Which of the following is the MOST important course of action to foster an ethical, risk-aware culture?

Implementing a fraud detection and prevention framework is a specific control for a particular risk, but it does not broadly foster an ethical, risk-aware culture across all aspects of the organization.

Aligning policies and standards with risk appetite is a crucial governance activity, but it's a structural element rather than a direct, active culture-building initiative that engages all employees.

An enterprise-wide ethics training and awareness program directly educates all employees about the organization's values, ethical principles, and the importance of risk awareness in their daily activities. This consistent communication helps to embed an ethical mindset and understanding of risk into the organizational culture, influencing individual behavior and collective decision-making. It actively cultivates the desired culture by informing and engaging the workforce.

Reviewing legislative frameworks ensures compliance but primarily addresses external requirements rather than proactively fostering an internal culture of ethics and risk awareness.