Risk culture survey questions for every level, with a board-ready report
A risk culture survey asks employees whether leaders live by the risk rules they set, whether problems can be raised without fear, and whether rewards favour doing things the right way. The core 12 maps onto the four indicators in the FSB risk culture framework and takes about four minutes. Five optional sets dig further, including a risk assessment round for managers.
- 34questions
- 12in the core set
- 4 minto answer the core
- 4FSB indicators covered
By Michael Hodge, BSc Psychology Updated September 2026
All 34 risk culture survey questions
The core 12 is ticked and ready. Add single questions or whole sets, then open them in the builder, print them or copy them out. Under every question you will see the choices employees pick from and what a low score is telling you.
The core 1212 questions
Nine statements spread across tone from the top, accountability, communication and challenge, and incentives, then the main barrier to speaking up, each person's level and one open question. Sent alone, it is a full risk culture survey.
-
Senior leaders follow the risk rules they set.
Strongly disagree12345Strongly agree1 = Strongly disagree, 5 = Strongly agreeTone from the top as staff see it. Leaders are meant to meet the same standards as everyone else, and people notice every shortcut.1
-
My manager puts the rules ahead of targets.
Strongly disagree12345Strongly agree1 = Strongly disagree, 5 = Strongly agreeTone at the middle, which the FSB asks boards to check against the tone at the top. The real test comes when a target and a rule pull apart.1
-
I know which decisions need sign-off before I act.
Strongly disagree12345Strongly agree1 = Strongly disagree, 5 = Strongly agreeRisk appetite in plain words. Staff can only stay inside limits they can name in their own job.
-
After a mistake we look for causes, not culprits.
Strongly disagree12345Strongly agree1 = Strongly disagree, 5 = Strongly agreeLearning from past errors means finding root causes. Where blame comes first, the next mistake goes unreported.1
-
I can raise a risk without it hurting my career.
Strongly disagree12345Strongly agree1 = Strongly disagree, 5 = Strongly agreeThe speak-up statement. Always split it by level: in APRA's bank survey executives agreed 8 points more often than individual contributors.2
-
When I raise a concern, I hear what happened next.
Strongly disagree12345Strongly agree1 = Strongly disagree, 5 = Strongly agreeClosing the loop. People keep raising issues when they see something come of the last one.
-
Staff can challenge decisions here, even senior ones.
Strongly disagree12345Strongly agree1 = Strongly disagree, 5 = Strongly agreeOpenness to alternate views, a core part of the communication and challenge indicator. Low scores mean decisions go unquestioned until they fail.1
-
Risk and compliance staff join plans early, not late.
Strongly disagree12345Strongly agree1 = Strongly disagree, 5 = Strongly agreeThe standing of control functions: are they in the room while a plan takes shape, or only asked to sign at the end?1
-
How targets are met matters here, not just results.
Strongly disagree12345Strongly agree1 = Strongly disagree, 5 = Strongly agreeIncentives. If only the number counts, people learn that the route to it does not.1
-
What would most likely stop someone here raising a risk?
Nothing wouldFear of blameDoubt it helpsUnsure who to tellNo timeNames the barrier to remove first. Count the answers on the worksheet; it also makes a good live poll at a risk forum.
-
Which best describes your role?
ExecutiveSenior managerTeam managerIndividual contributorPrefer not to sayThe split that matters most. Senior leaders tend to see a rosier risk culture than their staff, so the gap between levels is a finding in itself.4
-
What risk do you think senior leaders are not seeing?
Open answerSurfaces blind spots in staff's own words. Read these with the risk team before the numbers go to the board.
Leaders and managers4 questions
Use this set when Q1 or Q2 comes back low, or before a leadership offsite. It breaks tone from the top into things staff can see and hear.
-
Senior leaders talk about risk as often as growth.
Strongly disagree12345Strongly agree1 = Strongly disagree, 5 = Strongly agreeAirtime is a signal. If risk only comes up after something breaks, staff draw their own conclusions.
-
Leaders here own up to their own mistakes.
Strongly disagree12345Strongly agree1 = Strongly disagree, 5 = Strongly agreeLeaders who admit errors make it safer for everyone below them to admit theirs.
-
My manager asks what could go wrong before we start.
