Risk Culture and the Role Model of the Honorable Merchant

Abstract

The current discussion about a “risk culture” in financial services was triggered by the recent series of financial crises. The last decade saw a long list of hubris, misconduct and criminal activities by human beings on a single or even a collective basis in banks, in the industry or in the whole economy. As a counter-reaction, financial authorities called for a guidance by a “new” risk culture in financial institutions based on a set of abstract, formal, and normative governance processes. While traditional risk research in economics and in banking was focused on the statistical aspects of risk as the probability of loss multiplied by the amount of loss, culture is a paraphrase for the behavior in collectives and dynamics of organization found in human societies. Therefore, a “risk culture” should link the normative concepts of risk with the positive “real-world” decision-making in financial services. This paper will describe a novel view on “risk culture” from the perspective of human beings interacting in dynamical and intertemporal commercial relations. In this context “risk” is perceived by economic agents ex−ante as the consequence of the time lag between the present and the uncertain future development (compared to a probability distribution calculated by observers ex−post). For all those individual decisions—to be made under uncertainty—future “risk” includes the so-called “normal accidents”, i.e., failures that will happen at some uncertain point in time but are inevitable, and the only questions are when failure will happen and how to maintain function in the first line of defense. Finally, the shift from an abstract definition of “risk” as a probability distribution to a role model of “honorable merchants” as a benchmark for significant individual decision-making with individual responsibilities for the uncertain future outcome provides a new framework to discuss the responsibilities in the financial industry.

1. Introduction: Risk Culture in an Organization versus Organizational Culture of Risk

The current discussion about a “risk culture” in financial services was triggered by the recent series of financial crises in the last decade, from the US subprime mortgage crisis to the lock-in trap of central banks in the aftermath of the sovereign debt crisis. This decade revealed an amalgam of collective hubris, misconduct concerning services for customers and criminal activities by human beings on a single or even a collective basis in banks, in the industry or in the whole economy. As a reaction to regain the stability of the financial services markets, financial authorities called for a guidance on risk management in financial institutions including a “risk culture” (see

Table 1. Diverging definitions for “Risk Culture” as provided by different regulators or bank supervisors with quotes (emphasis by the authors; see also Milkau 2017). The diverse usage of the term “Risk Culture” indicates the need for a detailed discussion what “Risk Culture” means from the perspective of the different stakeholders.

Organization	Title	Quote
Financial Stability Board (FSB; 2014)	“Guidance on Supervisory Interaction with Financial Institutions on Risk Culture”	A sound risk culture consistently supports appropriate risk awareness, behaviors and judgments about risk-taking within a strong risk governance framework. A sound risk culture bolsters effective risk management, promotes sound risk-taking, and ensures that emerging risks … are recognized, assessed, escalate, and addressed in a timely manner. Risk culture … evolves over time in relation to the events that affect the institution’s history…
Basel Committee on Banking Supervision (BCBS 2015)	“Corporate Governance Principles for Banks”	… norms, attitudes and behaviors related to risk awareness, risk-taking and risk management, and controls that shape decisions on risks. Risk culture influences the decisions of management and employees during the day-to-day activities and has an impact on the risks they assume.
German banking supervisory authority BaFin’s expert article (Steinbrecher 2015)	“Risk culture: Requirements of responsible corporate governance”	Risk culture: Requirements of responsible corporate governance
German banking supervisory authority BaFin (2017)	amendment to the German guidelines on risk management in banks (MaRisk)	Risk culture described in general the manner, in which staff of a banking institution (should) handle risk as part of their activities. A risk culture should support the identification and the conscious handling of risks and guarantee that decision-making leads to results, which balance all aspects of risk. An appropriate risk culture is characterized by the clear acknowledgment of the senior management to a risk-adjusted behavior, strict discipline of all staff concerning the risk appetite as communicated by the senior management and the facilitation and support of a transparent an open dialog in the bank concerning risk-relevant issues.

).

These examples illustrate a shift from a pure normative definition of a risk culture in banking (“external governance”) to a positive perspective how to support a risk culture in the daily work of all staff in a bank. The concept of “risk culture” suffers three open issues: What is “culture” in an organizational perspective? How is “risk culture” linked to corporate culture and/or organizational culture? Moreover, how should “risk” be defined in the context of culture?

