The Risk Culture Framework: Introducing an Integrative Framework for Holistic Risk Analysis

Risk culture shapes individual, group, organizational, and societal risk perception, and behavior, and, therefore, is a promising concept in risk analysis. Risk culture concepts are popular among practitioners since they have the potential to integrate different research strands and provide practical guidelines. However, such concepts are still ill-defined, and their empirical foundations are limited. We introduce a new framework for risk culture derived from research on organizational culture and risk climate that aims to overcome the shortcomings of current models. The Risk Culture Framework is a 3 × 3 matrix that differentiates three influence domains (i.e., person, social context, and risk situation) and three cultural layers (i.e., observable, non-observable, and implicit factors). The framework can be applied in different contexts and fields of risk research. Each cell of the matrix can be filled with specific, proven factors relevant to the context of interest. The framework aims to enable the integration of different disciplines and approaches, to enlarge the understanding of mechanisms that shape risk perception and behavior, to navigate the conception of research studies, to provide a blueprint for comprehensive risk measures, to guide practical risk analysis, and to facilitate benchmarking for appropriate risk cultures. Considerations for the application of the Risk Culture Framework, as well as its validation through future research, are outlined.

the context of interest.The framework aims to enable integration of different disciplines and approaches, to enlarge the understanding of mechanisms that shape risk perception and behavior, to navigate the conception of research studies, to provide a blueprint for comprehensive risk measures, to guide practical risk analysis, and to facilitate benchmarking for appropriate risk cultures.Considerations for the application of the Risk Culture Framework, as well as its validation through future research, are outlined.Keywords: risk culture framework; risk analysis; risk science; integration How can uncertainty and complex risks be addressed more comprehensively, more consistently, and, thus, more successfully?Most recently, for example, the course of the Covid-19-pandemic demonstrated both the complexity of systemic, emerging and unfamiliar risks and how different backgrounds and understanding can shape the perception and assessment of these risks.In order to address and manage complex risks, the concept of risk culture as a comprehensive approach, which considers a social entity's specific understanding of risks, has received some attention (e.g., Ashby et al., 2012;Carretta et al., 2017;Sheedy & Griffin, 2018;Wood & Lewis, 2017).However, the current state of risk culture concepts is equivocal: it is popular amongst risk management practitioners (e.g., Sinha & Arena, 2020), as it deals with a comprehensive understanding and management of risks' relevant factors, and regulatory requirements demand its use in some fields (Ashby et al., 2012).It still, however, remains relatively novel, ill-defined and published research on conceptual clarity and methodological detail is limited (Ring et al., 2016;Zeng et al., 2020).One major reason for these shortcomings stems, at least in part, from the focus of research on, for example, the practical application in a single industry or company (Power et al., 2013, Sheedy & Griffin, 2018).Moreover, there is little agreement amongst practitioners as to the concept of risk culture (Power et al., 2013;Sinha & Arena, 2020).In this article, current perspectives on risk culture are discussed, and a new Risk Culture Framework (RCF) is introduced.This Framework is based on aspects of both risk and organizational culture research, and enables integration of key findings from psychological risk research and other disciplines.Thus, the RCF provides a conceptual foundation for the operationalization of risk culture studies in different fields and/or with different perspectives.The RCF particularly aims to benefit risk assessment and interventions in complex situations on a societal, organizational and individual level.In order to illustrate the potential application of the RCF, multiple hypothetical examples are described, and suggestions for validation and future research are outlined.

RISK CULTURE AND SHORTCOMINGS OF CURRENT CONCEPTS
Risk culture is a particularly complex and abstract construct from both a theoretical and practical perspective.It is based on two multilayered concepts: risk and culture (McConnell, 2013;Previati, 2017).Taking human subjective assessments into account, risk can broadly be defined as "uncertainty about and severity of the events and consequences (or outcomes) of an activity with respect to something that humans value" (Aven & Renn, 2009, p. 6).This definition implies that evaluations can be aligned or shared between people; but also that different individuals, groups, organizations or societies can have different definitions of what is of value and, therefore, can have different understandings, assessments, perceptions and handlings of risks in general and of specific risks in particular.Accordingly, risk is not seen as an independent objective truth or ontology by itself, but as, at least in part, socially dependent and culturally embedded (Jasanoff, 1999).
