Question

A mid-sized manufacturer has just launched an enterprise risk management program. During its first quarter, several operational risks fell through the cracks because business unit managers assumed the newly hired Chief Risk Officer (CRO) would identify and treat all risks, while the CRO believed the units were responsible for managing their own day-to-day risks. Which action would BEST prevent this recurring confusion?

Accepted Answer

Establish a RACI matrix that clearly assigns risk identification, treatment, oversight, and assurance responsibilities across roles

Answer

Require the CRO to personally attend every business unit meeting to identify risks in real time

Answer

Increase the risk management budget so more analysts can be hired to cover all business units

Answer

Direct internal audit to take ownership of all operational risks that business units fail to address