Typically, risk research in economics and in banking is focused on the mathematical aspects of calculating risk capital and refers to “risk” as the probability of loss multiplied by the amount of loss as introduced by Abraham de Moivre (1718) especially with an ex post probability distribution of measured loss events. The International Organization for Standardization (ISO 2018) defines risk as the “effect of uncertainty on objectives”, which is an ex ante point of view toward risk-based decision-making for an uncertain future. The novelty of this paper will be an extension of this newer definition, as this paper will start with the historical development of a “risk culture” and understanding of risk as the challenge of (economic) decision-making with responsibility for (uncertain) future consequences. This includes the quite modern “normal wrongdoing” as a trend for not taking responsibility for major decisions taken within an ensemble of decision-makers. This is a remarkable shift from risk as a probability distribution of an ensemble of independent events to the risk of single and unique major decisions with decision-makers hiding in a “faceless” crowd (see below). In that sense, this paper will refrain from a normative or equational definition of “risk” as a probability distribution of an ensemble of recorded events and apply the role model of “honorable merchants” as a benchmark for significant individual decision-making with individual responsibilities for the uncertain future outcome.

In the humanities, “culture” is a paraphrase for the behavior in collectives and dynamics of organization found in human societies. Kennedy and Deal (1982) described in their book “Corporate Cultures—Rites and Rituals of Corporate Life” culture briefly as [quote]: “the way we do things around here”. In his seminal book “Organizational Culture and Leadership”, Edgar H. Schein (1985) provided a long list of literature references with different definition of culture in an organization: observed behavioral regularities when people interact, group norms, espoused values, formal philosophy, rules of the game, climate, embedded skills, habits of thinking, mental models, and linguistic paradigms, shared meanings, “root metaphors” or integrating symbols, formal rituals and celebrations. Pettigrew (1979) described culture as an [quote] “amalgam of beliefs, identity, ritual, and myth” and, consequently, discussed culture on a meta-level beyond a strict definition. Nevertheless, all those approached focused primarily on operational issues of organizations and especially on possible explanations for the different competitive positions of US versus Japanese companies in that time—see e.g., the D’Aveni (1998): “Western firms, having begun the process of becoming lean, must now become mean”. However, a very recent paper, still, focused on the relationship between corporate culture and performance (Graham et al. 2017). As opposed to this, an approach was made to “measure” corporate culture psychometrically (in particular based on the work of Quinn and Rohrbaugh (1983), regarding the Competing Values Framework, a transfer of employee profiling tools that are usually based on the typology proposed by Carl Gustav Jung (1921).

A different approach was applied by Linda Smircich (1983) in her book “Concepts of Culture and Organizational Analysis”. She concluded that [quote]:

Although there may be different understandings of the specific nature of culture [...] by using culture as a root metaphor, they are all influenced to consider organization as a particular form of human expression. […]

A cultural analysis [of organizations] moves us in the direction of questioning taken-for-granted assumptions, raising issues of context and meaning, and bringing to the surface underlying values. […]

Denhardt in “In the Shadow of Organization” (1981) noted that organization and administration studies tend to take as their task improving organizational efficiency rather than questioning the “ethic of organization”

This paper will apply the idea of organizational culture as metaphor for the human expression and values of the people forming an organization. This is a shift from a normative concept, how an abstract “organization” should manage processes, to a perspective on actual human decision-making, responsibility, ability to learn from failure and—finally—resilience. This perspective fits to a world where the future is uncertain, where humans are trapped between values and vice, and where there is always a gap between desired and actual beliefs, values, and practices within an organization.

In this paper, the risk culture in the practice of daily work will be analyzed in four steps: First, a separation between probability (of repeated games) and risk (of human decisions) will be used to set the scene. Second, a short historical description of the term “risk” will illustrate the gap between a calculation of probabilities based on past events and the responsibility for future uncertainty of an “honorable merchant”. Third, the reality of (technical) “Normal Accidents” and (human) “Normal Wrongdoing” will be discussed. Fourth, a positive perspective with the three elements of learning from failure, resilience, and responsibility will be developed. Finally, the role model of an “honorable merchant” in a complex world with uncertainties will the discussed including the limitation of such an ideal approach.

