identified the danger and reported it. The report describes what happened next as “a cultural unwillingness to engage in challenging discussions or to escalate matters posing grave economic and reputational risk”. FINMA reached the same conclusion in its own proceedings in 2023 and put it more soberly: “the responsible employees acted in favour of the client”, and “exceeded limits were simply increased repeatedly”.

A limit that gets raised whenever it is in the way measures nothing. It only records what was going to happen anyway.

Archegos was no outlier. In the case of Greensill, the second major loss of March 2021, FINMA found that the responsible risk manager had recognised the risks in the business model and recommended internally that the loan not be granted. A senior manager overruled him.

Three Levels That Do Not Fit Together

Edgar Schein described organisational culture in terms of three levels, and his model explains quite precisely what came apart at CS. At the top are the artefacts, everything that can be seen and touched: structures, processes, documents. Below them lie the espoused values, what an organisation says about itself. Schein notes drily that they “may or may not be congruent with behavior”. At the bottom are the basic assumptions that nobody voices because they have become self-evident. According to Schein, they determine what people perceive, think, feel and do.

CS was well set up on the first two levels. The frameworks existed, and so did the professed commitments. At the third level, a different rule held: a good client matters more than a limit, and whoever stops a deal needs better reasons than whoever lets it run. In September 2020 an analyst in the credit risk function noted, as Paul, Weiss quotes him, that everyone he would have trusted “to have a backbone and push back” had left.

Schein also described how employees learn what really counts at the deepest level. They don’t get it from mission statements. They read it in what leaders pay attention to on a regular basis, how they react to critical incidents and how they allocate rewards and status. At CS, all three signals are well documented. The first has already surfaced with Archegos: the head of the investment bank learned of the client only days before the default, after eight months of limit breaches.

How Employees Learn What Really Counts

FINMA went through ten years of CS’s compensation figures. Cumulatively, the bank posted a net loss of CHF 2.1 billion over that period. Variable compensation over the same ten years exceeded CHF 33 billion. The sentence in which FINMA describes the compensation system could stand as the headline for the whole case: the scheme “included the consideration of risk behaviour on paper”, but “in practice the assumption of high risks and/or misconduct […] had very little effect on remuneration”. According to FINMA, “primarily high-ranking employees benefited disproportionately from variable remuneration, even if they were involved in disciplinary cases”.

The FSB names incentives as one of four indicators of risk culture. At CS they were the indicator that overrode all the others. Years of watching big revenue count while disciplinary cases made no difference teach employees what the bank expects of them, without any memo. They also learn what to make of a memo about values.

Just as telling is how the bank reacted to incidents. In September 2019 it became public that CS had had its former head of wealth management, Iqbal Khan, put under surveillance. On 1 October the board presented the findings of an external investigation. According to the board, the chief operating officer had acted alone; he stepped down. Chairman Urs Rohner told the press conference: “Even in a big company, there are incidents.”

Eleven weeks later a second case came to light. In 2021 FINMA found that between 2016 and 2019 the bank had planned seven surveillance operations and carried out most of them. It cited “serious organisational shortcomings” and “an inappropriate corporate culture among parts of Credit Suisse’s operational management at that time”. Statements by the bank “proved to be partially incomplete or even inaccurate”, and the surveillance and its background “were concealed”.

An organisation that first explains an incident as an isolated case ends the search for the pattern before it has begun. That need not be intentional. It is the obvious response when admitting a pattern would cost more than an explanation built around one person. But according to Schein, this is precisely the kind of reaction to a critical incident from which employees learn what really counts. In its overall assessment FINMA applied the same diagnosis to the bank as a whole: recurring events had revealed “that the weaknesses identified were not rectified in a sustainable way or were only rectified in one part of the Group”. It also noted that “escalated cases were sometimes hampered by the complex corporate structure of CS”.

Where Risk Culture Actually Becomes Visible

One could conclude from all this that the frameworks were useless. That would be wrong. The frameworks did what they were built to do: they made the breaches, and with them the conflicts, visible. The conflicts themselves were resolved elsewhere.

