Incentives and Risk-Taking Behavior
5 minutes
5 Questions
In Risk Management Governance, incentives are the formal and informal rewards that shape how people inside an organization behave, and they are among the most powerful drivers of risk-taking. For a Certification in Risk Management Assurance (CRMA) professional, understanding this link is essential because governance failures are frequently traced not to missing policies but to compensation and performance systems that quietly encouraged excessive, hidden, or misaligned risk. Incentives influence risk-taking in several ways. First, performance metrics focused on short-term revenue, sales volume, or profit can push managers to accept risks whose costs appear only later—classic examples include the 2008 financial crisis, where bonuses tied to loan origination rewarded volume over credit quality, and the Wells Fargo scandal, where aggressive sales targets led to fake accounts. Second, asymmetric payoffs—large upside for success and limited personal downside for failure—create moral hazard. Third, incentives extend beyond pay: promotion criteria, recognition, tolerance of rule-bending by top performers, and pressure to 'hit the number' all signal what the organization truly values, forming the risk culture. Good governance therefore aligns incentives with risk appetite. Boards and remuneration committees should ensure compensation includes risk-adjusted performance measures, deferral periods, clawback and malus provisions, and balanced scorecards that weigh compliance, control effectiveness, and ethical conduct alongside financial results. Risk and control functions should be compensated independently of the business lines they oversee. From an assurance perspective, internal auditors evaluate whether incentive design is consistent with the stated risk appetite, whether metrics could induce manipulation or gaming, whether the board receives reporting on behavioral indicators (whistleblower trends, policy breaches, near misses), and whether consequences are applied consistently regardless of seniority. Assessing incentives is thus a core element of auditing risk culture and the tone at the top, linking the 'soft' dimension of behavior to the hard architecture of governance and control.
Incentives and Risk-Taking Behavior: A Complete CRMA Study Guide
Why This Topic Matters
Incentives and risk-taking behavior sit at the heart of risk management governance because how people are rewarded determines how they behave. Nearly every major corporate failure of the past three decades, from Enron and WorldCom to the 2008 financial crisis and the Wells Fargo account-opening scandal, traces back in part to compensation and performance systems that rewarded short-term results, volume, or revenue without regard to the risks being created. For the CRMA candidate, this topic is important for three reasons:
1. It links culture to control. The IIA's Three Lines Model and the COSO ERM framework both emphasize that governance and culture are the foundation of risk management. Incentives are the most tangible expression of culture: they tell employees what the organization actually values, regardless of what the mission statement says.
2. It is a frequent root cause. When internal auditors investigate control breakdowns, misstatements, or compliance violations, misaligned incentives are consistently identified as a driver. Understanding this helps the risk assurance professional move from symptom to cause.
3. It is a board-level responsibility. Boards and compensation committees own executive remuneration design. Internal audit and risk functions are expected to provide assurance that incentive structures are consistent with risk appetite. Exam questions test whether you understand who is accountable and what good practice looks like.
What It Is: Core Definitions
Incentives are the rewards, penalties, and consequences, both financial and non-financial, that influence the decisions and actions of individuals within an organization. They include base salary, bonuses, commissions, stock options, promotions, recognition, job security, and even informal social approval from peers and managers.
Risk-taking behavior refers to the willingness of individuals or groups to accept uncertainty in pursuit of a reward. It can be appropriate (taking calculated risks within the approved risk appetite to create value) or inappropriate (excessive, reckless, or concealed risk-taking that exposes the organization to losses beyond its tolerance).
Risk appetite is the amount and type of risk an organization is willing to accept in pursuit of its objectives. Incentives should encourage behavior that stays within this appetite. Risk tolerance is the acceptable level of variation around specific objectives.
Moral hazard occurs when a party is insulated from the consequences of risk and therefore takes more risk than it otherwise would. For example, a trader who receives a large bonus for gains but faces no personal loss for losses has an asymmetric payoff that encourages excessive risk.
Agency problem (principal-agent problem) arises when the interests of agents (managers, employees) diverge from those of principals (shareholders, the organization). Incentive design is the primary tool for aligning these interests.
Perverse incentives are rewards that unintentionally encourage undesirable behavior. A classic example is paying call center staff by calls completed, which encourages them to hang up on customers quickly.