2. Probability of Repeated Games versus Risk in Human Decision-Making

Typically, risk is regarded as first formulated by Abraham de Moivre (1718)1 in his book on “The Doctrine of Chances: Or, a Method of Calculating the Probabilities of Events in Play” [quote, emphasis by the authors]:

The Risk of losing any Sum is […] the product of the Sum adventured multiplied by the Probability of the Loss.

As de Moivre pointed out by the single word “adventured”, it is the human “adventurer” with his individual decision under uncertainty of the future, who is the “risk-taker. Risk is perceived ex ante by human economic agents as the consequence of the time lag between the present of decision-making and the uncertain future development. This goes beyond an ex post calculation of a probability distribution done by external observers of a simple repeated “game”.

This difference has two major consequences: without human decision-makers, which are conscious of the time lag between present decision and future responsibilities, only time-invariant physical laws would exist (Luhmann 1991). For “non-simple” organizations in the real world with (some) complexity, one has to include the so-called “normal accidents”, which will happen at some uncertain point in time but are inevitable (Perrow 1984; Rochlin et al. 1987). They pointed out that unexpected failures are built into complex and tightly coupled systems and that such accidents are unavoidable and cannot be designed around.

In light of decisions under uncertainty and the danger of normal accidents, every decision-maker has individual responsibility for things to come. Compared to the normative approach to define how the world should be, uncertainty and normal accidents in daily business require a positive connotation of “risk culture” in the sense of the rational behavior of an honorable merchant—a role model, which worked for more than thousand years (albeit from a quiet “European” perspective).

3. A Short History of Risk Culture

From a historical perspective, a parallelism between the development of the understanding of “risk” (and risk culture) along with the development of the society to increasingly complex and inter-linked systems can be found, as recently described by Milkau (2017). The historical examination can be divided into three steps:

• ancient societies, in which each event was attributed to a “whim of the gods” (Bernstein 1996) by passive people with a predetermined fate
• honorable merchants as rational individual decision-makers with personal responsibility in long-term relationships starting with sea merchants in the Italian Renaissance
• illusion of control in modern society since the 20th century with the paradigm of a “clockwork economy”, in which human beings act as cogwheels without a face

The first transition—not for the whole society, but for a first group—from the first step to the second is marked by the emergence of the term “risk” itself. A word for “risk” can be found in many European languages from the beginning of the 16th century (e.g., Wilhelm 2013). Nonetheless, this is misleading, as the lingua franca in the Middle Ages was Medieval Latin Classical Latin did not contain the term “risk”, only danger (“periculum”) or—and with an ambivalent context—luck (“fortuna”).

A term for “risk” emerged in the context of Mediterranean maritime trade in Italian city republics continuing Roman legacy of sea loan to innovative set-ups of “risk-sharing” in contracts such as “colleganza” or “commenda” (see: Pryor 1977; Douglas and Wildavsky 1982; Maschke 1984; Nehlsen-von Stryk 1986; Dotson 1994; Ceccarelli 2015). They distinguish between (active) traveling merchants and (passive) sedentary merchants and revealed a differentiation between risk and danger:

• “Risicum” was used in the context of individual (commercial) conscious decision under uncertainty, but with the responsibility to accept or cover the (financial) consequences and damages
• “Periculum” or, respectively, “fortunam” were used for exogenous (natural) forces, which the merchant could not be aware of and with could be covered by a contract, i.e., something unrelated to the individual decision-making of a professional and experienced sea merchant

This development was labeled by Scheller (2017) as “The Birth of Risk”. The German sociologist Niklas Luhmann described it as a new “openness” of the individuals. Human fate was no longer pre-defined by gods or sovereigns, options could be taken, and all human decision were possible (Luhmann 1991; see also Aven 2012). The “Birth of Risk” was also the root of the “honorable merchant”: not in the sense of a “moral” category but as a fully rational approach to establish long-term and recurrent business relations across the whole Mediterranean with many uncertainties from shipwreck and pirates to kings and war.

The second transition occurred with the application of the calculus of probability, which was developed in the second half of the 17th century and first half of the 18th century based on ideas about gambling, on processes in the economy. Scientists such as Henri Poincaré still accepted the complexity of the economies with limited rationality and limited knowledge. Two examples are the comment of Poincaré (1908) to Bachelier’s thesis and his comment to Walras [as quoted in Ingrao and Israel (1990)]:

• When men are close to each other, they no longer decide randomly and independently of each other, they each reacts to the others
• … you regard men as infinitely selfish and infinitely farsighted. The first hypothesis may perhaps be admitted in a first approximation, the second may call for some reversion.

