Risk Reporting to the Board
5 minutes
5 Questions
Risk Reporting to the Board is a cornerstone of Risk Management Governance and a key competency area within the Certification in Risk Management Assurance (CRMA). It refers to the structured process by which management and internal audit communicate information about the organization's risk profile, risk appetite alignment, control effectiveness, and emerging threats to the board of directors or its designated committee (often the audit or risk committee). The board holds ultimate responsibility for risk oversight, so timely, accurate, and decision-useful reporting is essential for them to discharge their fiduciary duties. Effective board risk reporting typically includes several elements: a summary of the organization's key or 'top' risks mapped against stated risk appetite and tolerance levels; key risk indicators (KRIs) and trends that signal changes in exposure; the status of mitigation actions and residual risk; significant control weaknesses or incidents; emerging and strategic risks such as cyber, regulatory, or reputational threats; and assurance opinions on the overall maturity of the risk management framework. Reports should be concise, visual where possible (heat maps, dashboards), and focused on what matters most for strategic decision-making rather than operational detail. From a CRMA perspective, internal audit plays a critical assurance role. It independently evaluates whether management's risk reporting is complete, reliable, and consistent with frameworks such as COSO ERM or ISO 31000, and whether the governance structures (three lines model) support honest escalation of bad news. Internal audit may also provide its own independent view to the board on the effectiveness of risk management processes. Good practice emphasizes consistency in format and frequency, clear ownership of risks, linkage between risk and strategic objectives, and a culture that encourages transparency. Ultimately, risk reporting to the board enables informed challenge, supports accountability, and strengthens the organization's resilience and governance.
Risk Reporting to the Board: A Complete CRMA Study Guide
1. Why Risk Reporting to the Board Matters
The board of directors (or its equivalent governing body) holds ultimate accountability for the organization's governance, including oversight of risk management. However, the board does not manage risk day to day; management does. The board therefore depends on timely, accurate, relevant, and understandable risk information to discharge its oversight duty. Without effective risk reporting, the board cannot:
- Confirm that the organization is operating within its approved risk appetite and tolerances.
- Challenge management's assumptions about strategy, emerging threats, and opportunities.
- Understand whether controls and risk responses are working as intended.
- Meet legal, regulatory, and stakeholder expectations for accountability and transparency.
For the CRMA exam, this topic sits inside the Risk Management Governance domain. The IIA expects candidates to understand how internal audit supports, evaluates, and sometimes contributes to risk reporting that flows to the board, and to recognize what distinguishes high-quality board risk reporting from poor practice. Many exam questions test whether you can separate the roles of the board, management, the risk function, and internal audit in the reporting process.
2. What Is Risk Reporting to the Board?
Risk reporting to the board is the structured communication of information about the organization's risk profile, risk management performance, and risk governance to the board or its delegated committee (often the audit committee or a dedicated risk committee). It is a core element of the Information, Communication, and Reporting component of COSO ERM (2017) and aligns with ISO 31000's principle that risk management should be integrated, structured, and based on the best available information.
Key features of board-level risk reporting:
Audience-appropriate: The board needs strategic, aggregated, decision-useful information, not operational detail.
Linked to objectives and appetite: Risks are reported in relation to strategic objectives and the board-approved risk appetite statement.
Forward-looking as well as historical: Good reports cover emerging risks, trends, and scenarios, not only incidents that have already occurred.
Balanced: Reports cover both downside threats and upside opportunities, and both the inherent and residual view of risk.
Actionable: Reports highlight where board decisions, escalations, or resource reallocations are needed.
Typical content of a board risk report includes:
- A summary risk profile or heat map of the principal (top) risks.
- Key risk indicators (KRIs) with trend data and tolerance thresholds.
- Status of risk appetite compliance, including breaches or near-breaches of limits.
- Emerging and strategic risks, including external environment changes.
- Significant risk events, losses, near misses, and lessons learned.
- Progress on risk treatment and remediation plans.
- Assurance information: results from the three lines (management monitoring, risk and compliance functions, internal audit) and external assurance providers.
- The overall maturity and effectiveness of the risk management framework.
3. How Risk Reporting to the Board Works
3.1 Roles and responsibilities (the Three Lines Model)
Understanding who does what is essential and heavily tested.