There is little consensus on a cohesive and satisfactory definition of risk culture.Generally speaking, risk culture comprises social entities' (e.g., a group, organization, society) values, norms and traditions that determine how risk is identified, understood, evaluated and handled (Institute of International Finance, 2009).As culture generally drives situational understanding and, thereby, indirectly shapes perception, assessment, attitude and behavior (Schein, 2017), risk culture specifically shapes risk-perception, -assessment, -attitude and -behavior (Gupta & Liu, 2017;Sheedy & Griffin, 2018).Hence, risk culture can be defined as shared values, beliefs, knowledge and understanding of risks for a specific social entity (Ring et al., 2016).This means that different social entities (e.g., groups, organizations, societies) and their members can have numerous implicit and explicit convictions on how to deal with the many aspects of risks, which can be labeled as risk culture.These differences in convictions can lead to different responses to risk and, therefore, differences in risk cultures can result in different outcomes.For example, it could be assumed that during the COVID-19 pandemic, a distinct risk culture emerged together with new behavioral norms and evaluations that are both shared by many people but may also differ between social entities.
One major challenge facing risk culture is the identification and examination of relevant factors that contribute to risk culture.On the one hand, risk relevant factors can vary in different contexts.Thus, different factors with different relationships can be decisive in different contexts.On the other hand, many effects like group think (Janis, 1972) or biasing (Tversky & Kahneman, 1974) can occur in different contexts.As such, current risk culture concepts can be criticized as being too narrow because they are either limited to one context, such as the financial industry (e.g., Ring et al., 2016), or are too one-sided, for example if they only consider single aspects or determinants such as very general dimensions of culture (e.g., Zeng et al., 2020).
A second major challenge facing risk culture refers to the consideration, conceptualization and operationalization of both the different cultural layers and, more specifically, less accessible characteristics like implicit assumptions (Corneille & Hüter, 2020;Gawronski et al., 2020).Generally speaking, cultural layers describe different levels of accessibility of a social entity's shared values and attitudes from observable to implicit characteristics (Schein, 1988).The search for relevant factors of risk culture needs to consider factors on all cultural layers.In our opinion, current risk culture concepts remain superficial and conceptually ill-defined as they are restricted either to observable behavior or structures, such as risk climate (e.g., Sheedy et al., 2017), or provision of easily quantifiable measures to outsiders such as statements for an organization or the constitution of supervisory boards (Fritz-Morgenthal et al., 2016).In contrast to, for example, safety culture which is broadly defined as shared beliefs, norms, values, practices and structures, with respect to safety in organizations (Aven & Ylönen, 2021), risk culture has a broader scope.First, risk culture is not limited to organizations or a specific context.Accordingly, risk culture exists in, and can be applied to, different forms of social entities on a macro (e.g., societies), meso (e.g., organizations) and micro level (i.e., individuals as members of social entities).Second, risk culture can incorporate other related concepts such as safety culture as a specific, safety-orientated form of risk culture.However, risk culture research would benefit greatly from a comprehensive and conceptually well-defined identification and assessment of all cultural layers.
A third challenge for risk culture concepts refers to construct validity.Conceptual clarity implies that the construct of the pronounced risk culture concept can be empirically validated.To the best of our knowledge, no construct validation has yet been undertaken for a context-agnostic risk culture concept.The only relevant study of which we are aware of that tests and conforms the factor-structure of the pertinent concept used a model of risk climate that is limited to the financial industry (Sheedy et al., 2017).The lack of validated concepts and measures that can be applied more broadly to different risk contexts may stem from the strong interest of practitioners in risk culture concepts and their focus on the application in mainly the field of organizational risk management (Nguyen et al., 2019;Sinha & Arena, 2020).On one hand, practitioners might not feel the urge to tackle the plight of validation as long as a concept works for them.Moreover, existing models often seem to be built on practical demand and specific contexts rather than theoretical consideration or existing empirical research.On the other hand, from a scientific point of view, validation should take place before application.In order to increase the likelihood of successful validation, it is advisable to consider existing research and relevant theories independent of the potential context of application.If a risk culture concept is theoretically well founded and applicable to a wide range of contexts, it will bridge the gap between theoretical foundation and practical usefulness, as exemplified in Kurt Lewin's (1943) famous reference to an unknown businessman's statement that "there is nothing as practical as good theory" (p.118).On the long run, construct validation will foster practical usefulness by facilitating standardized measures, increasing comparability of results and establishing benchmarks.
