ICQ Log - Talking Points:

Organisational Culture 


Last Updated:  24 March 2022

Dr. Gerry Gallagher, MD of GBCL Governance and former academic in MTU, examines how the evolving nature of organisations is creating many challenges for the development of the right culture.

For many years, organisational culture was something that was often talked about in the workplace, but in reality, managers paid little attention. Perhaps one explanation is that it cannot be represented on a balance sheet. In the industrial age, plant and machinery were tangible assets, the value of which was clearly defined. In the ‘knowledge economy’, up to 80 per cent of a company’s value is accounted for by its human capital. It is recognition of the importance of people in the organisation and the value they create, that has now prompted a deeper interest in culture. In 1992, the Cadbury Report on Corporate Governance was published by the Financial Reporting Council (FRC) in the UK. It took until 2016 for the FRC to issue guidance on culture: “Corporate Culture and the Role of Boards”. The realisation has come that a healthy corporate culture plays a vital role in value creation, and executives need to give it careful consideration.


Culture is often described as “the way things are done around here”. Every organisation has its own culture. The purpose of this article is to lift the veil on culture and examine how it impacts on organisations. In particular, it will explore how culture plays an essential role in risk management and compliance.

What is Culture?
Culture is quite a complex phenomenon. According to Edgar Schein, organisational culture can be observed at three different levels:
•    Level 1 – the artefacts
•    Level 2 – the espoused beliefs and shared values
•    Level 3 – the basic assumptions.

Level 1 – The Artefacts

The first layer - the artefacts are the visible tangible phenomena that represent the organisation’s culture to outsiders such as buildings, employee dress code, rituals and ceremonies etc. This is an area where managers have considerable control over any change that is required. 

Level 2 – Values and Beliefs
The middle layer – the values and beliefs are the core element of culture. All groups will develop a shared understanding of what will work for the group. This is summed up in the definition of culture by French et al: “The system of shared values and beliefs that develops within an organisation and guides the behaviour of members”.

Almost all organisations have stated values which are displayed on their website and other public locations.


Values define what the organisation believes to be important, and they are the principles by which people operate. People bring their own values when they join an organisation. These are formed over time and there are layers of influence including societal culture, customs and language, people’s ethnic background, as well as the political setting and economic circumstances. An individual’s values are integrated into a value system and are ranked according to their relative importance. Organisational values are the collective values of the organisation and they also impact on personal values. This has important implications for the socialisation process when people join an organisation, or perhaps when a change in values is required. Collins and Porras described an organisation’s core values as “essential and enduring tenets – a small set of timeless guiding principles”. The organisation’s value system will influence culture as companies subscribe to numerous values: both conflicting and compatible. These include how tasks are accomplished and how the company maintains internal cohesion and solidarity. It is important that the company’s value system is aligned with both its organisational structure and its reward system. When it comes to decision-making, both organisational and personal values are relevant.


 A company’s espoused values are the explicitly stated values that are preferred by an organisation. They reflect the image that the organisation wants to portray to the outside world. They are often aspirational and may or may not reflect the reality on the ground. Enacted values are the values and norms that are actually practiced by the employees on a day-to-day basis. If there is a gap between the two, it can have a significant effect on culture and employee behaviour (and how culture might be changed). This leads to the distinction between norms and values.


Norms are shared and generally accepted prescriptions for other people’s behaviour in a group setting. They give a mutual sense of “right” and “wrong” for the group. Unlike values, norms cannot be held by an individual – they dictate how a group of people behave in a social setting. Norms often include sanctions when people do not adhere to them: either sanctions by the organisation in the form of disciplinary measures, or informally by being ostracised or bullied by the group itself. Alignment of norms and values is therefore vital, and the embedding of the appropriate norms in the organisation plays a central role in regulatory compliance.


Level 3 – Basic Assumptions

To get a fuller understanding of an organisation’s behaviour, one must understand the basic assumptions. These are the unconscious, taken-for-granted beliefs held by people in the organisation. They are deep beneath the surface and cannot be readily observed by outsiders. It is how the group perceives reality and they tend to be non-debatable and mutually- reinforcing. Basic assumptions are very powerful in how they guide people in how to think, perceive and feel, and are difficult for management to change.


Functions of Culture

Culture fulfils four important functions in every organisation. Firstly, it gives employees a collective identity that binds them together. Secondly, it gives people a sense of purpose and pride. Thirdly, it provides a stable social system that provides support for members, and finally, it enables employees to make sense of their work environment and what it required of them.


While organisational culture focuses on values and beliefs, “climate” refers to the prevailing atmosphere in the organisation as perceived by its employees. Climate is the felt or affective dimension of culture. A positive climate is more likely where the values of an organisation coincide with those of its employees. In times of change, if the company does not get buy-in from its members, a negative work climate can ensue. Leadership is essential for driving desired behaviour in organisations, and this also requires trust. Such trust must be earned by leaders and has four pillars:

  1. Ability – where leaders have competence;
  2. Benevolence leaders demonstrate concern for others;
  3. Integrity adherence to a set of principles; and
  4. Predictability – consistent behaviour by leaders over time.

Trustworthy leadership is vital for driving employee engagement and delivering the right culture. It must be aggressively authentic.


Dominant Culture

When we speak of organisational culture, there is often an assumption that there is one homogenous culture throughout, with all employees sharing the same values.


In larger organisations, there may often be sub-cultures which represent smaller groups that have a different set of values and philosophy. This is often linked to educational background, professional identity, or geographical locations. Sometimes, conflict may arise between sub-cultures and the dominant culture which in turn, can develop into a“counter-culture” which rejects the main culture. This might happen, for example, when a company has been acquired by a larger organisation. Counter-cultures can be beneficial for example when they challenge group-think or where the existing culture and strategy is failing.

Risk Culture
All strategic objectives entail some element of risk, and this risk needs to be managed. A risk-aware culture must therefore be an integral part of the organisation’s culture. A risk
culture consists of the values, beliefs, knowledge and understanding about risk, shared by a group of people and with a common intended purpose in particular, the leadership and employees of a company. Risk culture is a way of framing risk in the organisation’s overall culture and management system.

Ultimately it is the responsibility of the board to ensure that the company is clear about its risk appetite, and that this is communicated throughout the organisation. The risk culture must be aligned with the company’s purpose, (ethical) values and strategy. A code of conduct can translate general values into more specific policies, which in turn, influences behaviour. Over time, this creates a risk culture. Such behaviour should then be the means by which leaders and employees are assessed, rewarded, and held accountable.

The evolving nature of organisations is creating many challenges for the development of the right culture. Much of the literature presupposes a group of people who go through a training period that includes being socialised in the company’s value system and who are then working constantly together. Zero- hour contracts, remote working, and a geographically-dispersed workforce all present significant challenges in creating a high-performance culture based on sound risk management principles. Yet, there must be no doubt about the value of such a culture. It requires solid leadership, based on ethical values and trust, and where leaders walk the talk.

Lawyer Photo

AUTHOR: Dr. Gerry Gallagher ,

MD of GBCL Governance and former academic in MTU (Munster Technological University)

ICQ Summer Edition 2020

This article was taken from Compliance Institute's ICQ Spring Edition 2022