Governing body (board): Sets the tone, approves risk appetite, determines what information it needs and how often, and uses the reports to oversee and challenge management. The board is the recipient and user of risk reports; it is ultimately accountable for governance.
Management (first line): Owns and manages risks, operates controls, and generates the underlying risk data. Senior management is responsible for preparing and presenting the risk report to the board, often through the Chief Risk Officer (CRO) or CEO.
Risk management and compliance functions (second line): Design the ERM framework, consolidate and aggregate risk information, maintain the risk register, calculate KRIs, and often draft the enterprise risk report. They provide expertise and monitoring but remain part of management.
Internal audit (third line): Provides independent assurance to the board on the effectiveness of governance, risk management, and control, including assurance on the reliability of the risk reporting process itself. Internal audit reports functionally to the board (usually via the audit committee) so that its own communications are not filtered by management. The Chief Audit Executive (CAE) must communicate to the board about significant risk exposures, control issues, and the overall opinion on risk management per the IIA Standards (Global Internal Audit Standards, Domain III and Standard 11 series on communication; formerly Standards 2060 and 2600).
3.2 The reporting process
1. Identification and assessment occur at business-unit and process levels, with results captured in risk registers.
2. Aggregation consolidates risks across units, eliminating duplication and identifying concentrations and interdependencies.
3. Prioritization filters the portfolio down to the principal risks that merit board attention, using likelihood, impact, velocity, and proximity to appetite limits.
4. Analysis and context add trend information, KRIs, root causes, and comparisons to tolerance thresholds.
5. Presentation uses dashboards, heat maps, narrative summaries, and exception reporting designed for board consumption.
6. Discussion and challenge at board or committee meetings, with minutes documenting questions raised and decisions made.
7. Feedback and follow-up ensure that board decisions flow back to management and that actions are tracked to completion.
3.3 Frequency and escalation
Routine reporting is usually quarterly, aligned with board meeting cycles, with an annual comprehensive review of the risk framework and appetite statement. Separately, an escalation protocol must exist so that significant events, appetite breaches, or crises are reported immediately rather than waiting for the next scheduled meeting. Exam questions often probe whether a candidate recognizes that periodic reporting alone is insufficient without an ad hoc escalation mechanism.
3.4 Qualities of effective board risk reporting
- Relevant: Tied to strategy and objectives; addresses what the board actually needs to decide.
- Concise and prioritized: Avoids information overload; uses exception-based reporting.
- Timely: Delivered when it can still influence decisions.
- Accurate and reliable: Based on validated data with clear sources and assumptions.
- Consistent: Uses common risk language, rating scales, and formats period to period so trends are visible.
- Transparent and candid: Does not soften bad news; disclosures of failures and near misses are encouraged.
- Forward-looking: Includes emerging risks, scenario analysis, and stress testing.
- Integrated: Connects risk, performance, and strategy rather than treating risk as a stand-alone compliance list.
3.5 Common weaknesses
- Reports that are too granular or technical, burying the key message.
- Static heat maps with no trend or velocity information.
- Absence of a link to risk appetite, so the board cannot tell whether exposures are acceptable.
- Management filtering or optimistic bias, with internal audit findings diluted before reaching the board.
- Reporting only historical losses while ignoring emerging risks.
- No evidence that the board actually discusses or acts on the reports.
- Lack of independent validation of the data in the risk report.
3.6 Internal audit's role in evaluating board risk reporting
Under the CRMA body of knowledge, internal audit may:
- Assess whether the board has clearly defined its risk information needs.
- Evaluate the completeness, accuracy, and timeliness of the risk reports produced by management.
- Test the aggregation process and the integrity of KRIs and risk register data.
- Review whether appetite breaches were escalated properly.
- Assess the board's own engagement: Are reports discussed? Are decisions minuted and followed up?
- Provide its own independent communication on the state of risk management, including an annual opinion where appropriate.
Internal audit must preserve independence: it should not own risk reporting or make risk-acceptance decisions. Consulting support (for example, helping design a dashboard) is permissible with safeguards, but ownership remains with management.
4. Key Frameworks and References
- COSO ERM 2017: Component 5, Information, Communication, and Reporting, principles 18 to 20 (leverage information systems, communicate risk information, report on risk, culture, and performance).