Finally, published research on risk culture often has a rather retrospective and descriptive approach such as exploring corporate failures (e.g., McConnell, 2013) or public disasters (e.g., Banks, 2012).In our opinion, this outlines another shortcoming of current concepts: risk culture concepts should have a predictive validity as well and, therefore, be capable of making predictions by linking characteristics of a risk culture with future outcomes, such as resilience to risk or specific risk behavior.For example, a risk culture concept should allow for assessment of future health risks for a social entity on the basis of the entity's current health-related risk culture.Overall, this calls for a theoretically-orientated and integrated framework, which considers all cultural layers of observability, provides guidelines for factor selection, accounts for different effects of handling risks, is applicable to both different contexts and social entities, and is capable of not only explaining past events but also of making predictions.

THE RISK CULTURE FRAMEWORK
As a first step towards building an integrative framework for risk culture, related theories and models such as those from the areas of culture, risk theory, safety culture and risk climate (for an overview see: Guldenmund, 2000) should be assessed and incorporated.We believe that different influencing dimensions can be both relevant and indeed helpful in the understanding of the driving factors of a social entity and its members risk attitudes, perceptions and behavior.Such dimensions have a bidirectional nature as they can either be seen as the objects of attitudes and, therefore, describe how culture forms behavior, or as the structuring components on which a specific culture is built.While, for example, different models on safety culture incorporated different dimensions like 'software', 'people' and 'risks' (Cox & Cox, 1991), or 'person', 'behavior', and 'environment' (Geller, 1994), they all acknowledged the impact of individual, social and environmental factors.In line with other researchers (Carretta et al., 2017;Cornia et al., 2016;Power et al., 2013;Previati, 2017), we argue that risk attitudes, perceptions, assessments and behavior are influenced by factors of the self, social context and environment (for an overview, see: Raue et al., 2018).Accordingly, we propose three influence domains, specifically, characteristics of the person , the context including the social context, and the risk situation, as the first structural elements in our Framework.
The work of Schein (1988Schein ( , 2017) ) is then used as a base to structure cultural elements.Schein introduced a 3layered organizational culture model, which is well established and differentiates between artifacts, espoused values and beliefs, and basic assumptions.These three layers of organizational culture are characterized by a reduction in observability and accessibility.Expanding on Schein's model, which is based on the mechanism of shared learning, values and beliefs, we further incorporate influencing factors of risk perception, risk behavior and risk situation.To do this, we propose three layers corresponding to yet broader factors beyond the organizational context that drive risk perception and behavior, namely observable ,non-observable and implicit factors.Observable factors correspond to artifacts (Schein, 1988(Schein, , 2017) and comprise all characteristics, which are accessible from the outside, such as visible behavior and structures (see Table 1 for examples).Non-observable factors correspond to the layer of espoused values and beliefs from Schein's model.This layer is less visible from the outside but discernible to insiders (e.g., group norms), explicitly assessable (e.g., personality) or calculable from derived data (e.g., likelihood).The third layer, implicit factors, includes basic assumptions, which are often described as the essence or DNA of a group's culture.Characteristics of this third layer are neither immediately recognizable to insiders nor to outsiders but can be evaluated with indirect measures (Corneille & Hüter, 2020, Gawronski et al., 2020).Implicit factors shape perception, meaning, emotion and behavior.Within one risk culture, behavior that contradicts such implicit factors is perceived as irrational or strange (Schein, 2017;Zeier Roeschmann, 2014).However, implicit factors can contradict formal structures, which can generally be routed to conflict and, specifically, to a problematic risk culture.
