INVESTIGATING AND ANALYZING THE LINK OR INTERCONNECTION

BETWEEN RISK CULTURE AND ORGANIZATIONAL VALUES WITHIN MRA.

EXPLOREING HOW ITS ESTABLISHED VALUES INFLUENCE THE DEVELOPMENT,

IMPLEMENTATION, AND MAINTENANCE OF ITS RISK CULTURE AND ASSESSING
THE ROLE OF LEADERSHIP IN SHAPING AND SUSTAINING A RISK CULTURE THAT

ALIGNS WITH THE STATED VALUES OF THE ORGANIZATION.

By

Davis Maloya

23012100233

Submitted to: Mr. Mphatso Naveya

Risk Management

Malawi Assemblies of God University

Odel Lilongwe Campus

20th March 2024

In partial fulfillment of the requirements for:

FCC3023

1
 Investigating and Analyzing the Link or Interconnection Between Risk Culture and
Organizational Values within Malawi Revenue Authority (MRA), Exploring How Its Established
Values Influence the Development, Implementation, and Maintenance of Its Risk Culture and
Assessing the Role of Leadership in Shaping and Sustaining a Risk Culture That Aligns with the
Stated Values of The Organization

Risk culture and organizational values are very important in an organization in pursue of
its objectives. These two issues are basically shaped by managers and other senior personnel.
Each and every organization has its own culture and values. In this paper, these two concepts are
being investigated and analyzed, we will also explore how the company`s established values
influence the development, implementation, and maintenance of its risk culture and finally, the
role of leadership in shaping and sustaining a risk culture that aligns with its stated organizational
values in Malawi Revenue Authority.

Malawi Revenue Authority (MRA), is an agency of the Malawi Government which was
enacted by the Parliament of Malawi in the year 2000. Its objective is to assess and collect
revenue for national development and to facilitate legitimate trade. MRA is headed by a
Commissioner General. It has two sister divisions namely, the Customs and Excise Division and
the Domestic Taxes Division. The two divisions are entrusted to assess and collect taxes and
facilitating legitimate trade. In addition to these two, it has supporting divisions such as
Corporate affairs, Information and Communication Technology (ICT), Finance, Internal Audit,
Administration, Human Resources, Enterprise Wide-Risk Management (ERM), and others.

Risk culture. This may be defined as values, beliefs, attitudes and knowledge or
awareness of risks held within an organization or an entity (Calle 2019). The European Central
Banks defines it as a set of norms, attitudes and behaviours related to awareness, management
and controls of risks in in a bank. It is the professional atmosphere of a company together with
its values, customs and traditions (Steinberg 2014). From the definitions, risk culture may be
summarized as an organization`s awareness to risks it has, it is associated with, those it should
anticipate together with its risk management strategies. Moreover, the Basel Committee on
Banking Supervision defines risk culture as the norms, attitudes and behaviours related to risk
awareness, risk taking and risk management and controls that shape decisions on risks. Culture
influences decision making in an organization (Schein, 2010). Every organization has its own
risk culture. It is this culture which enables an organization to take risks and deal with them in
pursue of its objectives.
Organizational values. According to WalkMe Team (2023), organizational values are a
set of fundamental principles and guidelines that steer a company`s operations. They shape the
conduct of employees and its interaction with all its stakeholders. These values vary from
organization to another. These are imbued in the most senior members of staff as well as the most
subordinates. They assist everyone associated with the company to behave and conduct business
transactions in a manner that supports the vision and mission of the organization. These values
are what the company senior personnel expect to see all employees practice.

