Risk culture is an established concept that is seen by boards and executive management as being key to effective risk management and critical to long-term corporate health. Yet the discipline of proactively managing risk culture is still immature, as is reflected in the literature by the lack of consensus around what the concept involves, a lack of sophistication in assessing health/strength, and continued challenges in effectively addressing weaknesses. Against this background, the conceptual encounter methodology is used in this study to develop a pan-industry risk culture (PIRC) model based on the experiences of risk professionals across a range of industry sectors. The model is informed by complex-systems theory and an appreciation of organizational subcultures. It describes “what good practice is” by defining three stages of organizational maturity. While it incorporates well-understood attributes, such as leadership, accountability and incentives, it also broadens understanding through the inclusion of more novel aspects, such as the alignment of risk culture with strategy, the role of middle managers, the consideration of unintended behavioral consequences and the influence of an internal risk culture capability. The model extends current knowledge and may inform risk management policy, supervisory oversight and risk culture change programs.