Certified in Risk and Information Systems Control (CRISC) — Question 251

Which of the following is the BEST indication of a mature organizational risk culture?

Answer options

• A. Corporate risk appetite is communicated to staff members.
• B. Risk policy has been published and acknowledged by employees.
• C. Management encourages the reporting of policy breaches.
• D. Risk owners understand and accept accountability for risk.

Correct answer: D

Explanation

The correct answer, D, signifies that risk owners are aware of their responsibilities, which is crucial for a mature risk culture. While options A, B, and C are important components of risk management, they do not demonstrate the same level of ownership and accountability that D does, which is essential for effectively managing risks in an organization.