How It Works: The Mechanics of Incentive-Driven Risk
1. The behavioral chain. Incentives shape perceptions of what is valued, perceptions shape priorities, priorities shape decisions, and decisions create or mitigate risk. If a sales manager is paid purely on revenue booked, they will prioritize closing deals over credit quality, contract terms, or compliance screening. The risk does not appear immediately; it materializes later as bad debt, litigation, or regulatory penalties, often after the bonus has been paid.
2. Asymmetry of payoffs. Risk-taking becomes excessive when rewards for success are large and immediate while penalties for failure are small, delayed, or borne by others. Uncapped bonuses, annual payout cycles, and no clawback provisions all amplify this asymmetry.
3. Metric distortion (Goodhart's Law). When a measure becomes a target, it ceases to be a good measure. Employees optimize the metric, not the underlying objective. Cross-selling targets at Wells Fargo led to millions of fake accounts because the number of accounts was rewarded, not customer value.
4. Time horizon mismatch. Many risks, such as credit, reputational, operational, and strategic, take years to crystallize. If performance is measured and rewarded annually, employees are incentivized to front-load gains and back-load losses. Deferral and vesting periods are designed to counter this.
5. Tone and group dynamics. Incentives operate within a culture. If senior leaders celebrate aggressive performers and tolerate rule-bending, the informal incentive (social approval, career advancement) can be stronger than any written policy. Conversely, a strong risk culture can moderate the effects of imperfect compensation design.
6. Non-financial incentives. Fear of job loss, pressure to meet forecasts given to analysts, desire for promotion, and reluctance to deliver bad news all drive behavior. Risk professionals must consider the full incentive landscape, not just the compensation plan.
Good Practice in Incentive Design (What the Exam Expects You to Know)
Alignment with risk appetite and strategy. Performance measures should reflect both what was achieved and how it was achieved, including risk-adjusted returns, compliance outcomes, and control effectiveness.
Balanced scorecards. Combine financial metrics with risk, compliance, customer, and people measures so that no single metric dominates.
Risk-adjusted performance measures. Return on risk-adjusted capital (RORAC), risk-adjusted return on capital (RAROC), and economic profit measures charge business units for the capital their risks consume.
Deferral and vesting. Paying a portion of variable compensation over several years allows losses to emerge before the full reward is received.
Malus and clawback provisions. Malus allows unvested awards to be reduced; clawback allows paid awards to be recovered when misconduct, misstatement, or excessive risk-taking is later discovered.
Caps and gates. Caps limit the upside to reduce reckless behavior; gates require minimum thresholds (for example, no material compliance breaches) before any bonus is paid.
Risk function input. Chief Risk Officers and compliance leaders should have formal input into compensation design and into individual performance ratings for high-risk roles.
Independence of control functions. Compensation of risk, compliance, and internal audit staff should not depend on the financial results of the business units they oversee.
Board oversight. The compensation or remuneration committee should review incentive plans for risk implications, often jointly with the risk committee, and should receive independent assurance.
Frameworks and Standards Connection
COSO ERM (2017), Governance and Culture component: Principle 5, Attracts, Develops, and Retains Capable Individuals, and the broader emphasis on culture and accountability explicitly address how incentives shape risk behavior.
COSO Internal Control, Control Environment: Principle 5 states the organization holds individuals accountable for their internal control responsibilities and specifically calls for considering excessive pressures and aligning incentives and rewards.
IIA Three Lines Model: Management (first line) owns incentive design; risk and compliance (second line) advise and monitor; internal audit (third line) provides independent assurance that incentives are aligned with risk appetite and that the process is effective.
Financial Stability Board Principles for Sound Compensation Practices: Widely referenced international guidance calling for compensation to be adjusted for all types of risk, symmetric with risk outcomes, and sensitive to the time horizon of risks.
Internal Audit's Role
Internal audit may be asked to assess whether:
- Incentive plans have been reviewed for risk implications before approval
- Performance metrics reward behavior consistent with risk appetite
- Deferral, malus, and clawback mechanisms exist and have been applied when warranted
- Risk and compliance functions have genuine input into ratings and payouts
- Control function compensation is independent of business results
- There is evidence of metric gaming, such as unusual period-end spikes, concentration of results just above thresholds, or elevated error and complaint rates in high-incentive areas
- Whistleblower and speak-up data correlate with high-pressure incentive environments
How to Answer Exam Questions on This Topic
Step 1: Identify the misalignment. Most scenario questions describe an incentive plan and ask what risk it creates or how it should be improved. Ask yourself: what behavior does this reward, and what behavior does it ignore or punish? If a plan rewards volume, look for quality and compliance risk. If it rewards short-term profit, look for long-tail risk and earnings manipulation.
