8 Risk culture

A sound, diligent and consistent risk culture should be a key element of investment firms ’ effective risk management and should enable investment firms to make sound and informed decisions.

Investment firms should develop an integrated and investment firm-wide risk culture, based on a full understanding and holistic view of the risks they face including the risks to clients, to markets, the risk to the investment firm itself and the liquidity risks, in particular those which can have a material impact on or deplete the level of own funds available and how they are managed, taking into account the investment firm ’s risk capacity and risk appetite.

Investment firms should develop a risk culture through policies, communication and staff training regarding the investment firm s’ activities, strategy and risk profile , and should adapt communication and staff training to take into account staff’s responsibilities regarding risk-taking and risk management.

Staff should be fully aware of their responsibilities relating to risk management. Risk management should not be confined to risk specialists or internal control functions. Business units, under the oversight of the management body, should be primarily responsible for managing risks on a day-to-day basis in line with the investment firm ’s policies, procedures and controls, taking into account the investment firm ’s risk appetite and risk capacity.

A strong risk culture should include but is not necessarily limited to:

• a. Tone from the top: the management body should be responsible for setting and communicating the investment firm ’s core values and expectations . The behaviour of its members should reflect these values. Investment firms ’ management, including key function holders, should contribute to the internal communication of core values and expectations to staff. Staff should act in accordance with all applicable laws and regulations and promptly escalate observed non-compliance within or outside the investment firm (e.g. to the competent authority through a whistleblowing process). The management body should, on an ongoing basis, promote, monitor and assess the risk culture of the investment firm, consider the impact of the risk culture on the financial stability, risk profile and robust governance of the investment firm and make changes where necessary.
• b. Accountability: relevant staff at all levels should know and understand the core values of the investment firm and, to the extent necessary for their role, its risk appetite and risk capacity. They should be capable of performing their roles and be aware that they will be held accountable for their actions in relation to the investment firm ’s risk -taking behaviour.
• c. Effective communication and challenge: a sound risk culture should promote an environment of open communication and effective challenge in which decision-making processes encourage a broad range of views, allow for testing of current practices, stimulate a constructive critical attitude among staff and promote an environment of open and constructive engagement throughout the entire organisation.
• d. Incentives: appropriate incentives should play a key role in aligning risk-taking behaviour with the investment firm ’s risk profile and its long -term interests²⁵ .

²⁵ Please refer also to the EBA guidelines on sound remuneration policies under Directive (EU) 2034/2019