Skip to content

ACCA Strategic Professional · Strategic Business Leader · Managing, monitoring and mitigating risk

Calder Retail has a board risk committee, a chief risk officer (CRO) and an internal audit function. The CEO suggests the CRO should also sign off each business unit's risk assessment as correct, and that internal audit should design the risk controls to save time. Which is the main governance concern with this proposal?

The concern is blurred roles. Internal audit designing controls would compromise the independence it needs as third line assurance, and the CRO approving assessments would take ownership from line managers, who should be accountable for their own risks.

  1. AThe CRO would no longer be able to attend the risk committee
  2. BInternal audit designing controls would impair its independence as the third line, and the CRO signing off assessments would shift ownership away from managementCorrect
  3. CThe board would lose the right to set risk appetite
  4. DRisk management would become the responsibility of the external auditor

Explanation

Management owns risk; the CRO facilitates and challenges. Internal audit must remain independent to assure on controls and so should not design or operate them. The proposal blurs the lines, undermining accountability and objectivity.

Did you get it right without looking?

One question tells you little. A timed set on Managing, monitoring and mitigating risk shows your real accuracy, how long you take and where you lose marks.

Practise Managing, monitoring and mitigating riskFree diagnostic mock

More Managing, monitoring and mitigating risk questions