Step 2: Determine the time horizon. If the scenario involves annual bonuses on activities whose risks emerge later, the correct answer usually involves deferral, vesting, or risk-adjusted measures.
Step 3: Consider who should act. Questions about responsibility test the Three Lines Model. Designing incentives is management's job. Approving executive compensation is the board's job. Providing assurance is internal audit's job. Internal audit should not design the compensation plan.
Step 4: Favor balanced, risk-adjusted solutions. Answer choices that eliminate all variable pay or remove all performance pressure are usually wrong; organizations need to take risk to create value. The best answer typically balances reward with accountability through mechanisms like scorecards, gates, clawbacks, and control function input.
Step 5: Watch for independence issues. Any option that ties the compensation of risk, compliance, or audit staff to the financial results of the areas they oversee is a red flag.
Exam Tips: Answering Questions on Incentives and Risk-Taking Behavior
Tip 1: Remember that incentives are a root cause, not a symptom. When a question asks why a control failed or why employees engaged in misconduct, consider whether an answer pointing to incentive misalignment is more fundamental than one pointing to a procedural gap.
Tip 2: Connect to culture. The CRMA exam treats incentives as part of governance and risk culture. If a question mentions tone at the top, accountability, or ethical climate, incentive design is likely relevant to the best answer.
Tip 3: Know the vocabulary precisely. Be able to distinguish malus (reducing unvested awards) from clawback (recovering paid awards), risk appetite from risk tolerance, and moral hazard from the agency problem. Questions often test these distinctions directly.
Tip 4: Single-metric plans are almost always the problem. If a scenario describes compensation tied to one measure such as revenue, loans originated, units produced, or cost reduction, expect the correct answer to involve adding balancing or risk-based measures.
Tip 5: Uncapped upside plus no downside equals excessive risk. Recognize asymmetric payoff structures immediately. The remedy is symmetry: deferral, caps, gates, and clawbacks.
Tip 6: Do not over-correct. Eliminating performance incentives entirely is rarely the best answer. The exam rewards proportionate, balanced responses.
Tip 7: Keep roles straight. Internal audit assesses and advises; it does not set pay. The board or its remuneration committee approves executive compensation. The CRO or second-line risk function should have input into design and into evaluations of high-risk roles.
Tip 8: Look for analytical red flags in audit scenarios. Results clustering just above bonus thresholds, period-end spikes, high turnover in sales roles, rising customer complaints, and reversals in subsequent periods are indicators that incentives may be distorting behavior.
Tip 9: Think long-term. When in doubt between an answer that addresses the current period and one that addresses the multi-year horizon over which risk materializes, choose the longer horizon.
Tip 10: Apply the frameworks. Reference COSO's Control Environment and Governance and Culture components mentally; if an answer aligns with the principle of holding individuals accountable while considering pressures and incentives, it is likely correct.
Quick Review Summary
- Incentives drive behavior; behavior drives risk.
- Misaligned incentives are a leading root cause of control failures and misconduct.
- Key risks: short-termism, metric gaming, moral hazard, asymmetric payoffs, erosion of control function independence.
- Key remedies: balanced scorecards, risk-adjusted metrics, deferral and vesting, malus and clawback, caps and gates, risk function input, board oversight.
- Roles: management designs, board approves and oversees, second line advises and monitors, internal audit provides assurance.
- Exam strategy: identify the misalignment, consider the time horizon, assign the right role, prefer balanced risk-adjusted solutions, and protect independence.
Incentives and risk-taking behavior sit at the heart of risk management governance because how people are rewarded determines how they behave. Nearly every major corporate failure of the past three decades, from Enron and WorldCom to the 2008 financial crisis and the Wells Fargo account-opening scandal, traces back in part to compensation and performance systems that rewarded short-term results, volume, or revenue without regard to the risks being created. For the CRMA candidate, this topic is important for three reasons:
1. It links culture to control. The IIA's Three Lines Model and the COSO ERM framework both emphasize that governance and culture are the foundation of risk management. Incentives are the most tangible expression of culture: they tell employees what the organization actually values, regardless of what the mission statement says.
