Chief Risk Officer and Risk Function Roles

1. Why This Topic Matters for the CRMA Exam

The IIA's Certification in Risk Management Assurance (CRMA) tests your ability to provide assurance over an organisation's risk management processes. You cannot evaluate those processes unless you understand who owns them. The Chief Risk Officer (CRO) and the broader risk function sit at the heart of enterprise risk management (ERM) governance, and the exam repeatedly probes whether candidates can distinguish the management role of the risk function from the assurance role of internal audit. Questions in the Risk Management Governance domain frequently present scenarios in which roles are blurred, independence is compromised, or reporting lines are inappropriate, and ask you to identify the governance weakness or the best corrective action. Mastering this topic also underpins other domains, because understanding risk ownership is the foundation for evaluating risk appetite, risk culture, risk reporting and the Three Lines Model.

2. What the Chief Risk Officer Is

The CRO is the senior executive accountable for designing, implementing, coordinating and maintaining the organisation's ERM framework. The CRO does not own individual business risks; operational management owns those. Instead, the CRO builds and runs the infrastructure that allows risks to be identified, assessed, responded to, monitored and reported consistently across the enterprise.

Typical CRO responsibilities include:
• Developing and maintaining the ERM framework, policies and methodologies (often aligned to COSO ERM 2017 or ISO 31000).
• Facilitating the articulation of risk appetite and risk tolerance for approval by the board.
• Aggregating risk information across business units into an enterprise-wide risk profile.
• Reporting on key risks, emerging risks and risk appetite breaches to executive management and the board or board risk committee.
• Championing risk culture and risk awareness training.
• Challenging first-line risk assessments and risk responses.
• Coordinating with compliance, legal, finance, information security and other second-line functions.
• Advising on risk implications of strategy, major projects, acquisitions and new products.

3. The Risk Function and Its Place in the Three Lines Model

The IIA's Three Lines Model (2020) is the lens through which the exam views risk roles:

Governing body (board): Sets direction, defines risk appetite, holds management accountable and ensures independent assurance exists. Often delegates detailed oversight to a board risk committee or the audit committee.

First line (operational management): Owns and manages risk day to day. Business unit leaders are the true risk owners. They identify risks in their processes, implement controls and operate within approved appetite.

Second line (risk function, compliance, etc.): The CRO and the risk function sit here. They provide expertise, support, monitoring and challenge on risk matters. They set frameworks, coordinate assessments, aggregate data and report. Crucially, the second line is part of management, not independent assurance.

Third line (internal audit): Provides independent and objective assurance on the effectiveness of governance, risk management and control, including assurance over the work of the CRO and the risk function itself. Internal audit must remain free from management responsibility for risk processes.

A frequently tested point: the risk function and internal audit are complementary, not interchangeable. The risk function helps management manage risk; internal audit tells the board whether that management is working.

4. How the CRO and Risk Function Operate

Reporting lines and independence. Good practice is for the CRO to report administratively to the CEO (or another senior executive) and functionally to the board or its risk committee, with direct and unfiltered access to the board. Reporting solely to the CFO or to a business unit head is a red flag because it can subordinate risk judgement to financial or commercial pressures. The CRO should have sufficient stature, authority and resources to challenge business decisions.

Risk appetite and tolerance. The board approves risk appetite; the CRO drafts, translates and cascades it into measurable tolerances, limits and key risk indicators (KRIs). The risk function monitors actual exposure against these limits and escalates breaches.

Risk identification and assessment. The risk function provides common taxonomies, scoring scales and tools (risk registers, heat maps, scenario analysis). First-line managers perform the assessments; the second line facilitates, consolidates and challenges them.

Risk reporting. The CRO produces enterprise risk reports, dashboards and emerging-risk analyses for executive committees and the board. Effective reporting is timely, aggregated, forward-looking and linked to strategic objectives.

Risk culture. The CRO promotes tone at the top, embeds risk considerations into performance management and decision making, and encourages escalation without fear of retaliation.

Risk committees. Many organisations have a management-level risk committee chaired by the CEO or CRO and a board-level risk committee of non-executive directors. The CRO typically serves as secretary or principal adviser to both.

