CORES Risk Culture & Awareness Training 3 â Questions and Answers
Question 1: Which framework component directly links individual employee behavior to organizational risk culture?
- Governance structure
- Risk and control self-assessments (RCSAs)
- Performance management and incentive systems (Correct answer)
- Capital adequacy calculations
Correct answer: Performance management and incentive systems
Incentive systems shape behavior by rewarding or penalizing specific actions, making them a direct lever for reinforcing or undermining risk culture.
Question 2: The concept of 'three lines of defense' in operational risk culture assigns which primary risk culture role to the second line?
- Owning and managing risks in business processes
- Providing independent assurance to the board
- Setting risk frameworks and challenging the first line (Correct answer)
- Executing customer-facing transactions
Correct answer: Setting risk frameworks and challenging the first line
The second line (risk management and compliance) designs the risk framework, sets standards, and provides oversight and challenge to business units.
Question 3: When assessing risk culture during a regulatory examination, supervisors most commonly focus on which evidence?
- Volume of risk policies documented
- Employee conduct, escalation patterns, and management response to incidents (Correct answer)
- Size of the risk management department
- Number of risk committee meetings held
Correct answer: Employee conduct, escalation patterns, and management response to incidents
Regulators assess lived culture through behavioral evidence such as how incidents are escalated, communicated, and remediated rather than by counting documents.
Question 4: A risk awareness campaign uses gamification elements such as leaderboards and badges. What risk does this approach introduce?
- It may reduce participation by making training feel optional
- It can shift focus to winning rewards rather than genuine understanding (Correct answer)
- It increases the cost of the training program significantly
- It violates GDPR by tracking employee progress
Correct answer: It can shift focus to winning rewards rather than genuine understanding
Gamification can create extrinsic motivation that crowds out the intrinsic understanding of why risk management matters, reducing cultural impact.
Question 5: Which of the following is an example of 'middle management squeeze' in risk culture?
- Middle managers receive conflicting signalsâpressure to hit targets and comply with controls simultaneously (Correct answer)
- Middle managers are excluded from risk training programs
- Middle managers set the firm's risk appetite
- Middle managers approve all operational risk losses
Correct answer: Middle managers receive conflicting signalsâpressure to hit targets and comply with controls simultaneously
Middle management squeeze occurs when managers face competing pressures from above (performance targets) and below (employee concerns about controls), weakening cultural consistency.
Question 6: What is the PRIMARY reason operational risk culture is considered a 'soft' risk driver?
- It is only relevant for small community banks
- It involves behavioral and attitudinal factors that are difficult to quantify (Correct answer)
- It has no impact on regulatory capital requirements
- It is managed exclusively by HR departments
Correct answer: It involves behavioral and attitudinal factors that are difficult to quantify
Risk culture is 'soft' because it involves human attitudes, norms, and behaviors that resist easy measurement, unlike financial metrics or control counts.
Question 7: An organization redesigns its risk training to include real-world case studies from past industry failures. What learning principle does this apply?
- Spaced repetition
- Experiential and contextual learning (Correct answer)
- Classical conditioning
- Passive information transfer
Correct answer: Experiential and contextual learning
Using real-world case studies grounds training in authentic contexts, making abstract risk concepts concrete and memorable through experiential learning.
CORES Risk Culture & Awareness Training 3
Which framework component directly links individual employee behavior to organizational risk culture?