A risk practitioner is asked to strengthen the organisation's risk culture so that staff make more risk-aware decisions day to day. Which action would most directly improve risk-aware behaviour across the workforce?
- ASenior leaders consistently model risk-aware behaviour and reward staff who escalate concerns early. Correct
- BThe board mandates that every staff member completes annual risk awareness training without exception.
- CThe internal audit function increases the frequency of control testing across all business units.
- DThe risk register is expanded to capture a wider range of operational and strategic risk scenarios.
Why A is correct: Tone at the top is the strongest driver of risk culture because staff take their behavioural cues from what leaders consistently do and reward, which turns risk awareness into routine practice.
Why B is wrong: Mandatory training raises baseline knowledge and is tempting because it is visible and measurable, but completion alone does not change daily behaviour if leaders do not reinforce it through their own actions.
Why C is wrong: More frequent testing improves assurance over controls, which is why it appeals, yet it is a detective activity that checks compliance after the fact rather than shaping the values that drive how staff behave.
Why D is wrong: A richer register improves visibility of risks and is attractive as a concrete deliverable, but it is a documentation artefact that does not by itself influence the attitudes or conduct of the wider workforce.