The proposed integrative Risk Culture Framework combines the three domains of risk influences (i.e., person, social context & risk situation) with three layers of culture, which represent decreasing accessibility (i.e., observable, non-observable & implicit) in a 3x3 grid (see Table 1).Each influence domain contains all cultural layers, and all layers can be applied to all domains.To map a specific risk culture (e.g., a populations risk culture regarding health and longevity; an organizations risk culture regarding emerging risks and market changes) , this matrix comes alive by filling each cell with relevant factors from different research strands, disciplines and approaches.To list all of the possible hypothetical factors would be excessive and beyond the scope of this article.Instead, a shortlist of evidence-based examples of potential influence factors is presented that stem mainly from psychological research.Accordingly, factors displayed in Table 1 are exemplary and descriptive for the respective levels, without being generally valid for all fields of risk cultures.Cells of the grid are neither intended to contain selectively restricted factors nor to be understood as rigid units but are instead designed to be continuums.Risk culture can be understood as a dynamic model in which all aspects can mutually interact (cf.Zeier Roeschmann, 2014), and consequently, none of the suggested variables is dependent or independent per se.Instead, the respective scope of interest determines whether a particular variable is seen as dependent or independent.For example, since risk culture shapes risk behavior, most practitioners and researchers might be interested in risk culture as a means to understand and steer risk behavior and resulting outcomes.Consequently, they can focus on risk behavior as a dependent variable of a respective risk culture (e.g., Gardner & Steinberg, 2005;Jessor, 1992).Alternatively, risk behavior can function as a declarative characteristic and, therefore, is an independent variable of risk culture since past behavior shapes beliefs and basic assumptions of what is appropriate.For example, a particular health behavior could be viewed as a determinant of a risk culture affiliation or subgroup.Consequently, the aspect of risk behavior could be used as a dependent or independent variable of risk culture.
In addition, risk culture itself is dynamic.Social groups and organizations change the way they perceive, assess and handle risk so their risk culture thereby changes over time.For example, seat belts were rarely used in most Western countries prior to the 70s (cf.Fhanér & Hane, 1973).The societal risk culture accepted the risk of driving without a seatbelt at that time, and an adequate behavior was not to buckle up.Trafficrelated risk culture changed dramatically over the following decades, mainly due to compulsory seat belt use and its enforcement by law (Steptoe et al., 2002).Although risk culture is quite stable over time and has fixed structures, it is a dynamic construct as it is changeable and adaptive to situations.Accordingly, risk culture not only shapes risk perception and behavior, but understanding, assessing and influencing risk culture could provide a powerful risk analysis and management tool.Understanding a current risk culture will allow for effective intervention and, in so doing, affect sustainable changes in risk culture.
Moreover, the introduced RCF enables integrations of existing approaches to risk management in general and risk culture in particular.For example, the practice of enterprise risk management, that is the assumption that risks are measurable, determinable and calculable in a rationale manner, comes along with specific conditions like organizational guidelines, structures, and understanding of risks (Mikes, 2009).These conditions can be understood as part of a risk culture and integrated into the grid of the RCF.Up to now both the understanding of risk culture and its application in research have a strong background in organizational culture and corporate risk culture, and encompass corporate workflows or processes (cf.Lo, 2015;Palermo et al., 2015;Shefrin, 2016;Wood & Lewis, 2017).However, existing models of risk culture often describe single factors which enable to distinguish between different risk cultures.Such distinguishing factors comprise group cohesiveness, power distance (Douglas & Wildasvsky, 1982), disaster framing, trust in authorities or blaming (Cornia et al., 2016).These models regularly provide a narrow view on risk culture by, for example, lacking implicit factors.The RCF understands these guidelines, structures and understanding as elements of the organizations risk culture but aims for a more comprehensive view on risk culture and enables integration of such distinguishing factors.
In summary, risk culture comprises different cultural layers of accessibility such as shared observable, nonobservable and implicit factors with respect to risk within social entities like societies, organizations, groups or individuals as members of the social entity.The shared cultural understanding and handling of risks stem from factors of the person, the social context, and the risk situation.Risk culture is dynamic inasmuch as the specific risk culture of a social entity is stable and structured yet changeable over time.This dynamism accounts for a reciprocal interaction: social entities can construct and adapt their risk culture so that risk culture has an enduring impact on risk perception, assessment and behavior of social entities and their members.

