An internal auditor wants to obtain management's evaluation of the organizational risk culture.

Send out a survey with a few open questions, such as “What is your impression of the risk culture in our organization?”

Send out a survey with statements and request defined answers, such as “strongly agree” and “strongly disagree.”

Send out an email asking managers to evaluate the risk culture and provide detailed justification.

Send out an email asking those who have something to report on organizational risk culture to step forward.