Governance · Topic 2 of 7
Risk Culture, Ethics, Policies and Standards
CRISC risk culture and ethics, tone at the top, and the policy hierarchy of policies, standards, procedures and guidelines, with review and exceptions.
- 5 min
- Culture determines whether written controls work in practice.
- Tone at the top is the strongest driver of culture.
- Policies state intent; standards are specific and mandatory; guidelines are optional.
What it is
Organizational culture is how people actually behave when nobody is checking. A risk-aware culture is one where staff understand risk, raise concerns early and follow controls because they see the point. Ethics sets the values that guide decisions the rules do not cover.
Policies and standards turn governance intent into written, enforceable requirements. A policy states what management expects; standards, procedures and guidelines explain how to meet it.
How it works
Risk culture
Culture decides whether controls work in practice. A strong policy fails if staff hide incidents or bypass approvals to hit targets. The COSO ERM framework (2017) makes governance and culture its first component for this reason.
| Sign of a strong risk culture | Sign of a weak risk culture |
|---|---|
| Bad news reaches management quickly | Incidents are hidden or reported late |
| Staff challenge risky decisions | Risk is seen as the risk team's job only |
| Incentives reward sound risk taking | Bonuses reward targets at any cost |
| Leaders follow the same rules | Senior staff are routinely exempted |
| Lessons learned are shared without blame | People are blamed, so problems are buried |
Tone at the top is the visible behaviour of senior leaders. Staff copy what leaders do, not what policies say. The practitioner promotes a risk-aware culture through awareness, training, clear communication and by making risk reporting easy and safe.
Ethics
An ethics program normally includes a code of conduct, conflict of interest rules, a whistleblowing channel that protects reporters, and consequences for violations. ISACA members also agree to the ISACA Code of Professional Ethics, which covers due diligence, objectivity, confidentiality and competence.
For the practitioner, ethics shows up as objectivity. Risk ratings must not be softened to please a stakeholder, and conflicts of interest must be declared.
The policy hierarchy
| Document | Purpose | Mandatory? | Example |
|---|---|---|---|
| Policy | High-level statement of management intent | Yes | "All sensitive data must be protected in transit." |
| Standard | Specific, measurable requirement that supports a policy | Yes | "Use TLS 1.2 or higher for external connections." |
| Procedure | Step-by-step instructions | Yes, for those performing it | "How to request and install a server certificate." |
| Guideline | Recommended practice | No | "Tips for choosing strong passphrases." |
| Baseline | Minimum configuration for a system type | Yes | "Hardened build for Linux web servers." |
A risk management policy states the purpose of risk management, roles, the risk appetite reference, how risk is assessed and reported, and how often. It is approved by senior management or the board.
A good policy
A useful policy is short, approved at the right level, aligned with business objectives and law, communicated to everyone it affects, and reviewed on a schedule or when something significant changes. It names an owner who keeps it current.
Policies that are too detailed age quickly and are ignored. Put the detail in standards and procedures, which can change without board approval.
Compliance and policy exceptions
Compliance is checked by monitoring, control testing and audit. When a business unit cannot comply, it requests an exception.
A sound exception process records the reason, the risk, any compensating control, the approver and an expiry date. Exception handling is covered in detail in the Risk Response and Reporting chapter.
A worked example
A bank has a clear access control policy, but a review finds that traders share passwords to keep systems running during busy periods. Managers know and say nothing because desk revenue targets are met.
The practitioner reports this as a culture problem, not a policy gap. Rewriting the policy would change nothing. The recommendation is for senior management to address incentives and enforcement, add awareness for the desk, and fix the operational cause, such as too few licensed accounts.
How the exam asks about this
- "Which is the MOST effective way to build a risk-aware culture?" Visible commitment and behaviour from senior management, supported by awareness and training.
- "A standard conflicts with a new regulation. What should be updated FIRST?" Confirm the requirement, then update the policy and standards so they meet the law.
- "What is the PRIMARY purpose of a policy?" To state management's intent and direction in a way that can be enforced.
What to remember for the exam
- Culture determines whether written controls work in practice.
- Tone at the top is the strongest driver of culture.
- Policies state intent; standards are specific and mandatory; guidelines are optional.
- Policies are approved by senior management and reviewed regularly or on significant change.
- Practitioners must stay objective and declare conflicts of interest.
A missing policy and an ignored policy are different problems. If staff knowingly bypass a policy, more documentation will not fix it; leadership, incentives and enforcement will.
Common mistakes
Putting technical detail in a policy. It makes the policy hard to maintain. Detail belongs in standards and procedures.
Thinking awareness alone creates culture. Training helps, but incentives and leadership behaviour have more effect.
Treating guidelines as mandatory. Guidelines advise; standards and procedures require.
Check yourself
What is the difference between a policy and a standard?
A policy states management's high-level intent; a standard sets specific, mandatory requirements that support the policy.
Why does a blame culture increase risk?
Staff hide incidents and problems, so management learns about risk too late to respond.
What should a policy exception record contain?
The reason, the risk created, any compensating control, the approver with the right authority and an expiry date.
Topic 2 of 7 in Governance
Test yourself on Governance
The full ISACA CRISC question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.