Question

A mid-sized financial services firm has just acquired a smaller fintech company that operated with an informal, spreadsheet-based approach to risk tracking. The acquiring firm uses a mature enterprise risk management (ERM) program aligned to a formal framework. The board wants the acquired entity's risks reflected in enterprise reporting within one quarter. As the risk practitioner leading integration, what should be your FIRST priority?

Accepted Answer

Assess whether the acquired entity's business objectives, processes, and risk context can be mapped to the parent firm's ERM framework and risk taxonomy

Answer

Immediately migrate the acquired entity's spreadsheets into the parent firm's GRC tool to consolidate data

Answer

Require the acquired entity to immediately adopt the parent firm's risk appetite statement without modification

Answer

Schedule external penetration testing of the acquired entity's systems to identify technical vulnerabilities