Power With versus Power Over: Rethinking Risk Culture

TL;DR: Top-down risk culture frameworks and monitoring are useful, but they only take firms so far. Risk teams can build stronger frameworks, better challenge, and more resilient organisations by adding a bottom-up, decision-focused lens inspired by Mary Parker Follett’s idea of collaborative “Power With”.

The views and opinions expressed on this account are my own and do not reflect the official policy or position of my employer.  Any content provided is for informational purposes only and should not be considered or relied upon as professional advice.

Why Risk Culture Matters

Risk culture describes the behaviours that shape how an organisation identifies, assesses and manages uncertainty. Behaviours that improve a firm’s management of uncertainty include:

• Empowerment of individuals to identify, address and communicate issues,

• Creating psychological safety within and across teams, and

• Support for whistleblowing.

Regulators increasingly expect firms to define, manage and measure risk culture. The PRA, for example, expects Boards to “ensure that a culture of awareness and ethical behaviour is fostered from the top down and embedded across the firm”.

In practice, firms vary widely in how they define, document, communicate and measure risk culture. At a minimum, firms need to:

• Document how risk is managed (and how this is communicated to decision makers),

• Ensure positive norms are in place to empower individuals to take accountability for risk management, and

• Have standards in place to ensure that material decisions are supported by methodologies that account for uncertainty.

The limits of top-down culture

The PRA’s emphasis on Boards fostering a strong risk culture is not a new idea: the phrase “a fish stinks from the head down” has been in use since at least the thirteenth century.

Formal incentives, endorsed by the Board, should make clear which behaviours are encouraged and which are unacceptable.  It is a lot easier to measure and assess what behaviours are formally rewarded than those that are punished. The new FCA initiative requiring the reporting of non-financial misconduct (such as bullying, harassment and violence) is a genuinely positive step to add pressure on Boards to punish unacceptable behaviour and create transparency around how they reach decisions.

Informal incentives matter too [see Individual vs Organisational incentives]. The behaviours that are tacitly endorsed or informally rewarded can be just as influential as formal policies. They are also harder to measure because they are less visible, typically unacknowledged, and often applied inconsistently across the organisation.

We need to recognise that there are limits to what top-down culture enforcement can achieve. It works best for visible behaviours. It is weaker where good behaviour is harder to codify or is less visible.  Individuals want to preserve professional identity and autonomy, which can limit how far they will allow centralised behavioural rules to be imposed and monitored from above.

When firms seek a more expansive version of top-down cultural control, they can run into issues:

• Increased costs driven by greater demands on management time, employee generation of data, creation of monitoring systems and reports, resolution of “false positives”, and governance oversight.

• The availability and usefulness of the information available to monitor compliance tends to deteriorate as the granularity of oversight increases.  This can result in;

  • Over-simplified definition of “good” employee behaviour, which can create inappropriate incentives.

  • Employee backlash from increased surveillance.

  • Reduced employee empowerment to address issues and decisions that fall outside the norm.

• Increased normalisation of non-compliance .  The more we seek to control, the more we create “informal” or “invisible” behaviours.  This results in a performance that complies with the business’s expectations, disguising the messy reality that occurs somewhere else, out of view.

Measuring Risk Culture

Because risk culture matters, firms naturally try to measure it. This is where the problems begin. As a risk profession, we have a habit of trying to quantify things that are not always usefully reduced to a score (I’m looking at you, Operational Risk Appetite). Risk culture is a prime example.

Metrics can still be useful, but only if we are honest about their limitations. Some firms use culture dashboards to support genuine discussion. Others use them to satisfy regulatory expectations. Either way, the risk is the same: the measurement can become a performance of control rather than a source of insight.

