Which of the following is the BEST indication of a mature organizational risk culture?
A . Corporate risk appetite is communicated to staff members.
B . Risk policy has been published and acknowledged by employees.
C . Management encourages the reporting of policy breaches.
D . Risk owners understand and accept accountability for risk.
Answer: D