A good risk culture in an organization can be identified by several characteristics. Among the options

provided:

Option A: The enterprise learns from negative outcomes and treats the root cause

This option reflects a proactive and continuous improvement approach to risk management. It

indicates that the organization does not just react to incidents but also learns from them and

implements measures to address the underlying issues, thereby preventing recurrence. This

approach aligns with best practices in risk management and demonstrates a mature risk culture.

Option B: The enterprise enables discussions of risk and facts within the risk management functions

While facilitating open discussions about risk is important, it primarily shows that the enterprise

supports a communicative environment. However, it does not necessarily indicate that the

enterprise takes concrete actions to learn from negative outcomes or address root causes.

Option C: The enterprise places a strong emphasis on the positive and negative elements of risk

Emphasizing both positive and negative elements of risk is beneficial as it provides a balanced view.

Nonetheless, this focus alone does not provide evidence of actions taken to learn from past mistakes

or to rectify the root causes of issues.

Conclusion:

Option A is the best indication of a good risk culture because it demonstrates that the organization is

committed to learning from past failures and improving its risk management processes by addressing

the root causes of problems.