Exemplary Application of the RCF
Three hypothetical examples are given below to demonstrate the potential application of the RCF and which highlight different scopes (i.e., society, organization, individual) and contexts (i.e., health, business, outdoor activity) of the Framework.Furthermore, the examples illustrate the modus operandi of the RCF in different scenarios from intervention planning, post-hoc analysis, benchmarking, to individual decision making.It should be noted that to increase validity, the evaluation of the RCF structure should be part of a broader data analysis when applying a new measure for a specific risk culture.
The first example addresses a macro level and uses obesity as a complex risk, which not only affects the well-being of the individual but also has societal and macro-economical consequences, like additional costs for healthcare, days absent and tax revenue (OECD, 2019).Obesity is on the rise despite increased awareness of its down sides and improved availability of preventative measures.In the context of the RCF, one assumption could be that the weight-related risk culture of people at risk of being overweight differs from people who are not at risk.Based on existing empirical research, a measure of weight-related risk culture can be constructed by applying the most influential factors (e.g., based on reported effect sizes in metaanalyses, expert elicitation, or their fit to a theoretical or methodological definition) to the 3x3 grid of the RCF.If cells of the grid remain either uncovered or unrepresented -which seems particularly likely for the implicit layer -according measures need to be created and pretested (Corneille & Hütter, 2020;Gawronski et al., 2020).Data analysis could either focus on the differences in the risk culture between overweight and non-overweight participants, or further explore the sub-risk-culture/s (e.g., level of education, region or age).
Network analyses (e.g., Thoma et al., 2020) could facilitate detection of central relevant factors, interdependencies of factors and differences between risk cultures of subgroups.Furthermore, exploring the risk culture of different sub-groups could unravel potential gaps between scientific knowledge on weight-relevant factors and convictions of sub-groups regarding their weight.A knowledge of both the central factors and knowledge-conviction-differences for the different subgroups should facilitate decision makers in customizing intervention measures and communicating relevant information.
The second example addresses the meso level and illustrates problematic risk culture in organizations.Organizations like companies face various internal and external risks, which in the case of a fictitious medium-sized biotech enterprise can be related to a lack of skilled workers, fast transformation from small start-up to medium-size, changes in regulations or an unreliable supply chain (cf.Brustbauer, 2016).Regardless of the specific risks that a company could face, the risk culture of the company needs to recognize and address the risks for an effective risk management in the organization (Nguyen et al., 2019;Sinha & Arena, 2020).
Otherwise, the company will lack resilience and face fundamental problems in handling these risks in the future.Application of the RCF in this case would provide a comprehensive measure on how the company assesses and handles risk.Comparing potential risks with the existing risk culture works like a stress-test and enables detection of areas for improvement.Application of the RCF in this context would also enable a comprehensive retrospective look at corporate failure or establishment of benchmarks for adequate risk cultures at specific branches.
The third and final example addresses risk perception and behavior of an individual as a member of a social group.Imagine an individual free-rider planning to ride a mountain hillside where he has the risk of triggering an avalanche.The risk of avalanches can be roughly estimated by simple rules of thumb based on the current risk level provided by the regional avalanche-report and the steepness of the mountain hillside in question.However, as research suggests (e.g., McCammon, 2004;Raue et al., 2017), many non-snow factors such as biases in perception, group dynamics or bodily states can deteriorate decision making in the mountains.Applying the RCF in this case could help improve personal decision making by considering relevant influencing factors in the decision-making process beyond just the avalanche risk level.The free-rider in our example can work through the 3x3 grid of the RCF and reflect on the importance and influence of each cell on his current decision-making process.In relation to his own person, the free-rider could reflect on his general risk propensity, competence, current physical fitness, past experiences or willingness to abstain.
In relation to social context, i.e. his membership in the social entity of free riders, he could reflect on group norms, on social recognition for wild rides, on group rituals, on group pressure or shared learning experiences.
In relation to the risk situation, he could reflect on the severity and consequences of an avalanche on this specific hillside, familiarity with similar snow conditions, the level of complexity of the situation, exposure to information and potential biases pertaining to that information.These reflections should improve the overall quality of decision making by reducing the likelihood of overlooking important influential factors.In this example, the RCF serves as an ad hoc tool.Furthermore, a RCF-based study could also explore the most important factors for decision making in a specific context like avalanche assessment.It is envisaged that completing the RCF grid accordingly would provide an effective decision-making tool, which can be used as a tick-list in a standard operating procedure.

