CRISC Certified in Risk and Information Systems ControlGovernanceHard
A large retail chain is planning to launch a new mobile payment application. The project manager is primarily focused on user experience and marketing, while the legal department is concerned about compliance with Payment Card Industry Data Security Standard (PCI DSS) and consumer protection laws. The chief risk officer (CRO) observes that these different priorities are creating delays and potential compliance gaps. To resolve this, which of the following actions by the CRO would MOST effectively foster a strong risk culture?
- AEscalate the issue to the board of directors for a top-down directive on compliance.
- BMandate a series of compliance training sessions for all project team members.
- CImplement a 'gate review' process where project progress is halted until all legal and compliance checks are passed.
- DFacilitate cross-functional workshops to integrate risk and compliance requirements into project goals and metrics.
Show answer & explanationAnswer & explanation
Correct answer: D. Facilitate cross-functional workshops to integrate risk and compliance requirements into project goals and metrics.
Facilitating cross-functional workshops directly addresses the differing priorities by bringing stakeholders together to understand and integrate risk and compliance into shared project goals. This collaborative approach fosters a stronger risk culture by promoting shared ownership and understanding, rather than imposing controls or escalating issues.
Why the other options are wrong
- A. Escalation provides a directive but doesn't necessarily build a collaborative risk culture or address the root cause of differing priorities at the operational level.
- B. Training is important, but often insufficient on its own to change ingrained priorities or foster collaboration; it's a passive approach.
- C. A 'gate review' is a control mechanism that can cause delays and resentment if not coupled with proactive integration, and it doesn't necessarily foster a shared risk culture.
Risk Culture Integration
The process of embedding risk awareness and accountability into an organization's daily operations, decision-making, and employee behavior through collaborative mechanisms.
- Promotes shared ownership of risk management across all functions.
- Encourages proactive identification and mitigation of risks.
- Aligns individual and team objectives with organizational risk appetite.
Memory trick: Team Together, Risks Weather, Culture Better.