2. It is a frequent root cause. When internal auditors investigate control breakdowns, misstatements, or compliance violations, misaligned incentives are consistently identified as a driver. Understanding this helps the risk assurance professional move from symptom to cause.
3. It is a board-level responsibility. Boards and compensation committees own executive remuneration design. Internal audit and risk functions are expected to provide assurance that incentive structures are consistent with risk appetite. Exam questions test whether you understand who is accountable and what good practice looks like.
What It Is: Core Definitions
Incentives are the rewards, penalties, and consequences, both financial and non-financial, that influence the decisions and actions of individuals within an organization. They include base salary, bonuses, commissions, stock options, promotions, recognition, job security, and even informal social approval from peers and managers.
Risk-taking behavior refers to the willingness of individuals or groups to accept uncertainty in pursuit of a reward. It can be appropriate (taking calculated risks within the approved risk appetite to create value) or inappropriate (excessive, reckless, or concealed risk-taking that exposes the organization to losses beyond its tolerance).
Risk appetite is the amount and type of risk an organization is willing to accept in pursuit of its objectives. Incentives should encourage behavior that stays within this appetite. Risk tolerance is the acceptable level of variation around specific objectives.
Moral hazard occurs when a party is insulated from the consequences of risk and therefore takes more risk than it otherwise would. For example, a trader who receives a large bonus for gains but faces no personal loss for losses has an asymmetric payoff that encourages excessive risk.
Agency problem (principal-agent problem) arises when the interests of agents (managers, employees) diverge from those of principals (shareholders, the organization). Incentive design is the primary tool for aligning these interests.
Perverse incentives are rewards that unintentionally encourage undesirable behavior. A classic example is paying call center staff by calls completed, which encourages them to hang up on customers quickly.
How It Works: The Mechanics of Incentive-Driven Risk
1. The behavioral chain. Incentives shape perceptions of what is valued, perceptions shape priorities, priorities shape decisions, and decisions create or mitigate risk. If a sales manager is paid purely on revenue booked, they will prioritize closing deals over credit quality, contract terms, or compliance screening. The risk does not appear immediately; it materializes later as bad debt, litigation, or regulatory penalties, often after the bonus has been paid.
2. Asymmetry of payoffs. Risk-taking becomes excessive when rewards for success are large and immediate while penalties for failure are small, delayed, or borne by others. Uncapped bonuses, annual payout cycles, and no clawback provisions all amplify this asymmetry.
3. Metric distortion (Goodhart's Law). When a measure becomes a target, it ceases to be a good measure. Employees optimize the metric, not the underlying objective. Cross-selling targets at Wells Fargo led to millions of fake accounts because the number of accounts was rewarded, not customer value.
4. Time horizon mismatch. Many risks, such as credit, reputational, operational, and strategic, take years to crystallize. If performance is measured and rewarded annually, employees are incentivized to front-load gains and back-load losses. Deferral and vesting periods are designed to counter this.
5. Tone and group dynamics. Incentives operate within a culture. If senior leaders celebrate aggressive performers and tolerate rule-bending, the informal incentive (social approval, career advancement) can be stronger than any written policy. Conversely, a strong risk culture can moderate the effects of imperfect compensation design.
6. Non-financial incentives. Fear of job loss, pressure to meet forecasts given to analysts, desire for promotion, and reluctance to deliver bad news all drive behavior. Risk professionals must consider the full incentive landscape, not just the compensation plan.
Good Practice in Incentive Design (What the Exam Expects You to Know)
Alignment with risk appetite and strategy. Performance measures should reflect both what was achieved and how it was achieved, including risk-adjusted returns, compliance outcomes, and control effectiveness.
Balanced scorecards. Combine financial metrics with risk, compliance, customer, and people measures so that no single metric dominates.
Risk-adjusted performance measures. Return on risk-adjusted capital (RORAC), risk-adjusted return on capital (RAROC), and economic profit measures charge business units for the capital their risks consume.
