CRISC Certified in Risk and Information Systems ControlGovernanceHard
A nascent technology start-up is focused on rapid product development and market entry. The founders are highly technical but have limited experience with formal governance or risk management. As the company scales, investors are beginning to ask for assurance regarding the sustainability and control of operations. Which of the following is the MOST critical foundational element for the CRISC professional to help the start-up establish first?
- ADefine and communicate clear roles, responsibilities, and accountability for key operational areas.
- BConduct an external audit of their existing security controls and compliance posture.
- CDevelop detailed standard operating procedures (SOPs) for all core business processes.
- DImplement a comprehensive enterprise risk management (ERM) framework.
Show answer & explanationAnswer & explanation
Correct answer: A. Define and communicate clear roles, responsibilities, and accountability for key operational areas.
Before implementing complex frameworks or detailed procedures, establishing clear roles, responsibilities, and accountability is the most critical foundational element. This provides the basic structure for governance, ensures that key tasks are owned, and enables effective oversight, which is essential for a scaling startup.
Why the other options are wrong
- B. An external audit is a reactive assessment. The startup first needs to establish internal foundational elements of governance and control before an audit can be truly meaningful or effective.
- C. SOPs are important for process efficiency, but they are most effective when there's already a clear understanding of who is responsible for what, which is established by roles and responsibilities.
- D. While ERM is the ultimate goal, it's too advanced as a 'first' step for a nascent startup lacking basic structure. Foundational elements must precede complex frameworks.
Foundational Governance: R&R
The establishment of clear roles, responsibilities, and accountability within an organization, forming the essential bedrock for effective governance, decision-making, and risk management.
- Essential for any organization, especially scaling startups.
- Clarifies who does what and who is answerable.
- Precedes complex frameworks and procedures.
Memory trick: Build the team's roles before you build the castle.