Which of the following is the BEST way to build a risk-aware culture?

While varying awareness messages can maintain engagement, simply changing messages doesn't inherently build a culture of active risk reporting or ownership among staff.

Documenting and communicating threats is a top-down risk management activity, but it doesn't primarily foster a culture where all staff feel responsible for identifying and reporting new risks.

Establishing a clear and accessible channel for staff to report risks directly empowers employees to actively participate in the organization's risk management process. This fosters a sense of ownership and responsibility, encouraging a proactive culture where individuals feel comfortable identifying and escalating potential risks, thus embedding risk awareness into daily operations.

Periodically testing compliance helps ensure adherence to existing controls, but it is a reactive measure and does not proactively build a culture where employees identify and report new or unaddressed risks.