What should internal auditors consider when assessing the risk culture of a credit union?

When assessing the risk culture of a credit union, it is essential to focus on the attitudes and behaviors of employees towards risk. This is because the risk culture directly influences how risks are identified, assessed, managed, and communicated throughout the organization. Employees’ attitudes towards risk—such as their understanding of the importance of risk management, their willingness to report concerns, and their engagement in risk-related training—can significantly affect the effectiveness of the internal controls and overall risk management framework.

A strong risk culture promotes shared values and behaviors that encourage proactive risk identification and management. If employees perceive risk management as a priority and are empowered to act accordingly, the organization is likely to have a more robust approach to risk, reducing the likelihood of risk-related issues arising. This cultural aspect is often more telling of a credit union’s risk posture than other factors.

While the other options are certainly relevant to a broader risk assessment framework—such as financial stability, past audit documentation, and the regulatory environment—they do not specifically address the internal dynamics and employee perspectives that fundamentally shape the credit union's risk culture. Thus, the focus on employees' attitudes and behaviors is critical in building a sustainable risk culture.