- ISO 31000:2018: Recording and reporting as part of the process, emphasizing that reporting supports governance decisions and dialogue with stakeholders.
- IIA Three Lines Model (2020): Clarifies governing body accountability and the independent reporting line of internal audit.
- Global Internal Audit Standards / IPPF: Requirements for the CAE to communicate significant risk and control matters to the board and to report on the effectiveness of risk management.
5. Exam Tips: Answering Questions on Risk Reporting to the Board
Tip 1: Always identify the role first. When a question describes an action such as preparing the enterprise risk report, approving risk appetite, or providing assurance on the report's reliability, decide which party is responsible. Management (including the risk function) prepares; the board approves and oversees; internal audit independently assures. The wrong answer options frequently assign a management duty to internal audit or a board duty to management.
Tip 2: Think like a board member. If a question asks what information is most appropriate for the board, choose the option that is strategic, aggregated, linked to objectives and appetite, and decision-useful. Reject options that describe detailed operational control testing, individual transaction exceptions, or process-level checklists; those belong in management reports.
Tip 3: Look for the risk appetite link. The best answer about effective reporting almost always references comparing exposures to the board-approved appetite or tolerance. A report that lists risks without indicating whether they are within acceptable limits is incomplete.
Tip 4: Prefer forward-looking and trend-based content. When choosing between a report showing only last quarter's incidents and one that includes KRIs, trends, emerging risks, and scenario analysis, the latter is the stronger answer.
Tip 5: Distinguish periodic reporting from escalation. If a scenario describes a major risk event discovered between board meetings, the correct response involves immediate escalation under a defined protocol, not deferral to the next quarterly report.
Tip 6: Protect internal audit independence. If an answer option has internal audit owning the risk register, setting appetite, deciding risk responses, or allowing management to edit audit conclusions before they reach the board, it is wrong. The CAE's functional reporting line to the board exists precisely to prevent filtering.
Tip 7: Watch for the words most, best, primary, and least. Several options may be partially correct. Select the one that most directly supports board oversight. For example, the primary purpose of board risk reporting is to enable informed oversight and decision-making, not to satisfy regulators, even though compliance is a valid secondary benefit.
Tip 8: Recognize red flags in scenarios. Static heat maps, no discussion recorded in minutes, reports exceeding dozens of pages with no executive summary, inconsistent rating scales across units, and overly positive tone are all indicators the exam uses to signal weak reporting. The correct answer will typically recommend prioritization, consistency, candor, or independent validation.
Tip 9: Map to frameworks when asked. If a question cites COSO ERM, recall that reporting falls under Information, Communication, and Reporting and should cover risk, culture, and performance. If it cites the Three Lines Model, recall that the governing body is accountable to stakeholders and that internal audit reports to it independently.
Tip 10: Remember what internal audit assesses. When asked how internal audit evaluates board risk reporting, the complete answer includes the reliability of the data, the adequacy of the aggregation process, the alignment with board information needs, the escalation of appetite breaches, and evidence that the board actually uses the reports.
6. Quick Review Checklist
- Board is accountable for oversight; management is responsible for managing and reporting risk; internal audit provides independent assurance.
- Effective reports are relevant, concise, timely, accurate, consistent, candid, forward-looking, and linked to risk appetite.
- Content: top risks, KRIs and trends, appetite status, emerging risks, incidents and lessons learned, treatment progress, assurance summary, framework effectiveness.
- Periodic reporting (usually quarterly) must be complemented by immediate escalation of significant events.
- Internal audit evaluates the reporting process and communicates its own independent view directly to the board without management filtering.
- On the exam, choose the answer that best enables informed board oversight and respects the separation of roles.
Mastering this topic means being able to articulate not just what a board risk report contains, but why each element supports governance and who is responsible for producing, validating, and acting on it. Those three dimensions are exactly what CRMA questions on risk reporting to the board are designed to test.
The board of directors (or its equivalent governing body) holds ultimate accountability for the organization's governance, including oversight of risk management. However, the board does not manage risk day to day; management does. The board therefore depends on timely, accurate, relevant, and understandable risk information to discharge its oversight duty. Without effective risk reporting, the board cannot:
- Confirm that the organization is operating within its approved risk appetite and tolerances.
- Challenge management's assumptions about strategy, emerging threats, and opportunities.