Next Step: Validating the RCF
Construct validation of the RCF is beyond the scope of this manuscript and is suggested as a next step for research.Issues that should be considered in such research are outlined here.The first consideration is to include a subject of risk .Options are, at least in part, dependent on variations in the relevant risk culture.Furthermore, the risk should stem from multiple and interacting factors at different levels of accessibility.
Existing empirical research on the subject would be beneficial in identifying and measuring these relevant factors.For example, risks that are related to road traffic, health or sustainability and environment protection would be suitable.Many (if not all) people (and, therefore, potential participants) are affected in these scenarios, the issues are well researched, and they comprise many aspects of risk assessment and behavior, which are transferable to other contexts.A second consideration should be the scope of the risk subject : this should not be too narrow and, therefore, affect only a specific group of people (e.g., misuse of Whiskey) and yet not too broad (e.g., consuming beverages) to allow for test economy and transferability of results to other contexts.A very general scope also contains the risk of evening-out the structures of specific risk cultures.A third consideration is the distinction of a risk culture, which can specifically relate to a social entity (e.g., parents with young kids), or refer to time (e.g., the course of a pandemic) or an outcome (e.g., body mass index).Having a narrow focus to a specific risk culture enables the detection of specific features endemic to this risk culture but could hamper transferability to other contexts.Therefore, a fist validation study should choose a wider focus.A fourth and final consideration refers to methodology .In general, the framing, focus and wording of the measures need to reflect the scope and distinction of the selected risk (e.g., the relevance of nutrition on longevity in one's region).Moreover, the means of measurement needs to fit the cultural level of accessibility.Observable factors can be assessed with accessible data (e.g., constitution of board, formal structure) and/or with structured interviews or self-reported, explicit questionnaires (e.g., risk behavior).The latter measures are appropriate for non-observable factors as well (e.g., risk perception).
In contrast, implicit factors require implicit measures.Developing easy-to-use measures for implicit factors might, in some fields, present some challenges (cf.Corneille & Hütter, 2020;Gawronski et al., 2020).
After testing the structure of the RCF in different contexts, future research could also address variations of risk cultures and their effectiveness in handling risks in specific contexts such as health and longevity, environmental protection, financial crisis or globalization.When sufficient data and measurements or guidelines for the measurement of context-specific risk cultures are available, the RCF could be used to align methodological consistency in risk culture research and, thus, define benchmarks for adequate 'risk-culture-ship', for example, those demanded by the financial regulatory authorities (Ashby et al., 2012).Such benchmarks for risk cultures will serve the need for practical risk analysis guidance (Aven & Flage, 2020): they enable detection of potential pitfalls and weaknesses in a specific risk culture, and guide evidence-based, customized intervention to foster resilience and improvement.However, we acknowledge that there is no such thing as a perfect and everlasting risk culture, and the measure of any specific risk culture of a social group or organization needs to evolve to fit current and emerging risks.Therefore, benchmarks can only reflect a snapshot and are in need of continuous evaluation.

CONCLUSIONS AND OUTLOOK
In conclusion, the RCF aims to provide an integrated theory-and evidence-based approach to analyzing risks in complex contexts.The RCF offers a basis for comparing risk culture research.This is achieved by the Framework's ability to integrate different research strands.Relevant factors that contribute to a topic's risk culture can be identified through literature review on a specific topic and then assigned to the matrix of the RCF.In doing so, vacant or under-represented cells become evident.Factors within a cell can be ranked so as to attain an appropriate measure.New findings on context relevant factors can be added adinfinitum, and, thus, both the framework's content of a specific risk culture and its applications can be further developed.The framework can even facilitate learning from disciplines beyond those commonly used (e.g., developmental evolution; Laubichler, 2019; Renn et al., 2020).Hereby, the matrix of the Framework serves as a blueprint for assigning new approaches.In addition, in the future the RCF can facilitate the development of comprehensive measurements, can help to detect effective and inappropriate risk culture, and can guide decision making.

Table 1 .
Risk Culture Framework Note .Possible factors in all cells are not restricted to the listed examples, which are based on empirical research.