Exam Dumps 55/61 The Chief Risk Officer chairs the ERM/RM steering committee.

The statement that the Chief Risk Officer (CRO) chairs the ERM/RM steering committee is not universally true and is not a requirement stipulated by ISO 31000. While the CRO is a key leader in the risk management function, their role is often to facilitate the risk management process, provide expertise, and report to the risk committee. The chair of the risk committee is typically a senior executive (such as the CEO) or, in the case of a board-level committee, an independent non-executive director. This structure ensures a clear separation between the management of risk (a CRO's function) and the oversight of the risk management framework (the committee's function), which is a fundamental principle of good corporate governance. ISO 31000 requires top management to demonstrate leadership and assign responsibilities but remains non-prescriptive about specific titles or committee structures, allowing organizations the flexibility to design a framework that suits their specific context and governance needs.

The "True" option is incorrect because it presents a specific organizational arrangement as a mandatory rule. The composition and leadership of a risk committee can vary significantly based on an organization's size, industry, regulatory requirements, and governance model. Asserting that the CRO always chairs the committee is factually inaccurate.

1. ISO 31000:2018 - Risk management — Guidelines

Clause 5.2

"Leadership and commitment." This clause states that "Top management and oversight bodies

where applicable

should ensure that risk management is integrated into all organizational activities and should demonstrate leadership and commitment..." by "...assigning authorities

responsibilities and accountabilities at appropriate levels within the organization." The standard deliberately avoids prescribing specific roles like a CRO or mandating who must chair a committee

emphasizing the principle of assigning responsibility rather than defining a rigid structure.

2. Committee of Sponsoring Organizations of the Treadway Commission (COSO). (2017). Enterprise Risk Management—Integrating with Strategy and Performance. Page 31

Principle 2: "Establishes Operating Structures." The COSO framework

a globally recognized standard often used alongside ISO 31000

discusses governance structures. It notes

"The chief executive officer has ultimate responsibility for managing the entity... A chief risk officer (or equivalent) may be appointed with centralized responsibility to oversee enterprise risk management." This description positions the CRO in an oversight and facilitation role

typically reporting to senior management and the board

not chairing the oversight committee. The document emphasizes the board's oversight role

which is often delegated to a committee chaired by a board member.

3. Leitch

M. (2010). ISO 31000:2009—A new standard for risk management. The University of New South Wales

Centre for Law

Markets and Regulation. Page 5. In this academic review of the standard

the author notes that ISO 31000 is a principles-based standard

not a specification. "It is not a standard against which organizations can be certified... It is up to each organization to apply the principles in the standard to its own circumstances." This reinforces that the standard does not mandate specific structural roles

such as having the CRO chair a committee.

4. Frigo

M. L.

& Anderson

R. J. (2011). Strategic risk management: A foundation for improving enterprise risk management and governance. Journal of Corporate Accounting & Finance

22(3)

81-88. DOI: https://doi.org/10.1002/jcaf.20677. This article discusses the governance of strategic risk. It highlights the role of the board's risk committee in providing oversight. The authors state

"The board risk committee is typically comprised of a majority of independent directors..." This common governance practice clearly indicates that the chair would be an independent director

not the CRO

who is part of the management team.