The word
Risk Management Practices / Technology Innovations

The Secret Life of Culture: Unveiling Culture Risk in the Age of Machine Learning

icon of PDF file with down arrow



This paper has been prepared by Mike Durland and Mark Caplan. Mike Durland is independent contributor to GRI  from the Munk School of Global Affairs at the University of Toronto and Mark Caplan is President of Global Risk Institute. This is original research and applied theory authorized for GRI publication. The opinions expressed are solely those of the author(s).

In many organizations, across many industries, the most vital opportunities to drive growth, as well as the most pressing risks, start with people. In the financial services industry, it is often said that, “Our most important assets go up and down the elevator every day” — The same can be said for the most significant liabilities.

Central to the concept of modern risk management is the belief that methodologies have evolved that enable organizations to control what would otherwise be the domain of fate. Stakeholders — customers, shareholders, regulators, employees — no longer tolerate leaving matters to chance. It is the expectation of stakeholders that executive management of modern organizations apply the methods and technologies at their disposal to actively and effectively manage risk. As a result, effective risk management today is inseparable from the notion of executive accountability. This has led to the realization of a concept that Michael Power calls the “risk management of everything” — the modern pervasiveness and high emphasis on managing risks[1] .

In the wake of the global financial crisis, one area of risk management that has seemingly eluded control, but certainly not accountability, is corporate culture. There is perhaps no better recent example than Wells Fargo. To many, Wells Fargo was perceived to be top of the class for corporate culture. They survived the crisis with very little financial or reputational damage. Their relentless focus on cross-selling (measured by products per customer), and their intense application of metrics to drive results were seen by many competitors to be the bellwether for how a modern customer-oriented bank should successfully operate.

Yet something went horribly wrong. Wells Fargo’s relentless focus on product per customer and their intense application of metrics produced a set of goals that became increasingly unattainable. Past “success” promoted an “achieve your goal at any cost” culture. The crossed wiring of incentives and culture was a ticking time bomb, which ultimately detonated when certain individuals began to cheat to achieve their sales targets. One can obtain a clear example of the inseparability of risk management and accountability by watching Elizabeth Warren’s grueling and frequently uncomfortable questioning of John Stumpf during his Senate Banking Committee hearing.

In the past several decades, many large financial institutions have suffered from the negative impacts of culture risk. In fact, many commentators have highlighted culture as a predominant cause of the global financial crisis. Described by many as a culture of greed, the internal ethos of “succeed at all costs” dominated the financial services industry in the years preceding the global financial crisis. In the years immediately following the crisis, the danger of this culture of greed was frequently reinforced with incidents such as the pervasive and collusive activity of Libor and FX manipulation by a number of large global financial institutions.

As a result of these very public and painful lessons, most financial institutions have begun to recognize that people can be their most significant liabilities. They understand that it is people who ultimately execute strategy, make granular decisions, interface with customers and execute transactions. The conduct of each and every individual within an organization has the potential to contribute to the success, or to the failure, of that organization.

Not so long ago, people-related issues were seen as uncontrollable — the providence of bad luck. However, in the world of the risk management of everything, executives are held to a much higher standard. Warren’s questioning of Stumpf was a wake-up call.

At Wells Fargo, the problem was not the result of a rogue trader and, unlike the market manipulation scandals, it did not originate on a trading floor. The issue arose somewhere far less predictable — the traditional retail bank. It was a case in which many presumably good people engaged in bad behavior in order to achieve goals set by management and the board. While there is no doubt that it was appropriate to hold Mr. Stumpf accountable for the crisis of culture that materialized within Wells Fargo, the pertinent question becomes: What could and should management have done to manage this risk?

To be clear, the banking industry is by no means alone when it comes to the need to manage people-related risk. In the time since allegations of sexual harassment were made by Susan Fowler at Uber in February of 2017, a continuous stream of similar allegations have come to light against an ever-growing list of companies, including The Weinstein Company, NBC, Nickelodeon, Amazon, Warner Brothers, MediaCorp, the BBC, O2 (Telefonica group), the International Olympic Committee and more.
Across all industries, a great deal of focus is now being paid to improving mechanisms for the reporting and handling of harassment in the workplace, and there is renewed debate about what constitutes acceptable behavior and governance.

