CORES Risk Culture & Awareness Training 4 — Questions and Answers
Question 1: Under Basel Committee guidance, which pillar of the Principles for the Sound Management of Operational Risk specifically addresses risk culture?
- Principle 1: Governance (Correct answer)
- Principle 4: Risk appetite and tolerance
- Principle 6: Risk identification and assessment
- Principle 10: Business resilience and continuity
Correct answer: Principle 1: Governance
Basel's Principle 1 on governance establishes that the board is responsible for creating a culture of sound operational risk management throughout the organization.
Question 2: A CRO notices that operational risk losses cluster in one business unit. A risk culture diagnostic would FIRST examine which factor?
- The unit's contribution to total revenue
- Leadership behaviors and incentives within that business unit (Correct answer)
- The number of staff employed in the unit
- The unit's geographic location
Correct answer: Leadership behaviors and incentives within that business unit
Concentrated losses often reflect local cultural issues driven by how unit leaders model risk behavior and how incentives are structured within that team.
Question 3: What distinguishes a 'compliance-based' risk culture from a 'values-based' risk culture?
- Compliance-based cultures rely on rules and penalties; values-based cultures rely on internalized ethical norms (Correct answer)
- Compliance-based cultures have more staff; values-based cultures have fewer
- Values-based cultures require more regulatory reporting
- Compliance-based cultures are associated with higher profits
Correct answer: Compliance-based cultures rely on rules and penalties; values-based cultures rely on internalized ethical norms
Compliance-based cultures depend on external rules and enforcement, while values-based cultures embed risk awareness as an intrinsic part of how employees think and act.
Question 4: An operational risk manager is designing a Key Risk Indicator (KRI) dashboard for risk culture. Which metric is MOST relevant?
- Number of new product launches
- Rate of near-miss and incident reporting per 100 employees (Correct answer)
- Total assets under management
- Number of branches opened in the quarter
Correct answer: Rate of near-miss and incident reporting per 100 employees
Reporting rate per employee captures willingness to disclose risk events, which is a behavioral signal of psychological safety and cultural health.
Question 5: Which type of training delivery is MOST effective for senior executives in building risk culture awareness?
- Mandatory e-learning modules with completion certificates
- Board-level tabletop simulations and risk scenario workshops (Correct answer)
- Poster campaigns in office common areas
- Annual general risk briefing emails
Correct answer: Board-level tabletop simulations and risk scenario workshops
Tabletop simulations engage executives in realistic, high-stakes decision scenarios that build genuine risk awareness and improve response quality.
Question 6: A firm's risk culture survey shows high scores on 'awareness' but low scores on 'escalation.' What does this disconnect most likely indicate?
- Employees understand risks but do not feel safe or empowered to report them (Correct answer)
- The survey instrument is statistically invalid
- Risk awareness training is unnecessary
- Employees are unaware of the escalation procedure
Correct answer: Employees understand risks but do not feel safe or empowered to report them
High awareness but low escalation suggests a psychological safety gap—employees recognize risks but fear consequences of reporting, which is a critical cultural failure.
Question 7: Which of the following is an example of 'risk culture contagion' in a large organization?
- A cyberattack spreads malware across business units
- A newly acquired entity's weak risk practices spread to the parent firm post-merger (Correct answer)
- Regulators impose fines that affect multiple subsidiaries
- A risk training video is shared across departments
Correct answer: A newly acquired entity's weak risk practices spread to the parent firm post-merger
Risk culture contagion occurs when poor cultural norms from one entity infect others, most commonly during mergers and acquisitions without adequate cultural due diligence.
CORES Risk Culture & Awareness Training 4
Under Basel Committee guidance, which pillar of the Principles for the Sound Management of Operational Risk specifically addresses risk culture?