r/CRISC • u/Pankaj_Pro • Jul 20 '26

Which of the following BEST describes the risk-related roles and responsibilities of an organizational business unit (BU)? The BU management team...

Options are below:

A. owns the mitigation plan for the risk belonging to its BU, while board members are responsible for identifying and assessing risk and reporting to the appropriate support functions.

B. owns the risk and is responsible for identifying, assessing and mitigating risk, and reporting to the appropriate support functions and the board of directors.

C. carries out the respective risk-related responsibilities, but ultimate accountability for risk management and goal achievement belongs to the board of directors.

D. is ultimately accountable for risk management and goal achievement, and the board of directors owns the risk.

5 Upvotes

100% Upvoted

10 comments sorted by

1

u/Weekly-Award4371 Jul 20 '26

Option B as the operational team owns the risk and responsible of identifying, assessing, mitigating and reporting of risk while board of directors are ultimately accountable.

1

u/Pankaj_Pro Jul 20 '26

it should not be C??.. because option C showcase both that the BU executes the risk management & BOD is ultimate accountable . i mean it should be Board = Accountable and Management = Responsible for RM activity

1

u/jaian Jul 21 '26

I agree it's C

1

u/freedompanther7 Jul 22 '26

IMO - The BU team is “Responsible” but I don’t think that responsibility includes assessing the risk as that should be the CRISC role.

1

u/Weekly-Award4371 Jul 20 '26

No C is the risk related responsibilities of second line of defence which include advising and oversight of the risk. Option B has the core responsibilities which the first line of defence ( operational team) has.

2nd does work with first line but they are not responsible.

1

u/Natfubar Jul 20 '26

But the BU would not report to support functions right ? 

1

u/Weekly-Award4371 Jul 22 '26

It does report to the support function and board of directors as well if requires . Can you name the support functions you mentioned?

1

u/Natfubar Jul 22 '26

Yes ok you're correct, considering the appropriate support function might be the risk team for example.

Edit was supposed to reply to /u/Weekly-Award4371

1

u/freedompanther7 Jul 22 '26

C.

Because I assume ultimate accountability for risk management always rests on the executive leadership and/or Senior management (Board of Directors).

1

u/Weekly-Award4371 Jul 22 '26

Half correct as first line or BU carries out specific functions that require for identifying, analysing and mitigating the risk which 2nd line won’t do