A Large Investment Organization Hired a Chief Risk Officer (CRO)

Multiple Choice

A large investment organization hired a chief risk officer (CRO) to be responsible for the organization's risk management processes. Which of the following people should prioritize risks to be used for the audit plan?

A) Operational management, because they are responsible for the day-to-day management of the operational risks.
B) The CRO, because he is responsible for coordinating and project managing risk activities based on his specialized skills and knowledge.
C) The chief audit executive, although he is not accountable for risk management in the organization.
D) The CEO, because he has ultimate responsibility for ensuring that risks are managed within the agreed tolerance limits set by the board.