Deferral and vesting. Paying a portion of variable compensation over several years allows losses to emerge before the full reward is received.
Malus and clawback provisions. Malus allows unvested awards to be reduced; clawback allows paid awards to be recovered when misconduct, misstatement, or excessive risk-taking is later discovered.
Caps and gates. Caps limit the upside to reduce reckless behavior; gates require minimum thresholds (for example, no material compliance breaches) before any bonus is paid.
Risk function input. Chief Risk Officers and compliance leaders should have formal input into compensation design and into individual performance ratings for high-risk roles.
Independence of control functions. Compensation of risk, compliance, and internal audit staff should not depend on the financial results of the business units they oversee.
Board oversight. The compensation or remuneration committee should review incentive plans for risk implications, often jointly with the risk committee, and should receive independent assurance.
Frameworks and Standards Connection
COSO ERM (2017), Governance and Culture component: Principle 5, Attracts, Develops, and Retains Capable Individuals, and the broader emphasis on culture and accountability explicitly address how incentives shape risk behavior.
COSO Internal Control, Control Environment: Principle 5 states the organization holds individuals accountable for their internal control responsibilities and specifically calls for considering excessive pressures and aligning incentives and rewards.
IIA Three Lines Model: Management (first line) owns incentive design; risk and compliance (second line) advise and monitor; internal audit (third line) provides independent assurance that incentives are aligned with risk appetite and that the process is effective.
Financial Stability Board Principles for Sound Compensation Practices: Widely referenced international guidance calling for compensation to be adjusted for all types of risk, symmetric with risk outcomes, and sensitive to the time horizon of risks.
Internal Audit's Role
Internal audit may be asked to assess whether:
- Incentive plans have been reviewed for risk implications before approval
- Performance metrics reward behavior consistent with risk appetite
- Deferral, malus, and clawback mechanisms exist and have been applied when warranted
- Risk and compliance functions have genuine input into ratings and payouts
- Control function compensation is independent of business results
- There is evidence of metric gaming, such as unusual period-end spikes, concentration of results just above thresholds, or elevated error and complaint rates in high-incentive areas
- Whistleblower and speak-up data correlate with high-pressure incentive environments
How to Answer Exam Questions on This Topic
Step 1: Identify the misalignment. Most scenario questions describe an incentive plan and ask what risk it creates or how it should be improved. Ask yourself: what behavior does this reward, and what behavior does it ignore or punish? If a plan rewards volume, look for quality and compliance risk. If it rewards short-term profit, look for long-tail risk and earnings manipulation.
Step 2: Determine the time horizon. If the scenario involves annual bonuses on activities whose risks emerge later, the correct answer usually involves deferral, vesting, or risk-adjusted measures.
Step 3: Consider who should act. Questions about responsibility test the Three Lines Model. Designing incentives is management's job. Approving executive compensation is the board's job. Providing assurance is internal audit's job. Internal audit should not design the compensation plan.
Step 4: Favor balanced, risk-adjusted solutions. Answer choices that eliminate all variable pay or remove all performance pressure are usually wrong; organizations need to take risk to create value. The best answer typically balances reward with accountability through mechanisms like scorecards, gates, clawbacks, and control function input.
Step 5: Watch for independence issues. Any option that ties the compensation of risk, compliance, or audit staff to the financial results of the areas they oversee is a red flag.
Exam Tips: Answering Questions on Incentives and Risk-Taking Behavior
Tip 1: Remember that incentives are a root cause, not a symptom. When a question asks why a control failed or why employees engaged in misconduct, consider whether an answer pointing to incentive misalignment is more fundamental than one pointing to a procedural gap.
Tip 2: Connect to culture. The CRMA exam treats incentives as part of governance and risk culture. If a question mentions tone at the top, accountability, or ethical climate, incentive design is likely relevant to the best answer.
Tip 3: Know the vocabulary precisely. Be able to distinguish malus (reducing unvested awards) from clawback (recovering paid awards), risk appetite from risk tolerance, and moral hazard from the agency problem. Questions often test these distinctions directly.
Tip 4: Single-metric plans are almost always the problem. If a scenario describes compensation tied to one measure such as revenue, loans originated, units produced, or cost reduction, expect the correct answer to involve adding balancing or risk-based measures.
