CRISC Certified in Risk and Information Systems ControlGovernanceEasy
A newly appointed Chief Risk Officer (CRO) is tasked with establishing an effective enterprise risk management (ERM) framework. The CRO recognizes that for ERM to be successful and embedded throughout the organization, a critical first step involves obtaining formal acknowledgment and support from the highest level of leadership. Which of the following actions is MOST crucial for the CRO to undertake initially?
- AConduct risk awareness training for all employees.
- BDevelop a comprehensive risk register detailing all identified risks.
- CObtain board endorsement of the ERM policy and risk appetite statement.
- DImplement a new risk management software solution.
Show answer & explanationAnswer & explanation
Correct answer: C. Obtain board endorsement of the ERM policy and risk appetite statement.
For an ERM framework to be effective and truly integrated, it must have the full support and direction from the board. This endorsement provides the necessary authority and strategic alignment for all subsequent risk management activities.
Why the other options are wrong
- A. Training is crucial for building risk culture, but it needs to be underpinned by a formally endorsed ERM framework and policy.
- B. While important, developing a comprehensive risk register is a tactical step that follows strategic direction and board endorsement.
- D. Implementing software is a tool-based approach; it cannot substitute for foundational governance and strategic alignment.
ERM Board Endorsement
Formal approval and support from the board of directors for the Enterprise Risk Management (ERM) framework, policy, and risk appetite statement.
- Provides strategic mandate for ERM.
- Ensures ERM is integrated into governance.
- Demonstrates top-level commitment to risk management.
Memory trick: Remember, for ERM to stand tall like a monument, the Board must lay the first stone.