Strongly disagree12345Strongly agree1 = Strongly disagree, 5 = Strongly agreeA pre-mortem habit at team level, and a practical sign that risk is part of planning rather than an afterthought.
-
Bad news reaches senior leaders quickly here.
Strongly disagree12345Strongly agree1 = Strongly disagree, 5 = Strongly agreeEscalation speed. Slow bad news is how a small problem becomes an incident.
Rules, rewards and resources6 questions
The accountability and incentives side in more detail: reviews, consequences, controls, training and resources.
-
My performance review includes how I manage risk.
Strongly disagree12345Strongly agree1 = Strongly disagree, 5 = Strongly agreeWhether risk is written into objectives. If it is missing there, it is missing from priorities.
-
A broken rule is dealt with even if it paid off.
Strongly disagree12345Strongly agree1 = Strongly disagree, 5 = Strongly agreeConsistency. The FSB expects consequences whether or not a breach made money, because a good outcome that excuses a breach teaches the wrong lesson.1
-
Our controls fit the way the work is really done.
Strongly disagree12345Strongly agree1 = Strongly disagree, 5 = Strongly agreeControls that ignore real work get worked around. Low scores point to rules worth redesigning.
-
Targets here can be met without bending the rules.
Strongly disagree12345Strongly agree1 = Strongly disagree, 5 = Strongly agreeTarget pressure, asked straight. Where scores dip, look at how those targets were set.
-
I have had training on the risks in my own job.
Strongly disagree12345Strongly agree1 = Strongly disagree, 5 = Strongly agreeRole-specific training rather than generic e-learning. Read it by business unit.
-
My team has enough people and systems to manage risk.
Strongly disagree12345Strongly agree1 = Strongly disagree, 5 = Strongly agreeResourcing. In APRA's survey, 76% of executives but 58% of legal, risk and compliance staff agreed enough had been committed.2
Speaking up and learning4 questions
Include this set when Q5, Q6 or Q10 look weak. It shows whether issues surface early and whether anyone learns from them.
-
I know an anonymous way to raise a concern.
Strongly disagree12345Strongly agree1 = Strongly disagree, 5 = Strongly agreeTests whether the speak-up channel is known, not only whether it exists on paper.1
-
Near misses get reported here, not quietly fixed.
Strongly disagree12345Strongly agree1 = Strongly disagree, 5 = Strongly agreeNear misses are free lessons. A low score means the organisation only learns from real losses.
-
In the past year, did you hold back from raising a risk?
NoYes, onceYes, more than oncePrefer not to sayMeasures silence directly. Read it next to the barrier question (Q10).
-
What one change would help your team handle risk better?
Open answerGives you the action list, written by the people closest to the work.
Risk assessment round (managers and risk owners answer)6 questions
For the people who own a budget, a process or a product. Send it with the core to add a bottom-up risk register to the culture results, and score it with the table further down.
-
Which single risk could most stop your area meeting its goals?
Open answerOne named risk per manager keeps the list short and comparable across teams.
-
How likely is it to happen in the next 12 months?
RareUnlikelyPossibleLikelyAlmost certainScores likelihood from 1 to 5 for the heat map.
-
If it happened, how serious would the impact be?
MinimalMinorModerateMajorSevereScores impact from 1 to 5. Multiply it by likelihood to rank the risk.
-
How well do current controls cover it?
FullyMostlyPartlyBarelyNot at allSeparates risks that are high but handled from risks that are high and exposed.
-
Which kinds of risk weigh most on your area?
PeopleTechnologySuppliersRegulationMoneyReputationCustomersTick all that applyShows where risk concentrates across the business when you add up every manager's ticks.
-
Since the last review, has a risk in your area nearly caused harm?
NoYes, onceYes, more than onceNot sureNear misses at manager level. A yes next to a risk rated Rare deserves a second look.
About you (optional)2 questions
Only for comparing groups. Show a split only where every group is large enough to keep people anonymous.
-
Which area of the business do you work in?
Customer-facingOperationsTechnologyRisk, legal or complianceSupport functionPrefer not to sayCulture varies by unit. In APRA's survey, Technology staff were the least clear on their risk accountabilities.2
-
How long have you been with the organisation?
Under 1 year1 to 3 years4 to 10 yearsOver 10 yearsShows whether newer staff pick up the risk expectations as well as long-serving colleagues.