Tip 5: Uncapped upside plus no downside equals excessive risk. Recognize asymmetric payoff structures immediately. The remedy is symmetry: deferral, caps, gates, and clawbacks.
Tip 6: Do not over-correct. Eliminating performance incentives entirely is rarely the best answer. The exam rewards proportionate, balanced responses.
Tip 7: Keep roles straight. Internal audit assesses and advises; it does not set pay. The board or its remuneration committee approves executive compensation. The CRO or second-line risk function should have input into design and into evaluations of high-risk roles.
Tip 8: Look for analytical red flags in audit scenarios. Results clustering just above bonus thresholds, period-end spikes, high turnover in sales roles, rising customer complaints, and reversals in subsequent periods are indicators that incentives may be distorting behavior.
Tip 9: Think long-term. When in doubt between an answer that addresses the current period and one that addresses the multi-year horizon over which risk materializes, choose the longer horizon.
Tip 10: Apply the frameworks. Reference COSO's Control Environment and Governance and Culture components mentally; if an answer aligns with the principle of holding individuals accountable while considering pressures and incentives, it is likely correct.
Quick Review Summary
- Incentives drive behavior; behavior drives risk.
- Misaligned incentives are a leading root cause of control failures and misconduct.
- Key risks: short-termism, metric gaming, moral hazard, asymmetric payoffs, erosion of control function independence.
- Key remedies: balanced scorecards, risk-adjusted metrics, deferral and vesting, malus and clawback, caps and gates, risk function input, board oversight.
- Roles: management designs, board approves and oversees, second line advises and monitors, internal audit provides assurance.
- Exam strategy: identify the misalignment, consider the time horizon, assign the right role, prefer balanced risk-adjusted solutions, and protect independence.
Test mode:
CRMA - Incentives and Risk-Taking Behavior Example Questions
Test your knowledge of Incentives and Risk-Taking Behavior
Question 1
An internal auditor reviews a commercial lending unit. Loan officers' bonuses were recently tied to quarterly loan volume. Since that change, approved loan amounts cluster just below the limit that triggers credit committee review. Policy overrides also spike in the final week of each quarter. Portfolio losses and limit utilization remain within appetite. Which interpretation of these findings is MOST appropriate?
Question 2
After a risk culture review, management added a risk modifier to a trading desk's bonus plan that reduces bonuses for limit breaches. An internal auditor finds that breaches are recorded only when desk heads self-report them and that no bonus reduction has ever been applied. Since the change, recorded breaches have fallen while positions held just under their limits have risen sharply. Which conclusion is BEST supported by these findings?
Question 3
During a risk culture assessment, an internal auditor finds that relationship managers' bonuses are calculated solely on new loan volume. Breaches of credit risk limits have risen over the past year. The board-approved risk appetite statement is well documented and was recently communicated to all staff. Which recommendation would BEST address the underlying cause of the breaches?
Unlock Premium Access
Certification in Risk Management Assurance
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 3053 Superior-grade Certification in Risk Management Assurance practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CRMA: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Incentives and Risk-Taking Behavior questions
20 questions (total)
Other Risk Management Governance concepts
Assessing Risk CultureBoard Risk Oversight and CommitteesChief Risk Officer and Risk Function RolesComparing COSO ERM and ISO 31000Corporate Governance Structures and RolesCOSO ERM Components and PrinciplesCOSO Internal Control FrameworkElements of Risk GovernanceEmbedding Risk Management in OperationsEvaluating Governance Structure EffectivenessEvaluating the Quality of Risk ReportsGovernance Frameworks and PrinciplesHorizon Scanning and Scenario AnalysisIdentifying Emerging RisksImpact of Culture on the Control EnvironmentIntegrated Risk Reporting to StakeholdersIntegrating Risk into Strategy SettingISO 31000 Principles, Framework, and ProcessIT Governance and Control FrameworksKey Risk Indicators and Performance IndicatorsLinking Risk to Objectives and PerformanceManagement Commitment to Risk ManagementPortfolio View of RiskResilience and Business ContinuityResponding to Change and Strategic RiskRisk Appetite StatementsRisk Capacity, Appetite, and ToleranceRisk Culture and Its IndicatorsRisk Reporting to the BoardSelecting a Framework That Fits the OrganizationSoft Controls and Ethical ClimateTone at the Top