- Understand whether controls and risk responses are working as intended.
- Meet legal, regulatory, and stakeholder expectations for accountability and transparency.
For the CRMA exam, this topic sits inside the Risk Management Governance domain. The IIA expects candidates to understand how internal audit supports, evaluates, and sometimes contributes to risk reporting that flows to the board, and to recognize what distinguishes high-quality board risk reporting from poor practice. Many exam questions test whether you can separate the roles of the board, management, the risk function, and internal audit in the reporting process.
2. What Is Risk Reporting to the Board?
Risk reporting to the board is the structured communication of information about the organization's risk profile, risk management performance, and risk governance to the board or its delegated committee (often the audit committee or a dedicated risk committee). It is a core element of the Information, Communication, and Reporting component of COSO ERM (2017) and aligns with ISO 31000's principle that risk management should be integrated, structured, and based on the best available information.
Key features of board-level risk reporting:
Audience-appropriate: The board needs strategic, aggregated, decision-useful information, not operational detail.
Linked to objectives and appetite: Risks are reported in relation to strategic objectives and the board-approved risk appetite statement.
Forward-looking as well as historical: Good reports cover emerging risks, trends, and scenarios, not only incidents that have already occurred.
Balanced: Reports cover both downside threats and upside opportunities, and both the inherent and residual view of risk.
Actionable: Reports highlight where board decisions, escalations, or resource reallocations are needed.
Typical content of a board risk report includes:
- A summary risk profile or heat map of the principal (top) risks.
- Key risk indicators (KRIs) with trend data and tolerance thresholds.
- Status of risk appetite compliance, including breaches or near-breaches of limits.
- Emerging and strategic risks, including external environment changes.
- Significant risk events, losses, near misses, and lessons learned.
- Progress on risk treatment and remediation plans.
- Assurance information: results from the three lines (management monitoring, risk and compliance functions, internal audit) and external assurance providers.
- The overall maturity and effectiveness of the risk management framework.
3. How Risk Reporting to the Board Works
3.1 Roles and responsibilities (the Three Lines Model)
Understanding who does what is essential and heavily tested.
Governing body (board): Sets the tone, approves risk appetite, determines what information it needs and how often, and uses the reports to oversee and challenge management. The board is the recipient and user of risk reports; it is ultimately accountable for governance.
Management (first line): Owns and manages risks, operates controls, and generates the underlying risk data. Senior management is responsible for preparing and presenting the risk report to the board, often through the Chief Risk Officer (CRO) or CEO.
Risk management and compliance functions (second line): Design the ERM framework, consolidate and aggregate risk information, maintain the risk register, calculate KRIs, and often draft the enterprise risk report. They provide expertise and monitoring but remain part of management.
Internal audit (third line): Provides independent assurance to the board on the effectiveness of governance, risk management, and control, including assurance on the reliability of the risk reporting process itself. Internal audit reports functionally to the board (usually via the audit committee) so that its own communications are not filtered by management. The Chief Audit Executive (CAE) must communicate to the board about significant risk exposures, control issues, and the overall opinion on risk management per the IIA Standards (Global Internal Audit Standards, Domain III and Standard 11 series on communication; formerly Standards 2060 and 2600).
3.2 The reporting process
1. Identification and assessment occur at business-unit and process levels, with results captured in risk registers.
2. Aggregation consolidates risks across units, eliminating duplication and identifying concentrations and interdependencies.
3. Prioritization filters the portfolio down to the principal risks that merit board attention, using likelihood, impact, velocity, and proximity to appetite limits.
4. Analysis and context add trend information, KRIs, root causes, and comparisons to tolerance thresholds.
5. Presentation uses dashboards, heat maps, narrative summaries, and exception reporting designed for board consumption.
6. Discussion and challenge at board or committee meetings, with minutes documenting questions raised and decisions made.
7. Feedback and follow-up ensure that board decisions flow back to management and that actions are tracked to completion.
3.3 Frequency and escalation
Routine reporting is usually quarterly, aligned with board meeting cycles, with an annual comprehensive review of the risk framework and appetite statement. Separately, an escalation protocol must exist so that significant events, appetite breaches, or crises are reported immediately rather than waiting for the next scheduled meeting. Exam questions often probe whether a candidate recognizes that periodic reporting alone is insufficient without an ad hoc escalation mechanism.