Risk culture measures tend to fall into three types:

Measure type	Example	Limitations
Engagement	Training Attendance	Metrics tend to be noisy, limiting their use as an objective measure: poor training attendance could be an indicator of badly designed training, low relevance, or broader stress, rather than a cultural problem.  Making training compulsory adds cost to the business and reduces the usefulness of metrics.
Compliance	Count of key process breaches; Assessment of voluntary engagements with risk team (e.g. proportion of risk events risks raised by business).	A compliance culture is related to, but different to, a risk culture. Compliance breaches will often either have patchy coverage of desired behaviours, or will have incomplete visibility of breaches. A function with high scores relating to engagement with the risk team could reflect a good risk culture, but it often reflects a lack of team empowerment or status to resolve issues, encouraging greater engagement with the risk team.
Psychological assessments	Psychometric and psychological profiles at team and individual level, assessing predisposition to risk and ethics.	This can be a really useful tool, although costly to implement.  The tool is less useful if employees do not engage honestly (which is more likely in teams with a bad risk culture). The tool is also often only loosely indicative of future behaviour: personal and team ideology is more likely to be relevant where there is less data to support decision-making, and may vary depending on context, decision type, level of empowerment, function maturity and stress levels(iv).

What should risk teams do?

Too often, risk culture is treated as something consistent across the whole firm: a set of values imposed from the top. In this model, the risk team instructs the business, monitors compliance and resolves exceptions. This conforms to the “Power Over” view of management which is prevalent in management theory[i] and regulation design.

Mary Parker Follett (1868-1933) offers an alternative template for understanding power , helping us see that culture is not just something imposed from above, but something created through everyday collaboration, challenge and decision-making. This “Power With” lens can complement top-down cultural control frameworks.

Mary Parker Follett: Power With versus Power Over

“So far as my observation has gone, it seems to me that whereas power usually means power-over, the power of some person or group over some other person or group, it is possible to develop the conception of power-with, a jointly developed power, a co-active, not a coercive power.”[ii]

Mary Parker Follett was a pioneering thinker in organisational theory and management. Writing more than a century ago, she challenged mechanical views of the workplace and emphasised the human, relational side of organisations. Her ideas remain useful because many firms still understand authority primarily through a hierarchical lens.

Follett described three useful forms of power:

1. Power Over: Managers have power over employees.  This is often seen as “extractive” – i.e. to gain power you must first take it from someone else and then get others to comply with your authority.  This is driven by rigid, top-down hierarchies where managers dictate tasks.(i)

2. Power With:  Jointly held power resulting in collaboration and collective action across all levels of the organisational hierarchy, with employees not feeling less valuable than their managers. Power With succeeds where different perspectives and ideas are incorporated to resolve a common problem.  It emphasises the importance of individuals’ expertise rather than defaulting to hierarchical position.  With respect to dispute resolution, Follett proposed finding new creative solutions that met the needs of all parties, rather than forcing compromise or domination.

3. Power To: The power individuals and teams have to create new things (e.g. processes, products, systems, and frameworks).

Follett was not arguing for the elimination of hierarchy. Instead, she showed that organisations contain different forms of power, and that management theory becomes weaker when it is blind to any power dynamic that does not conform to “Power Over”. Her definition of leadership is especially relevant to risk culture: “Leadership is not defined by the exercise of power but by the capacity to increase the sense of power among those led.” [ii]

“Power With” improves resilience

Power relationships are rarely static. Organisations often oscillate between more centralised and more distributed forms of authority. Centralisation can happen unintentionally, as remits expand and temporary power shifts become permanent. It can also happen deliberately, when leaders believe tighter control will produce better outcomes (for themselves, or for the organisation).

Stress is one of the most common drivers of power centralisation[iii].  The desire for centralising power in an organisation can become intoxicating where rapid (internal or external) change overwhelms organisational tools systems and frameworks that are unable to change at the same pace. This can be because:

• Senior management genuinely believes that it is best placed to fix problems. 

• An attempt to sidestep a decision-making process that is insufficiently flexible to enable quick action in times of peril. 

• Leaders have been seduced by the idea that their position in the hierarchy is a reflection of their superiority in decision-making. 

For stress scenarios that have been wargamed, temporary centralisation can be useful. It can support fast, coordinated action. But even then, the quality of the response usually depends on earlier “Power With” collaboration: the broader engagement, challenge and expertise that shaped the plan before the crisis arrived.

For unplanned stress scenarios, centralisation is more dangerous. It can exclude the people whose experience is most relevant to the problem at hand. Where the senior management team has gained its experience under organisational and industry conditions that are in the process of being disrupted, an effective solution will likely require input from outside the leadership team.

