The Chief Risk Officer chairs the ERM/RM steering committee.

The statement that the Chief Risk Officer (CRO) chairs the ERM/RM steering committee is not universally true and is not a requirement stipulated by ISO 31000. While the CRO is a key leader in the risk management function, their role is often to facilitate the risk management process, provide expertise, and report to the risk committee. The chair of the risk committee is typically a senior executive (such as the CEO) or, in the case of a board-level committee, an independent non-executive director. This structure ensures a clear separation between the management of risk (a CRO's function) and the oversight of the risk management framework (the committee's function), which is a fundamental principle of good corporate governance. ISO 31000 requires top management to demonstrate leadership and assign responsibilities but remains non-prescriptive about specific titles or committee structures, allowing organizations the flexibility to design a framework that suits their specific context and governance needs.

The "True" option is incorrect because it presents a specific organizational arrangement as a mandatory rule. The composition and leadership of a risk committee can vary significantly based on an organization's size, industry, regulatory requirements, and governance model. Asserting that the CRO always chairs the committee is factually inaccurate.

1. ISO 31000:2018 - Risk management — Guidelines, Clause 5.2, "Leadership and commitment." This clause states that "Top management and oversight bodies, where applicable, should ensure that risk management is integrated into all organizational activities and should demonstrate leadership and commitment..." by "...assigning authorities, responsibilities and accountabilities at appropriate levels within the organization." The standard deliberately avoids prescribing specific roles like a CRO or mandating who must chair a committee, emphasizing the principle of assigning responsibility rather than defining a rigid structure.

2. Committee of Sponsoring Organizations of the Treadway Commission (COSO). (2017). Enterprise Risk Management—Integrating with Strategy and Performance. Page 31, Principle 2: "Establishes Operating Structures." The COSO framework, a globally recognized standard often used alongside ISO 31000, discusses governance structures. It notes, "The chief executive officer has ultimate responsibility for managing the entity... A chief risk officer (or equivalent) may be appointed with centralized responsibility to oversee enterprise risk management." This description positions the CRO in an oversight and facilitation role, typically reporting to senior management and the board, not chairing the oversight committee. The document emphasizes the board's oversight role, which is often delegated to a committee chaired by a board member.

3. Leitch, M. (2010). ISO 31000:2009—A new standard for risk management. The University of New South Wales, Centre for Law, Markets and Regulation. Page 5. In this academic review of the standard, the author notes that ISO 31000 is a principles-based standard, not a specification. "It is not a standard against which organizations can be certified... It is up to each organization to apply the principles in the standard to its own circumstances." This reinforces that the standard does not mandate specific structural roles, such as having the CRO chair a committee.

4. Frigo, M. L., & Anderson, R. J. (2011). Strategic risk management: A foundation for improving enterprise risk management and governance. Journal of Corporate Accounting & Finance, 22(3), 81-88. DOI: https://doi.org/10.1002/jcaf.20677. This article discusses the governance of strategic risk. It highlights the role of the board's risk committee in providing oversight. The authors state, "The board risk committee is typically comprised of a majority of independent directors..." This common governance practice clearly indicates that the chair would be an independent director, not the CRO, who is part of the management team.