Risk culture is defined as norms of behaviour for individuals and groups that determine the collective ability to identify and understand, openly discuss and act on an organisation’s current and future possible risks. Although studies have been done on risk culture, an assessment of the maturity level of risk culture in a South African government organisation has not been reported in the academic literature. Many government organisations have implemented risk management processes but it seems that, subsequently, no tangible benefits have been realised from applying these processes. The reason for this might be that these organisations did not first embed a risk culture. This article assesses the risk culture maturity level of a South African government organisation. Data were gathered by developing and applying a questionnaire and a checklist. In addition, documents were analysed. The results show that the organisation has established basic risk management processes and structures; however, a mature risk culture was not embedded in the organisational processes.

Risk culture is defined as norms of behaviour for individuals and groups that determine the collective ability to identify and understand, openly discuss and act on an organisation’s current and future possible risks. Although studies have been done on risk culture, an assessment of the maturity level of risk culture in a South African government organisation has not been reported in the academic literature. Many government organisations have implemented risk management processes but it seems that, subsequently, no tangible benefits have been realised from applying these processes. The reason for this might be that these organisations did not first embed a risk culture. This article assesses the risk culture maturity level of a South African government organisation. Data were gathered by developing and applying a questionnaire and a checklist. In addition, documents were analysed. The results show that the organisation has established basic risk management processes and structures; however, a mature risk culture was not embedded in the organisational processes.