In the wake of the global financial crisis, one area of risk management that has seemingly eluded control, but certainly not accountability, is corporate culture.

What is Culture?

Before we can begin to advance the concept of managing people-related risk, and culture risk more broadly within an organization, we need to define what we mean when we use the term “culture”. A simple definition of culture is the social behavior, values and norms found within a group. This definition highlights that culture is rooted in the concept of behavior, and more specifically in collective behavior.

Most large enterprises organize their human resources in a hierarchy. Executives at the top of the organization establish goals for the organization, then push those goals down through the hierarchy. This design enables large enterprises to effectively organize their people so they can focus on the important strategic imperatives of the organization’s shared goals, and by doing this concentrate their collective efforts on achieving these goals.

Achieving shared goals is enabled by collective effort. In high-performance organizations such as the military, professional sports teams, and many enterprises, the ability of the individual to de-prioritize his or her own interests to favor the interests of the collective is a key component of success. Rogue, self-interested behavior is shunned. To be part of the team, self-interest is subordinated for the good of the team.

However, hierarchies present a unique challenge. In large hierarchical organizations, there is often a large number of nodes between those at the top of the organization and those who are ultimately executing the activities required to achieve the goals.

To ensure control, organizations establish values and norms that are similarly pushed down the hierarchy; these values and norms are designed to act as a governor. Organizations aspire to achieve their goals, but only within the constraints of the values and norms that are established. The objective is to achieve goals without violating values.

Culture acts as both as an enabler and a constraint. One can think of this as a simple optimization problem: the objective is to achieve collective strategic goals (such as maximizing risk-adjusted returns) subject to not violating collective values.

The duality of this problem enables us to think of the problem in reverse: to achieve the highest standard of ethics and responsibility subject to achieving collective strategic goals. Framing the problem in the second way illustrates the reality that is often in play. Goals and values can often be in conflict — in other words, there is often a trade-off between optimizing collective goals and collective values. A strong, healthy culture is one that creates a balance between organizational goals, and organizational values and norms.

In order to ensure that the desired balance is achieved, one must fundamentally have the ability to measure and monitor both sides of this ledger.


The Risk Management of Culture

The risk management of financial goals benefits from years of development of the principles and methodologies of both accounting and finance. Today, sophisticated organizations meticulously monitor a large number of metrics which enables them to, in near real time, determine whether they are successfully achieving their strategic goals. Today, the mantra is “if we can measure it, we can manage it”. In a world of data analytics, large organizations thrive in the world of measurement and management.
Traditionally, culture has been hard to measure and the tools used to measure culture have been crude at best. The ability to measure performance relative to strategic goals, alongside the relative inability to measure the state of culture, has likely led many organizations to over-emphasize the management of financial goals relative to the management and measurement of values.

It is not a stretch to assert that the challenges that Wells Fargo faced might have been rooted in this very imbalance. Wells Fargo had set very aggressive goals and had designed an elaborate set of metrics to track progress against these goals. The weight they assigned to achieving their goals was out of balance with the weight they assigned to achieving their values, which was likely as much a function of lack of tools for measuring and monitoring their culture as it was an absence of values.


Systemic, Localized, and Latent Culture Risks

Often when stakeholders assess the culture of an organization, they focus on the “tone from the top”. They assess whether the proper set of values and norms have been clearly established within the organization by the board of directors and senior management, whether the board of directors and senior management consistently demonstrate and reinforce those values, and how effectively they have communicated those values down through the hierarchy. If there is a lack of clearly established values, or weak “tone from the top”, the organization may be classified as having an imbalanced or weak culture that is highly vulnerable to problematic behavior. We classify this type of culture risk as systemic culture risk.

While systemic cultural problems are often unconcealed, standing in plain sight for all to see, there are two other forms of culture risk that are much harder to detect: localized culture risk and latent culture risk.

