It is therefore vitally important that management actively shape a risk culture in which only these inherent risks are being managed and run, and that their people, in accordance with the organization’s risk profile, are playing their part in excluding all other risks as extraneous and nonessential.