Which questions cover each FSB risk culture indicator
The Financial Stability Board framework names four indicators of a sound risk culture.1 Every core statement sits under one of them, and each optional set goes deeper on one or two.
| FSB indicator | Core questions | Set to add |
|---|---|---|
| Tone from the top | Q1, Q2 and Q4 | Leaders and managers |
| Accountability | Q3 and Q5 | Speaking up and learning |
| Communication and challenge | Q6, Q7 and Q8 | Leaders and managers |
| Incentives | Q9 | Rules, rewards and resources |
Q10 names the main barrier to raising a risk, Q11 records each person's level so you can compare levels, and Q12 collects the risks staff believe leaders are missing.
If you answer to APRA or another prudential regulator
APRA sorts its own staff survey into ten dimensions: leadership; risk appetite and strategy; decision making and challenge; communication and escalation; risk capabilities; governance and controls; responsibility and accountability; performance management and incentives; alignment with purpose and values; and risk culture assessment and board oversight.3 The core and the three culture sets reach eight of the ten in plain words. When you need scores that line up with APRA's published industry results, run its question list alongside this one. Surveys for strategic planning, operations and process improvement sit with the other business survey questions.
A one-page risk culture results report
Enter the number of employees behind each point on the nine statements. A short bar marks a weak spot, since agreement is good news on all nine. Print the finished page for the risk committee.
- 1Each bar shows the share of respondents at 4 or 5. Neutral answers count as not yet on board.
- 2Fill the report once for everyone, then again for executives only and for individual contributors only (Q11). A statement where the two groups sit far apart is a message that is not reaching the front line.
- 3Count the answers to the barrier question (Q10). The most common barrier is the first thing to remove before the next survey.
- 4Read the blind-spot answers (Q12) with the risk team, match them to the two lowest statements, and agree two actions with named owners.
Risk culture results
Evidence a board or regulator will accept
Four practices that turn staff answers into evidence a board or a regulator will accept.
Agree it is safe to speak up, by level
Invite every level, then compare the levels
A risk culture survey is most revealing when you split it by seniority. In APRA's survey of every employee at 18 Australian banks and mutuals, 95% of executives agreed it was safe to speak up in their part of the business, against 87% of individual contributors, and the same 8-point gap appeared on whether people admit mistakes.2 Sheedy and Griffin's survey of bank staff found the same pattern: senior leaders held a rosier view of risk culture than employees generally.4 The core therefore asks each person's level (Q11). Report every statement by level, and put the widest gaps at the top of the action list.
Write in plain words, not framework terms
Risk appetite, leadership and even management mean different things to different people. In interviews with 21 risk experts, unclear terms were a major barrier to comparable answers, and items that restate a regulatory requirement drew near-uniform agreement.5 So each statement here describes something an employee can see: who signs off, what happens after a mistake, whether a concern gets a reply. Define senior leaders in your invitation, for example as the executive team and their direct reports.
Put the scores next to your other risk evidence
Survey scores show where culture is weakest; incidents, audit findings and conversations explain why. APRA reported that for most banks, the areas where staff agreed least were often the same areas its supervisors had already marked for improvement.2 Line up the two lowest statements with breach logs and audit issues from the same business units, then hold a short workshop with each unit to hear the story behind the numbers.5
Add a bottom-up risk assessment round
Culture questions show how people behave around risk. The Risk assessment round set adds what they are worried about: each manager names the one risk most likely to knock their area off course, then rates its likelihood, its impact and how well current controls cover it. The scoring table below turns those answers into a heat map, and a risk named by several teams at once is a candidate for the enterprise risk register.
Opening a risk forum or a team huddle? Launch the barrier question (Q10) as a live poll, then discuss whichever answer wins while everyone is still in the room. The guide to creating a poll covers sharing the link and reading the results as they come in.
Scoring the risk assessment round
Turn each manager's answers into a score from 1 to 25, so risks named by different teams can be ranked on one heat map.
