Question

A newly appointed CRO finds that the enterprise has a board-approved risk appetite statement, but individual business units continue to make risk decisions based on their own informal thresholds. As a result, one aggressive business unit is accepting risks that exceed enterprise-level limits, while a conservative unit is rejecting profitable opportunities well within acceptable bounds. Which action would MOST effectively address the root cause of this inconsistency?

Accepted Answer

Translate the enterprise risk appetite statement into specific, quantifiable risk tolerance levels that are cascaded to and embedded within each business unit's operating processes

Answer

Require every significant business unit risk decision to be escalated to the CRO for individual approval

Answer

Increase the enterprise risk appetite so that the aggressive business unit's decisions fall within approved limits

Answer

Direct the internal audit function to review each business unit's risk decisions quarterly and report deviations to the board