Risk culture — the collective way an institution understands, discusses, and responds to risk — is the foundation that determines whether a risk-management programme actually works in practice.
What we observed
In informal Council interviews across Tier-1 and Tier-2 Nigerian banks during Q4 2025, three themes recurred:
1. Documentation has outpaced behaviour
Most institutions have crisp risk policies on paper, but the gap between policy and day-to-day decision-making is widening. Boards expect line officers to push back on commercial pressure; in practice, many line officers don't feel safe doing so.
2. The risk function is still treated as a sign-off
Risk officers continue to be brought in late — typically when a deal is already structured. The Institute's recommendation remains: risk-function involvement should be a deal-shaping input, not a deal-blocking one.
3. Quantitative literacy is uneven
Younger risk officers are quantitatively strong; senior officers are strong on judgement but uneven on modern risk methods. The Institute's CPD programme is being expanded to close this gap.
Recommendations
- Boards should explicitly commit to a no-retaliation policy for risk-function escalations.
- Risk-function involvement should be shifted left in deal approval workflows.
- CRMI members should pursue at least 20 CPD hours per year in modern risk methods — the Institute now publishes a quarterly curated list.
This briefing is the first of a recurring Council series.
By CRMI Research Council. The views expressed are the author's own and do not necessarily reflect the official position of the CRMI Governing Council.
