An organization wants a risk-aware culture. Which behavior is strongest evidence of progress?

1. No reported concerns under any circumstances
2. Staff raise relevant concerns promptly and decisions document risk tradeoffs
3. Identical risk ratings across all departments
4. A larger number of policy PDFs