Localized culture risk is the risk that a small subset of individuals or groups within an organization conduct themselves in a manner that is inconsistent with the values and norms established by that organization. Localized conduct issues may be comprised of a wide range of behaviors, including (but not limited to): poor performance/results, interpersonal conflict, inappropriate interactions, negligence, deception, and fraud. If not identified, managed, and remedied, these issues can fester and leave an organization vulnerable to potentially devastating consequences.

Latent culture risk is the risk that the actual “active” culture within an organization materially differs from the “desired” culture. Latent culture risk can evolve for a variety of reasons. As was previously described, the goals of an organization are often at conflict with the values and norms of the organization. Goal-based incentives and metrics use a more formalized system of reinforcement within an organization, and thus often have a more powerful effect on behavior. Furthermore, in large complex hierarchical organizations, the distance from the top of the hierarchy to the bottom of the hierarchy presents significant challenges in enforcing a standard set of values and norms. Divisional heads, geographic/regional heads, middle managers – any influencer, formal or informal, within an organization — can have significant impact on the values and norms of the people around them. As a result, culture can often have a “secret life” all its own, hidden from the very people at the top of the organization that bear the accountability.

Systemic culture risk is the purview of the board of directors and other key stakeholders such as regulatory bodies. An effective board must hold the CEO accountable for establishing a clear set of values and norms and for effectively communicating those values and norms down through the organization.

Localized and latent culture risks are the purview of the executives of the organization, with the ultimate accountability residing with the CEO. This accountability transcends the establishment of appropriate norms and values, and of effective communication. Today, the C-suite is held accountable for ensuring that the organization has an effective culture. The management of culture risk requires a set of tools that enable the secret life of culture to be unveiled.


Towards a Proactive Approach to Culture Risk Management

In the world of the risk management of everything, executives are held accountable for ensuring that their organizations have the capabilities in place to manage culture risk. Historical approaches to the management of culture risk have been mostly reactive and focused on mitigating problems after they have occurred, since available tools have not enabled organizations to predict problems or to proactively prevent problems from arising in the first place.

This reactive approach is not without merit. When your house is on fire, it is certainly useful to have a fire extinguisher. But the first step in fire management is fire prevention, or at the very least an early warning system in the form of a smoke detector. Electrical fires are often the most damaging; they usually start in the walls, out of sight, and spread quickly. A smoke detector provides an early warning of the growing problem, enabling one to address it before it rages out of control. Culture risk is similar, often beginning as something benign, then growing out of sight until it manifests into something far more substantial and malignant. A preventative approach to risk management is one that seeks to identify cultural risk signals before they are able to spread and worsen.

The challenge is how to construct a system that enables an organization to measure, monitor, and manage culture risk proactively and holistically, and to provide the early warning system that will enable the organization to identify and address developing risks.

It is helpful to think of culture risk management from a system perspective. The starting point for this system would be data that informs the important emotional or cultural attributes of all employees in the organizational hierarchy, as well as the interpersonal dynamics that make up the fabric of the organization. There is a broad set of attributes that management might be interested in measuring such as stress, anxiety, engagement, empowerment, authenticity, open-mindedness, conscientiousness, neuroticism, disgruntlement, dishonesty, propensity to take risks, relationship quality, influence, pressure, and so on.

Once these attributes for each person are measured and their relationships within the organizational hierarchy are established, the measures can be aggregated across groupings, such as capital market employees or bank branch employees, or by gender, geography, or any other parameter. And of course, once these attributes are modeled across the organization, they can be compared across different time periods. If an organization can achieve this, it will have constructed a powerful system its executives can use draw a variety of insights into the organization’s culture.


The Application of Machine Learning to Culture Risk

In the recent past, the challenge of measuring attributes such as engagement, anxiety, and stress in anything near real-time would likely have required employees to commit to completing frequent surveys. Such surveys would require significant time and effort, which would certainly result in material distraction and loss of employee productivity. Surveys are also known to be highly prone to manipulation and bias, and findings are often out of date before they can be acted upon.
An alternative approach is to apply machine learning to the problem. There are several potential challenges to applying traditional machine learning techniques to the problem of culture attribute measurement. Firstly, machine learning algorithms must be trained, which is not a trivial task even within a large organization. Secondly, most machine learning algorithms are black boxes, so while they likely have some potential to extract, measure, and predict attributes of culture, traditional machine learning tools would leave the user in the dark about how they arrived at the answer.


