The Australian Prudential Regulation Authority (APRA) has underlined the need for the country's financial institutions (FIs) to dedicate ongoing attention to understanding and managing their risk cultures.

APRA has released an information paper designed to provide an insight into current practices in risk management in a range of banking, insurance and superannuation businesses.

The authority, which regulates banks, credit unions, building societies and many other types of FI in Australia, acknowledged that there has been a stronger focus on risk culture in recent years.

However, it also stressed that "continued effort and ongoing attention is required", with approaches to understand and managing risk still at a fairly early stage of development.

There are a number of areas where institutions are encountering difficulties, such as coming up with a clear idea of the sort of risk culture they aspire to. Identifying and addressing specific weaknesses in risk management is also proving a challenge for many businesses.

Wayne Byres, chairman of APRA, stressed that the responsibility of ensuring that an organisation has a sound risk culture ultimately falls to its leadership - starting with the chief executive officer and the board of directors.

"This is not an easy task, but nonetheless it is critically important for an institution's long-run health," he added.

"APRA cannot regulate sound risk culture into existence. However, APRA will apply greater supervisory intensity to institutions that are either unwilling or unable to address behaviours that are inconsistent with prudent risk management practices."

Other findings from the regulator's research showed that approaches to understanding and managing risk culture tend to vary based on institutional size, business mix and complexity.

Some larger businesses have argued that their size and complexity makes it more difficult to implement a consistent risk culture, meaning that strategies are sometimes segmented based on geographical location or business unit.