3.4 Qualities of effective board risk reporting
- Relevant: Tied to strategy and objectives; addresses what the board actually needs to decide.
- Concise and prioritized: Avoids information overload; uses exception-based reporting.
- Timely: Delivered when it can still influence decisions.
- Accurate and reliable: Based on validated data with clear sources and assumptions.
- Consistent: Uses common risk language, rating scales, and formats period to period so trends are visible.
- Transparent and candid: Does not soften bad news; disclosures of failures and near misses are encouraged.
- Forward-looking: Includes emerging risks, scenario analysis, and stress testing.
- Integrated: Connects risk, performance, and strategy rather than treating risk as a stand-alone compliance list.
3.5 Common weaknesses
- Reports that are too granular or technical, burying the key message.
- Static heat maps with no trend or velocity information.
- Absence of a link to risk appetite, so the board cannot tell whether exposures are acceptable.
- Management filtering or optimistic bias, with internal audit findings diluted before reaching the board.
- Reporting only historical losses while ignoring emerging risks.
- No evidence that the board actually discusses or acts on the reports.
- Lack of independent validation of the data in the risk report.
3.6 Internal audit's role in evaluating board risk reporting
Under the CRMA body of knowledge, internal audit may:
- Assess whether the board has clearly defined its risk information needs.
- Evaluate the completeness, accuracy, and timeliness of the risk reports produced by management.
- Test the aggregation process and the integrity of KRIs and risk register data.
- Review whether appetite breaches were escalated properly.
- Assess the board's own engagement: Are reports discussed? Are decisions minuted and followed up?
- Provide its own independent communication on the state of risk management, including an annual opinion where appropriate.
Internal audit must preserve independence: it should not own risk reporting or make risk-acceptance decisions. Consulting support (for example, helping design a dashboard) is permissible with safeguards, but ownership remains with management.
4. Key Frameworks and References
- COSO ERM 2017: Component 5, Information, Communication, and Reporting, principles 18 to 20 (leverage information systems, communicate risk information, report on risk, culture, and performance).
- ISO 31000:2018: Recording and reporting as part of the process, emphasizing that reporting supports governance decisions and dialogue with stakeholders.
- IIA Three Lines Model (2020): Clarifies governing body accountability and the independent reporting line of internal audit.
- Global Internal Audit Standards / IPPF: Requirements for the CAE to communicate significant risk and control matters to the board and to report on the effectiveness of risk management.
5. Exam Tips: Answering Questions on Risk Reporting to the Board
Tip 1: Always identify the role first. When a question describes an action such as preparing the enterprise risk report, approving risk appetite, or providing assurance on the report's reliability, decide which party is responsible. Management (including the risk function) prepares; the board approves and oversees; internal audit independently assures. The wrong answer options frequently assign a management duty to internal audit or a board duty to management.
Tip 2: Think like a board member. If a question asks what information is most appropriate for the board, choose the option that is strategic, aggregated, linked to objectives and appetite, and decision-useful. Reject options that describe detailed operational control testing, individual transaction exceptions, or process-level checklists; those belong in management reports.
Tip 3: Look for the risk appetite link. The best answer about effective reporting almost always references comparing exposures to the board-approved appetite or tolerance. A report that lists risks without indicating whether they are within acceptable limits is incomplete.
Tip 4: Prefer forward-looking and trend-based content. When choosing between a report showing only last quarter's incidents and one that includes KRIs, trends, emerging risks, and scenario analysis, the latter is the stronger answer.
Tip 5: Distinguish periodic reporting from escalation. If a scenario describes a major risk event discovered between board meetings, the correct response involves immediate escalation under a defined protocol, not deferral to the next quarterly report.
Tip 6: Protect internal audit independence. If an answer option has internal audit owning the risk register, setting appetite, deciding risk responses, or allowing management to edit audit conclusions before they reach the board, it is wrong. The CAE's functional reporting line to the board exists precisely to prevent filtering.
Tip 7: Watch for the words most, best, primary, and least. Several options may be partially correct. Select the one that most directly supports board oversight. For example, the primary purpose of board risk reporting is to enable informed oversight and decision-making, not to satisfy regulators, even though compliance is a valid secondary benefit.
