Question

A newly appointed CRO discovers that the enterprise's annual strategic planning cycle is completed by executive leadership before any formal risk assessment is performed. As a result, major strategic initiatives are approved without consideration of the associated risk exposure. Which action would BEST improve risk governance in this organization?

Accepted Answer

Integrate risk assessment activities into the strategic planning process so risk considerations inform initiative selection

Answer

Require the internal audit function to review each strategic initiative after board approval

Answer

Increase the frequency of operational risk assessments performed by business unit managers

Answer

Establish a separate risk committee that meets quarterly to review completed strategic plans