CRISC Certified in Risk and Information Systems ControlGovernanceEasy
A mid-sized e-commerce company is experiencing rapid growth, leading to increased transaction volumes and a broader customer base. The current risk management processes are ad-hoc and reactive, primarily focused on IT security incidents. The board of directors wants to mature the company's risk management capabilities to support sustainable growth. Which of the following is the MOST appropriate first step to establish a comprehensive enterprise risk management (ERM) program?
- AHire a dedicated Chief Information Security Officer (CISO).
- BDevelop a formal risk appetite statement approved by the board.
- CConduct a comprehensive risk assessment across all business functions.
- DImplement new security technologies to handle increased transaction volumes.
Show answer & explanationAnswer & explanation
Correct answer: B. Develop a formal risk appetite statement approved by the board.
Establishing a formal risk appetite statement provides the foundational guidance for all subsequent risk management activities, defining the acceptable level of risk the organization is willing to take to achieve its objectives.
Why the other options are wrong
- A. Hiring a CISO focuses on IT security, not the broader enterprise risk management required.
- C. A comprehensive risk assessment is a key step, but it should be guided by a clear understanding of the organization's risk appetite.
- D. Implementing new security technologies is a tactical response to a specific type of risk, not a foundational step for a comprehensive ERM program.
Risk Appetite Statement
A formal document approved by the board of directors that articulates the amount and type of risk an organization is willing to accept or retain to achieve its strategic objectives.
- Sets the tone for risk-taking throughout the organization.
- Guides decision-making at all levels.
- Fundamental component of an effective ERM framework.
Memory trick: Before you build a risk house, you need a blueprint of how much risk you're willing to live with.