When external auditors identified a lack of buy-in into risk management in a telecommunications organisation and gave a ‘risk immature’ rating, it aligned with the perception of a poor risk culture. Risk culture relates ...