.

Sponsored

Risk governance

3:57 PM | Posted by |
A governance structure based on a “three lines of defense”
model is emerging as a leading practice in the industry.
A key component of successful ERM is a risk culture that
permeates the organization and drives a sense of shared
responsibility for risk management throughout the company.
However, 38 percent of survey respondents reported that
company boards are not engaged or are only passively
engaged in risk management. In addition, only two thirds
of companies indicated that they have a dedicated chief
risk officer (CRO), and where companies did not have a
dedicated CRO, three quarters of them reported that other
positions cover the role, often on a part-time basis. In 40
percent of companies, the CRO does not report directly to
the CEO or the board; the other most common reporting line
is to the chief financial officer. And, while almost all board
risk committees have formal terms of reference in place,
with corporate risk committees and other risk committees
achieving almost the same level of formality, the existence
of formal terms of reference starts to fall off dramatically
for business unit risk committees. 84 percent of companies
responded that the risk function is responsible for risk
oversight, with business areas owning and managing
the risks.
Regardless of the reporting structure a company
employs, the CRO or risk committees will be largely
responsible, either solely or jointly, for compliance with
the RMORSA requirements.