5. Internal Audit's Relationship with the CRO

The IIA position paper on the role of internal auditing in ERM distinguishes:
• Core assurance roles (appropriate): giving assurance on risk management processes, on the evaluation and reporting of key risks, and on whether risks are correctly assessed.
• Legitimate consulting roles with safeguards: facilitating risk workshops, coaching management on risk response, coordinating ERM activities, maintaining the risk framework while management retains ownership and decision rights.
• Roles internal audit should NOT undertake: setting risk appetite, owning or implementing risk responses, making decisions on risk responses, being accountable for risk management, and imposing risk management processes.

In smaller organisations the Chief Audit Executive (CAE) may be asked to act as CRO. The exam expects you to recognise that this creates a self-review threat and impairs independence. If unavoidable, safeguards include board approval, disclosure in the audit charter, periodic rotation, and obtaining assurance over risk management from an external party.

6. Common Governance Weaknesses Tested

• CRO reports to the head of a revenue-generating unit or lacks board access.
• The risk function performs first-line control activities and then monitors its own work.
• Internal audit owns the risk register or sets risk appetite.
• Risk appetite is set by the CRO rather than approved by the board.
• Risk reports are not aggregated, are backward-looking, or do not reach the board.
• The CRO lacks authority to veto or escalate high-risk decisions.
• No clear documentation (charter, RACI) of risk roles across the three lines.
• Risk management is treated as a compliance exercise rather than integrated into strategy.

7. Exam Tips: Answering Questions on Chief Risk Officer and Risk Function Roles

Tip 1 – Always locate the line. Before choosing an answer, classify every actor in the scenario as governing body, first line, second line or third line. Most wrong answers assign a task to the wrong line (for example, having internal audit decide a risk response, or the board performing day-to-day monitoring).

Tip 2 – Remember who owns risk. Operational management owns risk. The CRO owns the framework. Internal audit owns the assurance. If an answer says the CRO is accountable for managing a specific business risk, it is almost certainly wrong.

Tip 3 – The board approves appetite; the CRO facilitates. Any answer stating that the CRO, CAE or risk committee sets or approves risk appetite on behalf of the organisation is a distractor. The CRO recommends and translates; the board approves.

Tip 4 – Watch for independence threats. When a scenario describes the CAE also acting as CRO, or internal audit maintaining the risk register with decision authority, look for the answer that identifies the impairment to objectivity and proposes safeguards or separation of duties.

Tip 5 – Reporting lines are a classic question. The best-practice answer is CRO with direct access to the board or board risk committee and administrative reporting to the CEO. Reporting to the CFO, COO or a business line head is usually presented as the weakness.

Tip 6 – Prefer answers that strengthen governance structurally. When asked for the most effective improvement, choose options that clarify roles (charter, RACI), elevate CRO authority, improve board reporting or separate conflicting duties, rather than options that merely add training or documentation.

Tip 7 – Distinguish coordination from substitution. Internal audit may coordinate with, rely on and leverage the risk function's work (with appropriate evaluation of its reliability), but may not substitute the risk function's self-assessment for independent assurance.

Tip 8 – Use IIA language. The exam uses terms from the Three Lines Model, the IIA Standards and the COSO ERM framework. Answers phrased in that language (assurance, objectivity, risk appetite, risk owner, second line, governing body) are more likely correct than answers using loose or commercial terminology.

Tip 9 – Eliminate absolutes. Options containing words like always, never or solely are often wrong, because the appropriate role of the CRO and internal audit depends on organisation size, maturity and safeguards.

Tip 10 – Think about what the board needs. Many questions ask what information the CRO should report. The right answer usually emphasises aggregated, enterprise-level, forward-looking information linked to strategic objectives and appetite, not granular operational detail.

8. Quick Revision Summary

• CRO = architect and coordinator of ERM; second line; part of management.
• Risk owners = first-line business managers.
• Board = approves risk appetite, oversees ERM, ensures independent assurance.
• Internal audit = third line; provides assurance over risk management, including over the CRO's work; must not own risks or set appetite.
• Best-practice CRO reporting: direct board/risk committee access plus CEO administrative line.
• CAE as CRO = independence impairment requiring safeguards.
• Exam strategy: identify the line, identify the owner, protect independence, elevate board oversight.

Master these principles and you will be well equipped to handle scenario-based questions on the Chief Risk Officer and risk function roles in the CRMA examination.