Question

A newly appointed risk manager at a mid-sized manufacturing firm discovers that risk activities are performed inconsistently across departments, with no common terminology, ownership structure, or method for aggregating risk to the enterprise level. The board wants assurance that risk is being managed in a structured, repeatable way that aligns with organizational objectives. Which action should the risk manager recommend FIRST?

Accepted Answer

Adopt and implement an enterprise-wide risk management framework that defines common terminology, roles, processes, and reporting

Answer

Purchase a governance, risk, and compliance (GRC) tool to automate risk data collection across departments

Answer

Require each department to submit its top ten risks to the board on a quarterly basis

Answer

Increase the internal audit budget to test the effectiveness of existing departmental controls