Question

A newly appointed CRO discovers that each business unit maintains its own risk register using different scoring scales, categories, and reporting frequencies. When the board asks for an enterprise-wide view of the organization's most significant exposures, the CRO cannot produce a consolidated picture. Which action should the CRO take FIRST to enable meaningful enterprise risk reporting?

Accepted Answer

Establish a common risk taxonomy and standardized assessment criteria across all business units

Answer

Direct each business unit to increase the frequency of its risk register updates

Answer

Purchase a governance, risk, and compliance (GRC) tool to automate risk aggregation

Answer

Present each business unit's individual risk register to the board separately