Is there a culture of risk?

The Institute of Internal Auditors recently asked me the question "Is there a culture of risk?" so I decided to share my view. My view is that there is a culture of risk within organizations. If we define culture as "a way of life - the behaviors, beliefs, and values that are passed along by communication and imitation from one generation to the next" and put it into an organizational context then we can assume the term "generation" refers to the hierarchial levels and parent/child relationships that exist within an organization. That said, we can reasonably conclude that an organizational Board of Directors with good governance practices and an ethical tone at the top will minimize the risky behavior that permeate through the organization. We need to be mindful that cultural beliefs and values have a tendency to dilute themselves as they pass from one generation to the next, however this is the opportunity for internal auditors to serve as the feedback mechanism to the Board to protect the organizational well-being. For those organizational Board of Directors with weak governance practices or who disregard strong ethical practices - they have already lost and will eventually become destroyed by the culture of risky behavior they have created.