Questions for management

1: Can all of managementnot just the chief risk officerarticulate how risk is considered in the selection of strategy or business decisions?

2: Can they clearly articulate the entity's risk appetite and how it might influence a specific decision?

3: The resulting con- versation may shed light on what the mindset for risk taking is really like in the organization.

Boards can also ask senior man- agement to talk not only about risk processes but also about culture. How does the culture enable or inhibit responsible risk taking?

4: What lens does management use to monitor the risk culture, and how has that changed?

5:As things changeand things will change whether or not they're on the entity's radarhow can the board be confident of an appropriate and timely response from management?