If not machine learning, what else?

Given that the challenge is to measure emotional and psychological attributes, a better approach might exist at the intersection of psychology, linguistics, and natural language processing.

Today, there are three major schools of thought in psychology: biological, behavioral, and cognitive. The biological approach focuses on the interaction of mind and body; one of its more lauded branches is the field of neuropsychology, where an overarching goal is to discover which parts of the brain are related to which behavioral and biological functions [2].

The behavioral approach is so-named because it focuses on human behavior, its main goal generally being the study of ways to predict and adjust behavior. This approach is the one in which several famous early psychological studies, such as Pavlov’s dog [3] and Skinner’s box[4] are entrenched. After Noam Chomsky published a critique of pure behaviorism [5], in which he argued that the framework could not account for the complex linguistic process of language acquisition, the behavioral approach to psychology came to be combined with the third major approach to understanding human behavior: cognitive psychology

Cognitive psychology seeks to understand mental processes, including cognition, emotion, and language. It can be combined with behavioral psychology, neuropsychology, social psychology, and linguistics in order to understand and predict human behavior, mental states, and mental processes. In terms of organizational health, this approach is the one from which we can draw the most major, actionable insights for businesses.

A combination of cognitive psychology, social psychology, and linguistics, Language-Psychology Science can provide a particularly useful research base for understanding the people, psychologies, and social dynamics that make up an organization. Language-Psychology Science can provide the ability to obtain insight into people’s likely behavior through their use of language — the basic means of daily communication between members within any organization.

With a small number of writing or speech samples from an individual, Language-Psychology Scientists can perform statistical analyses and obtain a holistic understanding of that person’s emotional or psychological state. Likewise, a similar understanding can be achieved through the same means (writing samples from its members) for an organization’s psychological “culture.” This understanding can come from a variety of linguistic sources containing people’s everyday language, including engagement surveys, emails, chat logs, or even transcripts of phone calls, interviews and meetings.

The benchmark methodology for deriving the emotional meaning from human language is the Linguistic Inquiry Word Count model, known as LIWC. LIWC was developed by James W. Pennebaker, a professor from The University of Texas at Austin, and author of a book titled, “The Secret Life of Pronouns”. Much of Dr. Pennebaker’s work explores the connection between emotion, behavior, perception, cognition, and language with a specific focus on what he calls “stealth words,” or the small function words in our lexicon, such as prepositions and pronouns, which are seemingly invisible in day-to-day speech. These seemingly innocuous function words (such as I, me, you, he, for, it, of, this, etc.) play a crucial role in helping us to understand identity, detect emotions and realize intention; they also provide important clues about social and cultural cohesion.

LIWC evolved out of Dr. Pennebaker’s research. At its essence, LIWC is a model that maps words to a set of categories or factors. Each factor has psychological meaning. By counting the frequency of word use by factor, or by combinations thereof, one is able to draw statistical inferences into the author’s emotional state. LIWC is a very important and broadly-utilized model that has been applied to a large number of use cases ranging from measuring emotional tone, to monitoring mental health, to identifying leadership potential, to detecting negative social influences, to predicting attrition and even detecting deception.

James Pennebaker and Jonathan Kreindler founded Receptiviti, a Toronto-based company focused on the application of LIWC and a number of proprietary machine learning tools to the area of people analytics. Their technology provides a powerful new tool set for the management of culture risk. Core to their solution is their ability to extract important attributes of culture from human language. They have combined this capability with a set of visualization and analytics tools that provide large organizations with the ability to proactively and holistically analyze culture, and the psychological states, relationships, and dynamics of the people who constitute a corporate culture.