Score likelihood from Rare (1) to Almost certain (5) and impact from Minimal (1) to Severe (5), then multiply the two.
| Score | Rating | What happens next |
|---|---|---|
| 15 to 25 | Extreme | Escalate to the risk committee this month |
| 10 to 14 | High | Name an owner and fix it this quarter |
| 5 to 9 | Medium | Owner monitors it until the next round |
| 1 to 4 | Low | Keep it on the register and watch |
Worked example
A payments team lead names a key card processor going down for a day. They rate it Likely (4) with a Major impact (4), so 4 x 4 = 16: Extreme. Controls cover it only Partly, so it goes to the risk committee with a request for a backup processor. When two other teams name the same supplier, it moves onto the enterprise risk register as a shared risk.
Use the controls answer to order risks inside a band: a 12 with controls rated Barely comes before a 12 with controls rated Fully.
Every quarter between full surveys: the risk pulse
Send these five every quarter in the months between full surveys. They track leaders, speaking up, replies to concerns, incentives and the top barrier, so you can see whether last year's actions are landing.
- 01Senior leaders follow the risk rules they set.
- 02I can raise a risk without it hurting my career.
- 03When I raise a concern, I hear what happened next.
- 04How targets are met matters here, not just results.
- 05What would most likely stop someone here raising a risk?
Paper questionnaire and scoring sheet for risk culture
Branch, plant and field staff rarely sit at a screen. Print the questionnaire for a team huddle, collect the forms in a sealed envelope, and key the paper answers in alongside the online ones. Letter and A4 both fit.
Risk culture questionnaire
Tick boxes for all twelve core questions fill the first sheet. Pages two onward carry the optional sets.
Download PDF
Risk culture scoring sheet
Count the forms by hand, convert each statement into a percent agreeing, tally the barriers, and record the two areas to act on.
Download PDFQuestions risk and HR teams ask first
Short answers for the planning meeting.
What does a risk culture survey measure?
How people behave around risk, as the people doing the work see it: whether leaders model the rules, whether staff know their limits and can raise problems safely, whether decisions can be challenged, and whether pay and promotion reward the right behaviour. Those are the four indicators in the FSB framework.1
How often should we run a risk culture survey?
On a fixed cycle, with short pulse checks on single themes in between. Durst and Kunz suggest scheduling the full survey "annually or biannually" and adding pulse checks on topics such as openness, because the trend shows whether leadership training or incentive changes are landing.5 Rerun the core a quarter or two after a reorganisation or system launch to test whether it took hold.
Who should answer it?
Everyone, from the executive team to last month's new starters. APRA sent its survey to every employee at 18 banks and mutuals, about 165,500 invitations,2 and the differences between levels were among its most useful findings.
What response rate should we expect?
In APRA's all-staff survey the five largest banks averaged 42% and the other 13 institutions 59%.2 Keep it short, promise anonymity in the invitation, and show staff what changed after the last round.
Is a risk culture survey the same as a risk assessment survey?
No. A risk culture survey asks how people behave around risk; a risk assessment survey asks which risks worry them, how likely they are and how bad they would be. This page has both: the core for culture, and the Risk assessment round set for managers, scored with the table above.
Should a risk culture survey be anonymous?
Yes. Use one open link with no login and hold back any breakdown thin enough to trace one reply to its author. In the risk assessment round, ask managers to write their team name beside the risk they pick, so every risk on the heat map has an owner.
Risk culture questions that miss, rewritten
Expert reviewers flag two weak spots again and again: jargon, and items that restate a rule so that everyone agrees.5 Browse more survey questions by topic for other jobs.
Our organisation has a documented risk appetite statement.
I know which decisions need sign-off before I act.
Everyone agrees the document exists, which makes the result useless. Ask whether its limits reach an ordinary working day.
Does management set the right tone from the top on risk?
Senior leaders follow the risk rules they set.
My manager puts the rules ahead of targets.
Management means the board to some staff and their supervisor to others, and tone is jargon. Name the people and the behaviour.
Do you feel comfortable reporting risks and know how to escalate them?
I can raise a risk without it hurting my career.
I know an anonymous way to raise a concern.
Two questions in one. Someone who knows the channel but fears using it has no honest answer.
How would you rate our risk culture overall?
When I raise a concern, I hear what happened next.
An overall grade cannot be acted on. A specific behaviour tells the risk team exactly what to change.
Measure your risk culture this quarter
Email the core 12 link to all levels, print copies for staff away from a screen, and bring the level-by-level report to your next risk committee.