Excluding the wider organisation from the decision-making process, especially in times of stress, weakens resilience[v]. Organisations that maintain decision-making delegation, psychological safety and flexibility are better placed to anticipate, avoid and adapt to shocks. They can draw on more expertise, generate more options and respond faster when conditions change.

There are caveats. Delegation has to be meaningful and durable. Psychological safety has to be real, not simply asserted in a culture survey. Employees also need permission, time and confidence to identify problems and propose solutions as part of normal business activity – the first time employees are asked for their input shouldn’t be when the building is on fire!

Bringing Follett’s “Power With” Ideas into Risk Culture Analysis

The prevailing approach to risk culture still relies heavily on a “Power Over” model of authority. That approach has value, especially for visible behaviours where there are clear and unambiguous standards for good practice. But it is incomplete. It tells us less about how issues are really identified, challenged and resolved inside teams.

Applying Follett’s “Power With” lens helps risk teams understand how work actually gets done. It encourages them to look at local decision-making, informal authority, psychological safety, challenge dynamics and the practical ability of teams to manage uncertainty. This requires risk teams to treat risk culture as local, dynamic and decision-specific rather than homogeneous or static. It allows for changes in risk culture as people move roles, processes evolve, reporting lines shift, strategy changes and businesses become more complex.

This knowledge can then be used to tailor risk frameworks and risk team engagement models to complement how the business is managed from the bottom up, and improve organisational resilience.

Useful questions for a bottom-up view of risk culture include:

• What is the universe of decisions that can be affected by this team / relate to this risk?  What is the quality, completeness and maturity of data and processes available to support this decision? How is uncertainty analysis factored in?

• What formal and informal ownership, governance and oversight is in place to identify, assess and managed related issues?

• What ideas and uncertainties can be openly discussed within the team, and what ideas are shut down / considered outside the scope of the team’s remit?

• How does the team define success?  What are its biggest priorities? How does it define its remit?  What are the explicit and implicit assumptions that support the definition of team role and strategy?

• How does a team’s resource, capability and prioritisation align with its terms of reference?

Risk culture assessments should also be linked to material decisions, not just periodic firm-wide reporting. This is especially important during periods of stress or organisational change, when top-down culture assessments are often least predictive of behaviour. Decision-focused assessments should consider:

• Engagement with business experts,

• Tolerance for bad news or contrary opinions,

• Accuracy of communication to decision-makers of definitions of success, scope, methodology, and outcome,

• Tolerance for, and assessment of, uncertainty in the decision-making process, and

• Formal and informal incentivisation.

Done well, this does not mean more control for its own sake. It means understanding where the business is well placed to own risk decisions, and where more active challenge is needed. It helps risk teams design frameworks that support the organisation as it actually operates, not as it appears on an organisation chart.

Building this understanding allows the creation of an effective and adaptive risk strategy for each risk area and material decision.  The purpose of this analysis is increased understanding, not centralised control or increased risk team power. Only the discovery of categorically toxic behaviours should be escalated and addressed. 

This exercise should allow a better allocation of risk teams’ efforts, not a greater workload.  Where local risk cultures are found sufficiently robust to support decision-making, risk teams can reduce their assurance activity and increase business empowerment, whilst increasing effective and proactive risk challenge where they are not.

Bottom-up risk culture analysis empowers risk teams to build a risk framework to support the organisation as it is, rather than what we would like it to be.

---

I hope this blog sparks ideas and discussion. If you found it interesting, please share or connect with me on LinkedIn to contribute or provide feedback!

---

[i] https://www.bostonreview.net/articles/caitlin-c-rosenthal-accounting-slavery-excerpt/ provides a short summary of how many “modern” management techniques – including Gantt charts, task and bonus systems, and a focus on time discipline – originated in the plantation slave system.

[ii] Mary Parker Follett, The Creative Experience, 1924

[iii] van den Berg, J., Alblas, A., Blanc, P. L., & Romme, A. G. L. (2022). How Structural Empowerment Boosts Organizational Resilience: A case study in the Dutch home care industry. Organization Studies, 43(9), 1425-1451. https://doi.org/10.1177/01708406211030659

[iv] The Impact of Ideology on Decision Making