Summary and Conclusion

People are our biggest assets, but also our biggest potential liabilities. In the world of the risk management of everything, the board of directors, the CEO, and all of the executives of an organization are held to the highest level of accountability for culture risk. Yet culture often has a secret life of its own within an organization. Historically, culture risk has been challenging to manage effectively. This has been due in large part to the lack of effective tools available for managing culture risk proactively and holistically.

To effectively manage culture risk, the organization should be viewed as a functioning organism, with each piece influencing other pieces while contributing at the same time to the health of the organizational environment as a whole. New tools, such as the proper application of Language-Psychology Science, provide organizations with the ability to reveal hidden culture and detect environments that aren’t as healthy as they could be, as well as environments that are healthier than others. Such techniques can enable organizations to diagnose potential problem areas by understanding their impact on employee psychology before they ever manifest into problematic behaviors, and before they require major action.

Combining psychology and linguistics with data science and machine learning to create a holistic system provides the means to predict behavior from changes in psychological state, as evidenced through changes in a person’s use of language.

Applying Language-Psychology Science to culture risk management can provide a holistic view of systemic and latent culture risk by looking at the overall psychological health of the organization at the aggregate level. An aggregate view provides insights into the general atmosphere, health, emotions, and cohesion of the people who make up the organization — a high level view of the organization and how smoothly it functions on a daily basis. This aggregate measure can be tracked over time to monitor for changes to an organization’s overall health, and can also be benchmarked against other institutions to provide a relative measure of the organization’s overall health compared to other organizations in the industry in which it operates. For any organization undergoing a deliberate culture change initiative, a tool of this kind could prove invaluable.

To monitor localized culture risk, one must drill down into a more detailed diagnostic of how various groups, and the people within them, work together in organization. Two major indicators can be used to diagnose and assess localized culture risk: relative differences between groups, and changes in the culture attribute risk measures over time.

By highlighting places where the psychology differs from organizational norms, or where significant changes to psychology occur over time, the system can flag areas of concern for potential investigation. These areas of concern may show psychological differences from the organization as a whole, or differences from established norms based on departments, roles, geographies, or any other structural grouping within the organization. Differences to norms at other organizations within the same industry can also be taken into account.

When an organizational team shows significant negative variance from established organizational norms with respect to stress, for example, the whole organization suffers. Diagnosing this difference and pinpointing the group in which it occurs can enable leadership to take the first steps toward rectifying the situation. On the more sinister side, specific changes to other psychological attributes such as stress, anxiety levels, or risk-taking tendencies within a team can be indicative of an environment which may be fertile for insider threat type behavior. Identifying these psychological changes as they occur can provide an organization with the early warning system required to prevent culture risks from materializing.

Wells Fargo was a wake-up call for many financial institutions, and the recent events at Uber, The Weinstein Company, and Amazon have forced virtually every large corporation to recognize their exposure. It is now obvious that stakeholders will no longer tolerate attributing internal people issues to bad luck. We live in a world of the risk management of everything. The world of the risk management of everything is a world of accountability. Fortunately, powerful tools are emerging that enable large institutions to maximize the value of their human assets while proactively minimizing the risk of their human liabilities.



[1] Power, Michael. ” The Risk Management of Everything: Rethinking the politics of uncertainty” (2004). Demos.

[2] Luria, “The Working Brain” (1973), pp. 20– 22.Thompson, Richard F. & Zola, Stuart M. “Biological Psychology”, in Weiner (ed.), Handbook of Psychology (2003), Volume 1: History of Psychology.

[3] Pavlov, I. P. (1927). Conditioned Reflexes: An Investigation of the Physiological Activity of the Cerebral Cortex. Translated and Edited by G. V. Anrep. London: Oxford University Press. p. 142.Todes, Daniel Philip (2002). Pavlov’s Physiology Factory. Baltimore MD: Johns Hopkins University Press. pp. 232 ff. ISBN 0-8018-6690-1.

[4] Skinner, B. F. (1958) Verbal Behavior. Acton, MA: Copley Publishing Group. ISBN 1-58390-021-7.

[5] Chomsky, N.A. (1959) A Review of Skinner’s Verbal Behavior. The New York Review of Books. 1971 Dec 30;17:18–24.