Later in the 20th century, the understanding of the economy and of economic agents changed. The tremendous successes of sciences, mathematics, and engineering lead to a culture which believed in a clockwork-like world, which could be “managed scientifically” (Taylor 1911), fully calculated and centrally planned. Economical activities were seen through the glasses of Cartesian constructivism, in which risk could arise only as statistical derivation from prescribed processes. This “culture of the clockwork” came with two side effects: in clockwork, everything is fully predictable (illusion of control), and no single piece has an individuality (dilution of responsibility). The personal responsibility of an honorable merchant shifted to the background.

4. From “Normal Accidents” to “Normal Wrongdoing”

The model of “normal accidents” is a positive approach to a world of VUCA (volatility, uncertainty, complexity, ambiguity; see Stiehm and Townsend (2002)), in which ex post models can tell us what might happen in statistical average but cannot help a first line of defense to decide ex ante what do. Stanley McChrystal (2015) briefly summarized: “… data-rich records can be wonderful for explaining how complex phenomena happened and how they might happen, but they can’t tell us when and where they will happen.”

However, VUCA is not the only challenge. The “mechanical” view of complexity has to be complemented by the awareness of “human” hubris, intended misconduct, and criminal activities. In a recent paper, Shapira and Zingales (2017) coined the term “normal wrongdoing”. They analyze one example (the DuPont case, i.e., the emissions of a toxic chemical named C8, which DuPont used in the making of Teflon^®) [quote, emphasis by the authors]:

DuPont, one of the most respectable US companies, caused environmental damage that ended up costing the company around a billion dollars.

…rule out the possibilities that this bad outcome was due to ignorance, an unexpected realization, or a problem of bad governance. The documents rather suggest that the polluting was a rational decision: under reasonable probabilities of detection, …

One common reason for the failures of deterrence mechanisms is that the company controls most of the information and its release. …

From 1951 to 2000 DuPont received C8 from a supplier (the Minnesota Mining & Manufacturing Company, later renamed 3M). …

By 1984 DuPont knew that C8 is toxic, …, and seeps into local drinking water supplies. The executives acknowledged that the legal and medical departments would recommend stopping the usage of C8 altogether. …

Yet the business side ultimately overruled these recommendations and opted to continue (in fact, double) C8 emissions. …DuPont’s decision, it seems, was a case of “rational wrongdoing”: a decision that maximizes shareholder value ex ante, even though it is socially harmful. …

Indeed, a critical mass of honest research and well-documented studies of C8 were generated in-house …

These scientists seemingly tried to instill in DuPont a corporate culture of the highest standards in that regard, as is evident from the words of Bruch Karrh, DuPont’s medical director and vice president in the relevant time frame (since 1983) …

One of the interesting aspects of the DuPont-C8 case is the “faceless crime” element. Even though the company suffered negative media coverage, none of its top managers were dragged through the mud. The lack of personal accountability …rational, “normal,” wrongdoing. C8 emissions and the suppression of information about it were not an evil plan or an accident. They were the natural course of action of a profit-maximizing company, which fully utilized the tools available under then-current laws.

Shapira and Zingales (2017) pointed out several mechanisms for that case: path dependency and time lag (with C8 usage already from 1952, information of toxicity by 1984, and continuous use until 20002), broken regulatory framework (without consistency and low penalties), and information advantage or information asymmetry between the company and all other stakeholders. This may be one example only, but many others are well-known cases from Enron to Volkswagen to misconduct with mortgages et cetera. There is no obvious pattern to point to a certain industry or a certain type of management.

5. A Self-Organized Lex Mercatoria for Risk?

A key for “normal wrongdoing” might be the “faceless crime” element with a group of decision-makers, who are acting as “anonymous”, selfish, norm-free, and fully rational maximizers of short-run benefits in a non-cooperative game. The large intertemporal gap between “collective” decision-making and potential (individual) responsibility opens room for a “risk discounting” from an individual point of view. Although the rules, regulations and legislations are in place and well known, a rational calculation of the future probability of penalty seems to lead to game-theoretical behavior with “collective dilution of individual responsibilities”. This behavior is supported by the time lag and by long-term information asymmetry between the decision-making agents and the principles (whoever they might be).

