Which of the following is MOST important to promoting a risk-aware culture?

Regular testing of risk controls is crucial for validating control effectiveness but doesn't directly promote a cultural shift in risk awareness across all employees.

Communication of audit findings is important for learning and improvement, but it is reactive and focuses on past issues rather than proactive, ongoing risk awareness across the organization.

Procedures for security monitoring are operational activities to detect threats but do not inherently build a broad risk-aware culture.

Open communication of risk reporting is fundamental to promoting a risk-aware culture as it ensures that risks are transparently identified, discussed, and understood throughout the organization. This fosters a sense of collective responsibility and empowers employees to actively participate in risk management.