Tip 8: Recognize red flags in scenarios. Static heat maps, no discussion recorded in minutes, reports exceeding dozens of pages with no executive summary, inconsistent rating scales across units, and overly positive tone are all indicators the exam uses to signal weak reporting. The correct answer will typically recommend prioritization, consistency, candor, or independent validation.
Tip 9: Map to frameworks when asked. If a question cites COSO ERM, recall that reporting falls under Information, Communication, and Reporting and should cover risk, culture, and performance. If it cites the Three Lines Model, recall that the governing body is accountable to stakeholders and that internal audit reports to it independently.
Tip 10: Remember what internal audit assesses. When asked how internal audit evaluates board risk reporting, the complete answer includes the reliability of the data, the adequacy of the aggregation process, the alignment with board information needs, the escalation of appetite breaches, and evidence that the board actually uses the reports.
6. Quick Review Checklist
- Board is accountable for oversight; management is responsible for managing and reporting risk; internal audit provides independent assurance.
- Effective reports are relevant, concise, timely, accurate, consistent, candid, forward-looking, and linked to risk appetite.
- Content: top risks, KRIs and trends, appetite status, emerging risks, incidents and lessons learned, treatment progress, assurance summary, framework effectiveness.
- Periodic reporting (usually quarterly) must be complemented by immediate escalation of significant events.
- Internal audit evaluates the reporting process and communicates its own independent view directly to the board without management filtering.
- On the exam, choose the answer that best enables informed board oversight and respects the separation of roles.
Mastering this topic means being able to articulate not just what a board risk report contains, but why each element supports governance and who is responsible for producing, validating, and acting on it. Those three dimensions are exactly what CRMA questions on risk reporting to the board are designed to test.
Test mode:
CRMA - Risk Reporting to the Board Example Questions
Test your knowledge of Risk Reporting to the Board
Question 1
The chief risk officer's quarterly board risk report rates cyber risk as within appetite, based on business unit self-assessments. A recent internal audit engagement found that several key access controls failed. It also found that the exposure indicators feeding the report leave out two critical systems. The audit committee meets next week to review the report. What should the chief audit executive do FIRST?
Question 2
An internal auditor reviews the last four quarterly risk reports presented to the board. Each report lists the same ten principal risks with unchanged residual ratings, all shown as within appetite. Over the same period, separate operational performance reports to the board show missed customer service targets and rising loss events in two of those risk areas. Which conclusion is MOST supported by this evidence?
Question 3
The chief risk officer prepares a quarterly risk report for the board. It shows a heat map of the top 20 risks, scored before controls, with trend arrows. The risks are not linked to strategic objectives. The report does not compare exposure to the approved risk appetite and says nothing about whether mitigation plans are working. Several directors tell the chief audit executive the report does not help them decide where to challenge management. The chief audit executive is asked to advise on improving the report's usefulness. Which recommendation is BEST?
Unlock Premium Access
Certification in Risk Management Assurance
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 3053 Superior-grade Certification in Risk Management Assurance practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CRMA: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Risk Reporting to the Board questions
20 questions (total)
Other Risk Management Governance concepts
Assessing Risk CultureBoard Risk Oversight and CommitteesChief Risk Officer and Risk Function RolesComparing COSO ERM and ISO 31000Corporate Governance Structures and RolesCOSO ERM Components and PrinciplesCOSO Internal Control FrameworkElements of Risk GovernanceEmbedding Risk Management in OperationsEvaluating Governance Structure EffectivenessEvaluating the Quality of Risk ReportsGovernance Frameworks and PrinciplesHorizon Scanning and Scenario AnalysisIdentifying Emerging RisksImpact of Culture on the Control EnvironmentIncentives and Risk-Taking BehaviorIntegrated Risk Reporting to StakeholdersIntegrating Risk into Strategy SettingISO 31000 Principles, Framework, and ProcessIT Governance and Control FrameworksKey Risk Indicators and Performance IndicatorsLinking Risk to Objectives and PerformanceManagement Commitment to Risk ManagementPortfolio View of RiskResilience and Business ContinuityResponding to Change and Strategic RiskRisk Appetite StatementsRisk Capacity, Appetite, and ToleranceRisk Culture and Its IndicatorsSelecting a Framework That Fits the OrganizationSoft Controls and Ethical ClimateTone at the Top