A risk-aware culture is a culture that recognizes, understands, and values the importance of risk management in achieving the organization’s objectives and goals. A risk-aware culture is also a culture that supports and encourages the identification, assessment, response, and monitoring of risks across the organization, as well as the sharing and learning of risk information and best practices. One of the activities that would best contribute to promoting an organization-wide risk-aware culture is communicating components of risk and their acceptable levels. This is a technique to inform and educate the stakeholders and decision makers about the nature and scope of the risks that the organization faces, as well as the criteria and standards that the organization uses to measure and manage the risks. Communicating components of risk and their acceptable levels can help to increase the awareness and understanding of the risks and their impact on the organization’s performance and value, as well as to align the expectations and behaviors of the stakeholders and decision makers with the organization’s risk appetite and tolerance. Communicating components of risk and their acceptable levels can also help to foster a transparent and collaborative environment for risk management, where the stakeholders and decision makers can openly discuss and address the risks and their implications, as well as to provide and receive feedback and support. The other options are not the best activities to promote an organization-wide risk-aware culture, although they may be relevant and useful. Performing a benchmark analysis and evaluating gaps is a technique to compare and improve the organization’s risk management process and performance with the industry standards or best practices, as well as to identify and close the gaps or weaknesses in the organization’s risk management capabilities or maturity. However, this technique does not necessarily promote a risk-aware culture, as it focuses on the process and performance of risk management, not the attitude and behavior of risk management. Conducting risk assessments and implementing controls is a technique to identify and analyze the risks that the organization faces, as well as to select and execute the appropriate actions to address the risks, such as avoiding, transferring, mitigating, or accepting the risks. However, this technique does not directly promote a risk-aware culture, as it focuses on the actions and outcomes of risk management, not the values and beliefs of risk management. Participating in peer reviews and implementing best practices is a technique to evaluate and enhance the quality and effectiveness of the organization’s risk management activities anddeliverables, as well as to adopt and apply the proven and successful methods or solutions for risk management. However, this technique does not effectively promote a risk-aware culture, as it focuses on the improvement and optimization of risk management, not the communication and collaboration of risk management. References = CRISC Review Manual, pages 22-231; CRISC Review Questions, Answers & Explanations Manual, page 982; The 6 keyelements to creating and maintaining a good risk culture3; How to increase risk awareness - Project Management Institute4
