A newly appointed CRISC-certified risk manager discovers that the enterprise has a formally approved code of conduct, but employees routinely bypass its requirements around gift acceptance from vendors, and no disciplinary action has ever been taken. Senior leadership acknowledges the code exists but treats it as guidance rather than a binding rule. Which action should the risk manager recommend FIRST to strengthen the organization's risk governance?