The Chief Risk Officer chairs the ERM/RM steering committee.

ISO 31000 assigns top management the duty to establish risk-governance roles and permits them to appoint a “champion, e.g., a chief risk officer” to lead the risk-management infrastructure (ISO 31000:2018, Annex A.2-g). Best-practice governance texts (e.g., Lam 2003; IRM “Structured Approach to ERM”) state that the CRO usually heads and chairs the enterprise-wide risk (ERM/RM) steering committee so that risk policy, methodology and reporting are coordinated under a single point of accountability. Therefore, the statement is true.

Why Incorrect Option is Wrong:

B. False – ISO 31000 and widely accepted ERM governance literature explicitly recognise the CRO as the normal chair of the organisation’s risk committee; marking “False” would contradict that guidance.

1. ISO 31000:2018, Annex A.2, item g – “appointing a champion, e.g., a risk manager or chief risk officer” (p.15).

2. Lam, J. 2003. Enterprise Risk Management: From Incentives to Controls, Wiley, Ch. 11 “Risk Governance”, p.206 – “The CRO typically chairs the corporate risk committee.”

3. Institute of Risk Management, ALARM & AIRMIC. 2010. A Structured Approach to Enterprise Risk Management & the Requirements of ISO 31000, Section 4.3, p.16 – “The chief risk officer normally chairs the risk management steering committee.”

4. Simons, R. 2005. Managing Risk in Organizations, Harvard Business School Press, Ch. 8, p.178 – describes the CRO as “chair of the enterprise risk committee.”