To reinforce organization-wide ethical norms and risk recognition, which of the following is MOST important...

Effective AI user training must go beyond policy acknowledgment and compliance instruction to equip employees with the practical skills needed to identify ethical risks and report them appropriately. This builds an active risk-aware workforce.

Why B is Correct: The ISACA AAIR framework identifies that training on ethical risk indicators and reporting mechanisms directly reinforces ethical norms by enabling employees to recognize real-world signs of AI misuse, bias, or harmful outputs. When staff can identify specific risk signals and know how to escalate them, the organization builds a proactive risk culture grounded in practical ethical literacy.

Why A is Wrong: Acceptable use policy acknowledgment is a compliance activity, not a culture-building measure. Acknowledging a document does not ensure employees understand how to apply ethical principles in practice.

Why C is Wrong: Cyber threat identification addresses security risk, which is narrower than the full scope of ethical AI risk. Security training does not develop ethical judgment regarding fairness, bias, or societal impact.

Why D is Wrong: Regulatory compliance checklists address legal obligations but do not develop the ethical reasoning and risk recognition skills needed to reinforce organizational norms.