CORES Risk Culture & Awareness Training 5 — Questions and Answers
Question 1: What role does internal audit play in assessing risk culture under a three-lines-of-defense model?
- Designs and implements the risk culture framework
- Provides independent, objective assurance on the effectiveness of risk culture (Correct answer)
- Sets the risk appetite for each business unit
- Trains employees on risk management procedures
Correct answer: Provides independent, objective assurance on the effectiveness of risk culture
As the third line, internal audit independently evaluates whether risk culture programs are effectively embedded and whether cultural norms align with stated values.
Question 2: A newly appointed Chief Risk Officer wants to shift the firm from a 'silo' risk culture to an 'integrated' risk culture. The FIRST step should be:
- Hiring additional risk staff in each department
- Conducting a risk culture diagnostic to understand current norms and gaps (Correct answer)
- Mandating weekly cross-departmental risk meetings
- Rewriting all operational risk policies
Correct answer: Conducting a risk culture diagnostic to understand current norms and gaps
A diagnostic assessment establishes the baseline state of cultural norms and identifies specific gaps before any change initiative can be designed.
Question 3: Which of the following best illustrates 'ethical fade' as a risk to operational risk culture?
- A firm's risk appetite statement is updated annually
- Employees gradually normalize small rule violations until large breaches occur (Correct answer)
- The risk committee reduces meeting frequency over time
- Training materials are not updated for three years
Correct answer: Employees gradually normalize small rule violations until large breaches occur
Ethical fade describes the incremental normalization of minor misconduct that desensitizes employees, eventually enabling major breaches of conduct or control.
Question 4: Which element should be explicitly included in a risk culture framework to sustain long-term cultural change?
- A one-time firm-wide risk training event
- Ongoing reinforcement mechanisms such as recognition programs and refresher training (Correct answer)
- A single board resolution approving the culture statement
- A risk culture policy document stored on the intranet
Correct answer: Ongoing reinforcement mechanisms such as recognition programs and refresher training
Sustained cultural change requires continuous reinforcement through recognition, refresher learning, and leadership modeling rather than isolated one-time events.
Question 5: During a post-incident review, the root cause analysis identifies 'normalization of deviance' as a contributing factor. What does this mean?
- The deviation was caused by abnormal market conditions
- Employees had gradually accepted non-compliant practices as normal operating procedure (Correct answer)
- Deviant behavior was detected and reported promptly
- The incident occurred in a foreign regulatory jurisdiction
Correct answer: Employees had gradually accepted non-compliant practices as normal operating procedure
Normalization of deviance occurs when repeated rule violations without negative consequences cause employees to treat non-compliance as acceptable, until a catastrophic event results.
Question 6: How does psychological safety contribute to operational risk culture?
- It ensures employees feel physically secure in the workplace
- It enables employees to speak up about risks and errors without fear of punishment (Correct answer)
- It reduces the need for formal risk controls
- It is a legal requirement under OSHA regulations
Correct answer: It enables employees to speak up about risks and errors without fear of punishment
Psychological safety creates an environment where employees voluntarily disclose risks, near-misses, and errors, which is foundational to an effective risk-aware culture.
Question 7: Which measurement approach is MOST useful for evaluating whether risk culture change initiatives have led to behavioral change?
- Annual employee satisfaction surveys
- Longitudinal tracking of behavioral KRIs before and after the initiative (Correct answer)
- Number of risk policies updated post-initiative
- Reduction in the risk management department headcount
Correct answer: Longitudinal tracking of behavioral KRIs before and after the initiative
Longitudinal KRI tracking captures actual behavioral shifts over time, providing evidence of whether cultural interventions have changed how employees act, not just what they say.
CORES Risk Culture & Awareness Training 5
What role does internal audit play in assessing risk culture under a three-lines-of-defense model?