This is a “Catch-22” dilemma, which resembles the well-known issue with the “Tragedies of the Commons” (Hardin 1968). If would be beyond the scope of this paper to review the whole discussion, but one paper by Elinor Ostrom (1999) “Coping with Tragedies of the Commons” is helpful for the situation discussed here. If we regard “normal wrongdoing” as a problem with the commons of trust in the relationship of honorable merchants, then short-tern non-cooperation provides more individual benefits than playing by the rules of an informal community with a long-term perspective of sustainability.

Ostrom (1999) summarizes that the traditional position derived from non-cooperative game theory of finitely repeated games calls for (i) external regulation of the internal participants of a group to overcome perverse incentives; (ii) rather simple rules to change the incentive model based on “scientific management”; and (iii) centralized directives to replace game theory by authorities. This is a remarkable similarity to the regulatory approach to “risk culture”. Nonetheless, Ostrom provides many examples about field studies of commons such as farming on an alp, communal organized irrigation systems, Mongolian pastoralist groups or local fisheries in lakes, which exhibit sustainability based on self-regulation of the local communities. She described such “self-organized resource governance systems as complex adaption systems”, in which experience-based rules for individual agents without full information over the whole system lead to resilient system behavior.

Elinor Ostrom did not include the systems of honorable merchants, probably as she focused on geographically localized groups of economic agents. However, the great medieval fairs saw the first developments of a “law merchant” (or “ius mercatorum/lex mercatoria”) as elaborated in Piergiovanni (2005) and especially by Fortunati (2005). The merchants were granted the right to self-organize their business at those market places and to establish merchant courts with jurisdiction for commercial disputes. Of course, the “honorable” merchants knew very well that nobody is honorable all the time but were rational agents to self-regulate their business. Could there be a self-organized and adaptive “risk culture” in organizations such as banks?

6. Three Dimensions of Risk Culture

It is important to understand that the role model of “honorable merchants” was never formalized: it is a summary of how we understand the development of a merchant culture from the present perspective. However, there is no consistent description. Any social ethics is a dynamic process of constant adaption with some actors more committed and others less. However, this adaptability within a group of socially interacting agents is an advantage compared to ex ante rule-based regulations. Of course, formal processes are key to an effective risk management in banks, but the unpredictability of the future cannot be “removed” by models or processes. Münkler (2010) compared “cultures of risk” to “worlds of safety” [quote, translation by the authors]:

Cultures of risk dare to do more in handling dangerous and perilous situations compared to worlds of safety. Cultures of risk are designed to see an opportunity together with some danger. [...]. Worlds of safety are based on the implicit promise of a “safe world” and promote experiences to be measured to. In the course of this, the fact emerges with large regularity that such “worlds of safety” cannot fulfill the promises.

For use in the 21st century, the risk culture of honorable merchants can be condensed to three elements. First, individual responsibility and credibility based on three pillars: social instructions, self-enforcement and rational behavior. In the Zibaldone da Canal, a merchant manual with a Venetian origin dating a little after 1320, one can find the instruction [quote according to translation by Dotson 1994, 2002]:

Cheat not rich man nor poor—since you know not what you may encounter a man may buy other things—but not fortune.

Self-enforcement regulated the direct commercial transactions (especially at medieval fairs). Any merchant looking to build long-term business relationships with partners across Europe had to trivially act as a rational agent in a repeated game (using today’s language).

Second, those long-term business relationships with partners across Europe required continuous learning from failure due to the changing political and economic conditions (and the centers of trade shifted from Italy to the fairs of the Champagne to Flanders and Amsterdam). Centuries later, Von Hayek (1982) elaborated how complex interaction between independent agents leads to a dynamical discovery process, which we call “the market”, and Sir Karl R. Popper (1991) pointed out this basic principle of uncertainty in the quote:

“All Life is Problem Solving”.

If organizations want to learn how to solve problems in the discovery processes, a “Strategy for Learning from Failure” (Edmondson 2011) is required. One essential part of such a strategy must be open communication including chances, problems, and failures.

