Question

A newly appointed chief risk officer (CRO) finds that the enterprise risk management function operates informally, with no document defining its mandate, decision-making authority, or escalation rights. Business units frequently bypass risk reviews, claiming the risk team has no power to require them. To establish a legitimate foundation for the function, what should the CRO prioritize?

Accepted Answer

Developing and obtaining board approval of a risk management charter that defines the function's mandate, authority, and reporting lines

Answer

Issuing a memo to all business units instructing them to comply with future risk reviews

Answer

Deploying a governance, risk, and compliance (GRC) tool to centralize risk data collection

Answer

Conducting an enterprise-wide risk assessment to demonstrate the value of the risk function