Risk culture in practice: what brokers should look for

Most businesses say risk management matters. The harder question is what happens after someone finds a fault, near miss or overdue action. Is it owned, dealt with and followed through, or does it stay on a list?

This is where risk culture becomes visible. It shows how a business manages risk between surveys and renewals. Brokers do not need to inspect controls themselves. A few simple questions can help them see whether a client knows its main risks and acts on them.

What good risk culture looks like day to day

“Good risk culture is visible. It can be seen in the condition of the premises, the quality of maintenance, how contractors are controlled, how incidents are investigated, how changes are managed and whether identified improvements are actually completed,” says David Reynolds, Head of Risk Engineering and Surveys at RiskSTOP.

Clear ownership is a good place to start. Senior leaders need to know which risks could cause serious harm or disruption. Managers and employees also need to understand the controls they are responsible for. Risk cannot sit only with the health and safety, facilities or compliance team.

The Health and Safety Executive’s Managing for health and safety guidance says health and safety should be part of good management, rather than a separate system. David takes the same view of the wider insurance picture: “Property protection, health and safety, environmental management, cyber risk, security and business continuity should not operate entirely independently.”

Looking beyond compliance

Businesses must meet their legal duties. Even so, compliance in one area does not show how every insured risk is managed.

A business may have the right documents and inspections but still have overdue repairs, weak contractor controls or poor plans for disruption. A certificate can confirm that a specific check took place. It cannot show how well every control works each day.

David puts it this way: “Questions should be asked along the lines of: What could realistically cause us a serious loss, and are we doing enough to control it? This moves the discussion from paperwork to what happens in practice.”

As most within the industry are aware, risk changes. New equipment arrives. Buildings are altered. Different materials are stored and new contractors come on site. Good risk management should pick up those changes before they create a bigger problem.

Spotting the warnings before a claim

Claims show what has already gone wrong. Risk engineers call these lagging indicators. Other signs can warn a business much sooner.

Warning signs include overdue maintenance and open risk actions. The same issue may appear in several audits. Near misses may rise and housekeeping may slip. Temporary repairs may also stay in place for too long.

One overdue job may have a reasonable explanation. A growing pattern is more important. It could show that the business is struggling to identify, prioritise or close risk issues.

HSE’s leadership guidance advises boards to consider preventive information, such as progress with maintenance and training, alongside incident data. Put simply, managers need information that helps them act before a serious event happens.

Practical questions brokers can raise

Brokers do not need to judge whether each control is technically sound. These questions can help them understand the client’s approach and spot when expert advice may be useful.

What has changed since the last risk review?

New equipment, materials, layouts, contractors or ways of working can create different risks. Ask how the client considered the effect on people, property and trading.

Which maintenance or risk actions are still open?

Outstanding work is not always a sign of poor culture. Ask who owns the action, why it remains open, when it is due and what happens if the deadline is missed.

How is higher-risk contractor work controlled?

Hot work, electrical work, roof work and jobs affecting fire protection can bring serious risks. Brokers do not need to inspect permits or supervision. They can ask how contractors are chosen, briefed and monitored, and how the site is checked when the work ends.

What has the business learnt from incidents or near misses?

A useful investigation looks beyond the person closest to the event. It asks why the controls failed and whether the same issue could exist elsewhere in the business.

What would stop the business trading?

Ask which machines, suppliers, utilities, IT systems, people or locations are essential. Then ask how the client would cope without them. This makes business continuity planning more practical.

What information reaches senior management?

Claims data looks backwards. Maintenance delays, repeat findings, near-miss trends and open actions may give managers an earlier view of problems.

Honest evidence is more useful than reassurance

Clients do not need to claim that everything is perfect. As David explains: “An organisation that understands its deficiencies, has prioritised them and can demonstrate a credible improvement programme may give an insurer greater confidence than one which simply claims that everything is satisfactory.”

That does not promise a better premium or a particular decision. Underwriters will still consider the full risk, including claims history, appetite and market conditions. Clear records do, however, help brokers explain what the client has done, what remains open and how progress is being managed.

Good risk culture is practical. People know what they own. Problems are raised, actions are completed and lessons are shared. For brokers, a few simple questions can show whether risk is being actively managed. They can also reveal when a client needs more specialist support.

RiskSTOP works with brokers and businesses to make significant exposures clearer and risk improvements easier to act on.