To mark the next season of RelyOn, our joint podcast with Rely where we sit down with subject matter experts and leaders to explore ways to build better workplaces, we spoke with Anne-Marie Paterson, Acting Chief Risk Officer at Medibank.
With a career spanning financial services, insurance, and regulated industries, Anne-Marie has spent years working at the intersection of non-financial risk, people risk, and organisational culture. She is known for her direct, no-jargon take on risk leadership and for challenging the assumption that compliance and performance are the same thing.
Most organisations believe they have a risk culture. In reality, many have a compliance culture. For executives running fast-growth businesses, understanding the difference between the two is where reputations, and sometimes companies, are won or lost.
We put that tension directly to Anne-Marie in the latest episode of RelyOn. Her answer was pointed: “Prescriptive obligations drive a compliance culture, a tick-box mentality.” That’s not an argument against regulation. It’s an argument for investing in something more.
The comfort of rules and their limits
Rules give people certainty. Anne-Marie acknowledges that plainly: “People naturally want to know what are the limits. What can I do? What can I not do?” Defined boundaries reduce anxiety and clarify accountability, and there is real value in that.
The problem is what happens next. When teams optimise purely for staying inside the lines, they stop asking the harder questions about second-order consequences, slow-burn cultural drift, and the risks that don’t announce themselves until the damage is done. Regulators globally have noticed. The Institute of Risk Management has long argued that effective risk culture is behavioural, not procedural. APRA has embedded risk culture assessments into supervisory practice for the same reason: formal controls don’t guarantee sound decisions.
Compliance builds structure. Risk culture builds the judgement to use it well.
Risk culture is a competitive advantage, not a handbrake
One of the more persistent myths in high-growth environments is that rigorous risk management slows momentum. Anne-Marie challenges that directly: “I don’t think you can have high performance without a mature risk culture.”
That reframe matters. Sustainable performance is not just revenue and margin. It’s reliability, reputation, talent stability, and the quality of decisions made under pressure. Amy Edmondson’s research on psychological safety consistently shows that teams who surface problems early outperform those who suppress them. Organisations with genuine risk literacy at every level detect weak signals sooner and avoid the compounding failures that undo years of growth.
Risk culture doesn’t constrain ambition. It disciplines it.
Risk is everyone’s job, including HR
One of the most important shifts Anne-Marie describes is the decentralisation of risk ownership. Risk no longer lives in a central function. It sits with product teams, sales leaders, operations managers and HR.
She is unambiguous: “If you’re an HR professional, I think it’s imperative that you also are a risk professional.” Not by acquiring formal credentials, but by recognising that people risk, including psychosocial hazards, restructures, speak-up culture, and moral injury, carries enterprise-wide consequences. When HR sees its role purely through a performance-management or compliance lens, it underestimates the influence it has on risk maturity. And when risk functions ignore the human context behind their policies, they miss the early warning signs that matter most.
Mature organisations bridge that divide deliberately. The ones that don’t tend to find out why it mattered through a regulator or a front page.
Empathy isn’t enough. You need the infrastructure.
There is a version of the cultural openness conversation that stops at “create a safe space.” Anne-Marie is clear that this is insufficient. “You could be the most empathetic leader, but if you don’t have the tools and processes, you’re no better than the person who says, ‘I don’t want to hear it.'”
A genuine risk culture requires both the courage to surface uncomfortable issues and the systems to respond to them consistently and fairly. Without psychological safety, risks stay hidden. Without infrastructure, surfaced risks are mishandled. Compliance culture tends to focus on policies and documentation. Risk culture integrates behaviour, systems, and shared understanding into how decisions actually get made.
Back to basics
Before any organisation can elevate its risk culture, it needs alignment on a foundational question: what does risk mean here, and why does it matter? Without shared language, teams read signals differently, decisions fragment, and accountability diffuses. With shared understanding, risk becomes an operating discipline rather than a policing mechanism.