This is why Power, Ashby and Palermo describe risk culture as a process rather than a state, as “a myriad of small behaviours and habits which in the aggregate constitute the state of risk culture at any one point in time”. In their interviews with banks, a degree of tension between the business and the risk function was considered healthy, as long as the risk function genuinely challenged. Risk culture reveals itself in these moments: when a limit stands in the way of a lucrative client, when a risk manager says no and a superior says yes, when an incident becomes public and someone has to decide how to explain it.

FINMA takes the same line in its report when it writes that an adequate risk management system “takes more than just improvements to processes and controls”. What is essential is “for the responsibilities to be clear and lived up to”. One thing the supervisor lacked, FINMA says, was a regime that assigns responsibility to individual senior managers. In 2024 the Parliamentary Investigation Committee found it “incomprehensible” that despite the bank’s numerous failings “no causal responsibility” could be established.

The Data Is Already There

Anyone who wants to know the state of an organisation’s risk culture does not have to look far. Every bank already holds the most telling data, and so does every other organisation that works with limits and approvals. How often was a breached limit raised instead of enforced? How often was a risk recommendation overruled, and by whom? How much variable pay went to people with an open disciplinary case? And what did the first public explanation after the most recent incident say, compared with what came out later?

None of these questions needs a new questionnaire. Power, Ashby and Palermo warn that tools for measuring risk culture can themselves become the primary focus of attention, instead of prompting conversations. That is no argument against measuring. It is an argument against measuring that produces a number once a year and is then ticked off. The questions above need something else: the willingness to read one’s own decisions as evidence about culture. That is more uncomfortable than any survey, because the answers have names.

Readers working in other fields can translate the questions. How often did work carry on under deadline pressure even though someone had the authority to stop it? Who decided that, and what happened afterwards to the person who would have stopped it?

Credit Suisse did not lack risk management. It lacked the willingness to let the findings of its risk management prevail over the business, and it had a pay system that did not demand that willingness either. There is a simple test for an organisation’s basic assumptions. You ask it whether it has a culture problem. An organisation that says no without hesitating has already answered the question.

FINMA is quoted from its official English publications. Quotations from the Parliamentary Investigation Committee (PUK) report are my own translation.

Sources

• FINMA – FINMA Report: Lessons Learned from the CS Crisis, 19 December 2023 (main source)
• Paul, Weiss, Rifkind, Wharton & Garrison – Credit Suisse Group Special Committee of the Board of Directors Report on Archegos Capital Management, published by Credit Suisse Group AG on 29 July 2021 (main source)
• FINMA – Archegos: FINMA concludes proceedings against Credit Suisse, press release of 24 July 2023
• FINMA – FINMA concludes Greensill proceedings against Credit Suisse, press release of 28 February 2023
• FINMA – Credit Suisse observation activities: FINMA identifies serious breaches of supervisory law, press release of 19 October 2021
• Credit Suisse – Board of Directors statement on the findings of the investigation into the observation of Iqbal Khan, 1 October 2019, and Investigations into new observation allegations, 23 December 2019
• CNBC – Credit Suisse hopes to close the curtain on bizarre spying saga, 1 October 2019
• Parlamentarische Untersuchungskommission (Parliamentary Investigation Committee, PUK) – Geschäftsführung der Behörden im Kontext der CS-Notfusion, report of 17 December 2024
• Edgar H. Schein & Peter Schein – Organizational Culture and Leadership, 5th ed., Wiley 2017
• Edgar H. Schein – Organizational Culture and Leadership, 4th ed., Jossey-Bass 2010
• Michael Power, Simon Ashby & Tommaso Palermo – Risk Culture in Financial Organisations: A Research Report, LSE Centre for Analysis of Risk and Regulation 2013 (main source)
• Financial Stability Board – Guidance on Supervisory Interaction with Financial Institutions on Risk Culture, 7 April 2014