CRO CRO Risk Culture & Communication 2 — Questions and Answers
Question 1: In the three lines of defense model, where does the Chief Risk Officer's function primarily reside?
- First line — business operations
- Second line — risk oversight and policy setting (Correct answer)
- Third line — internal audit
- Fourth line — external audit
Correct answer: Second line — risk oversight and policy setting
The CRO and the enterprise risk management function sit in the second line, providing independent oversight, frameworks, and challenge to first-line business units.
Question 2: Which metric is MOST useful for assessing the effectiveness of risk culture communication initiatives?
- Total number of risk policies published
- Change in the rate of voluntary risk event reporting over time (Correct answer)
- Total budget allocated to risk training
- Number of risk management software licenses purchased
Correct answer: Change in the rate of voluntary risk event reporting over time
An increase in voluntary reporting rates signals that employees trust the system and feel accountable for risk, which are direct outputs of effective risk culture communication.
Question 3: A CRO notices that front-line managers consistently override risk controls. This MOST likely indicates:
- Controls are too complex and not integrated into daily workflows (Correct answer)
- The organization has too many risk managers
- The risk register needs to be updated more frequently
- External auditors are not conducting reviews often enough
Correct answer: Controls are too complex and not integrated into daily workflows
When controls are bypassed regularly, it typically means they are poorly designed or create excessive friction, making override the path of least resistance for managers.
Question 4: The concept of 'tone at the top' in risk management means:
- Senior executives publicly model and reinforce desired risk behaviors and values (Correct answer)
- The CRO sits at the top of the organizational hierarchy
- Risk management is only the responsibility of senior leadership
- All risk decisions must be escalated to the CEO
Correct answer: Senior executives publicly model and reinforce desired risk behaviors and values
Tone at the top refers to senior leaders visibly demonstrating and communicating the behaviors and values they expect the entire workforce to emulate regarding risk.
Question 5: Which communication channel is MOST effective for rapidly disseminating a critical risk alert to all employees?
- Quarterly risk newsletter
- Annual risk awareness training module
- Immediate all-staff notification via multiple channels (email, intranet, SMS) (Correct answer)
- Posted memo on the compliance bulletin board
Correct answer: Immediate all-staff notification via multiple channels (email, intranet, SMS)
Critical risk alerts require immediate, multi-channel communication to ensure maximum reach and timely awareness across the entire workforce.
Question 6: When designing risk training for non-risk employees, a CRO should prioritize:
- In-depth coverage of all regulatory frameworks relevant to the organization
- Role-specific scenarios that show how risk concepts apply to each employee's daily decisions (Correct answer)
- Comprehensive mathematical risk modeling techniques
- Detailed review of the organization's historical loss events
Correct answer: Role-specific scenarios that show how risk concepts apply to each employee's daily decisions
Role-specific, scenario-based training increases relevance and retention by showing employees how risk management directly applies to decisions they make every day.
CRO CRO Risk Culture & Communication 2
In the three lines of defense model, where does the Chief Risk Officer's function primarily reside?