Third, the need for resilience triggered merchants in the 10th century to rediscover Roman contracts known as “colleganza” in Amalfi and Venice (Pryor 1977)—and “commenda” elsewhere in Europe (e.g., in Genoa, Pisa, Marseilles, Toulouse; see Puga and Trefler 2012), which provided a distribution of business risk across the partners, but with the participation of the traveling merchant as decision-maker (compared e.g., to the subprime mortgage chain in the US with a full risk transfer from the underwriter down the chain).

This fits with the definition of resilience “to build capability to absorb disturbance and maintain function” as elaborated by Walker and Salt (2012). In the context of current complexity, resilience is identified with redundancy (parallel systems of different participants), loose coupling (damping of non-linear amplification if “everybody marches to the same music”) and reasonable latency time (to avoid automatic overreaction).

In a rather schematic concept, three dimensions of risk culture could be regarded as necessary for a bottom-up approach to deal with real-world situations (see Figure 1):

• Decision-making with Individual Responsibility
• Learning from Failure
• Organizational Resilience

Compared to this very pragmatic approach of medieval merchants in times with usually high risk for pan-European business, the developments in the 20th century caused a risk culture with a rather “mechanical” belief in:

• clockwork (mechanical, deterministic, and parts without individuality)
• equilibrium (with risk as variance of small variations around a design value)
• model-based prediction (of probability distributions for risk by simple numbers)

This culminated in an “illusion of control”, as the more people were involved in decision-making along prescribed process chains, the less an individual saw himself as personally responsible. As illustrated in the DuPont case, time lag between decisions and consequences, decisions made in formal structures and shared by a “crowd” of managers (or herd behavior, when “you have to dance as longs as the music plays”), and information advantage can end up in “faceless crime”. Personal responsibility should be an important measure to avoid it.

7. An Honorable Merchant in a Complex World

In practice, there is a generic gap between a normative risk culture and the organizational reality and especially between advocated values by executives and values actually shared by staff. This “culture gap” expresses the rather natural difference between required and actual beliefs, values, and practices within an organization. The role model of an honorable merchant of the medieval ages cannot be transferred to the complex world of the 21st century in a trivial manner. However, the “honorable merchant” is a model for rational long-term relationships (or in terms of game theory: continuously repeated games) and for a balance between risky decision-making and resilience.

In the real world of “normal accidents” and “normal wrongdoing” any pure normative approach to a risk culture will be questionable. Human individuals will always be attracted to criminal, yet rational behavior, even though regulations are in place and law will be enforced. A sustainable risk culture can benefit from a holistic perspective integrating economics, sociology, psychology, and anthropology.

A self-organized risk culture with the three dimensions of risk culture shown above should be guiding lines from management education in universities to incentive models approved by supervision. Every decision a decision-maker takes is a decision under uncertainty. Therefore, no single decision can be a point of reference, but the whole (long-term) behavior of decision-makers can be monitored against the reputation of a honorable merchant as a simple but sophisticated benchmark. In the long run such an “evolution of trust” (Manapata et al. 2013) can help to overcome the dilemma of current regulation of risk culture.

8. Conclusions

Risk should be regarded as more than a probability distribution of measured events, depends on the social system we live in, is related to the responsibility of individual decision-making, and is a part of any (economic) culture. There is no risk in a clockwork-like world as Luhmann (1991) pointed out [quote incl. emphasis from Luhmann 1993]:

The outside world itself knows no risks, for it knows neither distinction, nor expectations, nor evaluations, nor probabilities—unless self-produced by observer systems in the environment of other systems.

Complex systems—social or technical ones—require normative regulation, but “normal accidents” and “normal wrongdoing” belong to the real world.

Culture is a complex concept related to human behavior adopted by people within a society, a dedicated group, or an organization. Therefore, the role model of “honorable merchants” could be an answer to a dynamically changing world. A guideline for a positive approach to manage the reality of risk in the daily reality of an organization can be the role model of honorable merchants, who make (careful) decisions under uncertainty and take (individual) responsibility for future uncertainty if such a “culture of co-operative repeated games” could be established for the decision-makers in charge. As central regulation faces the problem of “normal wrongdoing”, a self-organized risk culture—perhaps with self-organized sanction mechanisms—could align individual decision-making of rational actors, organizational decision-making with organizations as economic agents, and principles in charge of the system at large. Further research will be required to analyze whether this duality of formal regulations and a risk culture between interacting agents can provide better solutions.