CORES Risk Culture & Awareness Training 5

Question 1

What role does internal audit play in assessing risk culture under a three-lines-of-defense model?

Accepted Answer

Provides independent, objective assurance on the effectiveness of risk culture

Answer

As the third line, internal audit independently evaluates whether risk culture programs are effectively embedded and whether cultural norms align with stated values.

Question 2

A newly appointed Chief Risk Officer wants to shift the firm from a 'silo' risk culture to an 'integrated' risk culture. The FIRST step should be:

Accepted Answer

Conducting a risk culture diagnostic to understand current norms and gaps

Answer

A diagnostic assessment establishes the baseline state of cultural norms and identifies specific gaps before any change initiative can be designed.

Question 3

Which of the following best illustrates 'ethical fade' as a risk to operational risk culture?

Accepted Answer

Employees gradually normalize small rule violations until large breaches occur

Answer

Ethical fade describes the incremental normalization of minor misconduct that desensitizes employees, eventually enabling major breaches of conduct or control.

Question 4

Which element should be explicitly included in a risk culture framework to sustain long-term cultural change?

Accepted Answer

Ongoing reinforcement mechanisms such as recognition programs and refresher training

Answer

Sustained cultural change requires continuous reinforcement through recognition, refresher learning, and leadership modeling rather than isolated one-time events.

Question 5

During a post-incident review, the root cause analysis identifies 'normalization of deviance' as a contributing factor. What does this mean?

Accepted Answer

Employees had gradually accepted non-compliant practices as normal operating procedure

Answer

Normalization of deviance occurs when repeated rule violations without negative consequences cause employees to treat non-compliance as acceptable, until a catastrophic event results.

(CORES) Certified Operational Risk Executive Specialist Practice Test

(CORES) Certified Operational Risk Executive Specialist Practice Test

CORES Risk Culture & Awareness Training 5