The set of shared values, attitudes, and behaviors within the organization that shape its approach to risk management.