2
 Malawi Revenue Authority (MRA) has four major organizational values which are,
Fairness, Integrity, Service Excellence and Transparency, abbreviated as FIST. All internal
stakeholders of MRA are required to live by these standards. Management and all employees are
required to be fair with conduct amongst themselves as well as its customers who are taxpayers
and the general public. They are also required to exercise highest integrity in their day-to-day
operations, for example by not receiving bribes and as well declaring gifts from taxpayers. They
are to provide the excellent services to the Authority`s customers always. Finally, they are
required to act in a transparent way. This entails that the actions of the authority should be open
enough to the public, the procedures being made available for the public to follow. They have a
taxpayer charter in which all services are laid out together with their timeline. All these values
enable the organizations internal stakeholders to work inline with the organization`s objective
which is to maximise revenue collection and to facilitate legitimate trade for national
development. In spite of having the organizational values stated, a study by Berette Values
Centre (2023) revealed that there is so much bureaucracy and empire building amongst at all
levels of the organization. The report by Berette Centre further reveals that there is high
corruption amongst officials at the institution, excessive bureaucracy, no fairness and no
employee recognition. According to Banton (2024), bureaucracy refers to a system having
complex structure, multiple layers and procedures. There are so many processes in MRA
undertaken to arrive at a decision. Bureaucracy leads to delays in decision making (Banton
2024).
The authority has a risk management framework which is headed by a full director. It has
developed a risk register which is used to capture functional risks, that is to say, each and every
function is required to identify, assess, and monitor its risks. The director oversees the risk
management process of the organization. In short, MRA has a risk culture that understands the
existence of risks in its operations. Though there is a risk awareness at the institution, it appears
that the risk culture is not that strong because of excessive bureaucracy, corruption and other
issues. The awareness to the existence of risks enables employees and management team to live
with organizational values. The values assist the organization to manage risks in many ways for
example, by exercising integrity, the risk of failing to achieve the organization objective of
maximizing revenue collection is dealt with. The risk culture is maintained as employees live
with the values. In short, risk culture is linked to organizational values.
According to Vendor Risk Management (2023), corporate culture and risk management
are intertwined. The corporate culture which is a result of employee behaviour has an impact on
how the organization identifies, assess, and manage risks. Organization`s ethical behaviours
portrayed in individuals may lead to reduce risk exposure. The Vendor Risk Management argue
that transparent and open communication may lead to timely identification of risks. According to
Deloitte and Touche (2006), risk management should not be regarded as being part of a project
but rather the way of doing things in an organization. Risk should be embedded in the process or
systems of an organization.
According to Kimbrougha and Componation (2009), organizational culture has an
impact on the implementation of initiatives or policies within an organization. Furthermore, a
study by Miccolis (2003) revealed that organizational culture is one of the barriers to the
implementation of an enterprise risk management. In the case of MRA, it may as well be
concluded that the organizational values are related to its risk culture. According to Carol
Williams (2023), both risk culture and organizational culture are created by an organization`s

3
management team. Thus, they reflect management decision making or view. Management
actions determine the risk culture as well as the organizational culture. Williams (2023), adds
that there are behaviours or cultural issues that prevent an organization from achieving its goals
or objectives. For instance, if employees of MRA will not practice the organizational values such
as fairness, integrity, service excellency and transparency, the objectives will not be achieved.
According to House (2004), organizational culture influences decision-making in an
organization. The culture determines how members make decisions on all issues affecting the
company. Effective and desirable organizational values lived may lead to good and strong risk
culture. This will enable the organization to achieve its goals. In summary, organizational culture
has a positive effect on the implementation of risk management.
According to Schein (2010), organizational culture is influenced by leadership. He also
adds that leadership is essential to enable the implementation of a risk culture awareness. Levy
(2011), adds that leadership need to show transparency, communication and support to create a
culture of risk. According to the literature, organizational behaviour reflects the behaviour of its
managers, this implies that leaders or managers of a company are at the fore front of designing
and maintaining the risk culture in accordance with organizational values. We may conclude that
the established values lived by managers and all senior personnel will illuminate in all other
personnel who will also live the values. Once the values are lived to the fullest, the result will be
the achievement of organizational objectives. Leadership shapes risk culture by actions and not
statements.
In this paper, risk culture has been defined as the norms and beliefs held by an
organization in relation to risk management. Values have been defined as the fundamental
principles that governs the conduct of business. Ther relationship has been discussed. We have
also discussed that organizational values have an influence on the implementation and
maintenance of its risk culture. Lastly, it has also been established that organizational leadership
has a role to play in shaping and sustaining risk culture of an organization.

Reference List
4
Juan Pablo Calle, December 11, 2019. What does risk culture mean? Available at
https://prianrisk.com/ accessed on 17 March 2024

European Central Bank, February 15, 2024. Strong risk culture- sound banks. Available at
https://www.bankingsupervision.europa.eu/ accessed on 17 March 2024.

Richard M Steinberg. What is Culture? Governance, Risk Management and Compliance 2014,
p5.

Schein, E. H. (2010). Organizational culture and leadership (Vol. 2). John Wiley & Sons

WalkMe Team, December 14, 2023. Organizational Values: Definition Importance and
Examples. Available at https://www.walkme.com/ accessed on 17 March 2024

Vendor Risk Management. November 23, 2023. The Connection Between Corporate Culture and
Risk Management. Available at https://www.getcerta.com/ accessed on 19 March 2024.

The Relationship Between Organizational Culture and Enterprise Risk Management by R. L.

Kimbrougha (Deloitte and Touche LLP) and P. J. Componation, (The University of Alabama in
Huntsville

Caroline Banton. March 18, 2024. What Is a Bureaucracy and How It Works, With Examples.
Available at https://www.investopedia.com/ accessed on 19 March 2024.

Malawi Revenue Authority- Overall Group-MRA Cultural Values Assessment report. Barrett
Values Centre. July 2023

The Relationship Between Organizational Culture and Enterprise Risk Management by R. L.

Kimbrougha (Deloitte & Touche LLP) & P. J. Componation, (The University of Alabama in
Huntsville)

Carol Williams. February 15, 2023. Culture, Governance & Oversight, Internal Audit. Available
at https://strategicdecisionsolutions.com/ accessed on 19 March 2024.

Malawi Revenue Authority Website. Available at https://www.mra.mw/ accessed on 20 March,

2024