An organization has adopted an enterprise-wide risk management process and has appointed a chief risk officer (CRO) to manage the process. The board has requested that the audit committee have oversight over the risk management function. Which of the following statements is not true regarding this situation?
The audit committee, on behalf of the board, does not have overall responsibility for the risk management process in the organization. The responsibility for managing risks typically lies with senior management, while the audit committee's role is to provide oversight and ensure that management has an effective risk management process in place.
I realized this is "which is NOT true" question. A is the correct answer because assurance is not provided by CRO.
Why not D? assurance should be provided by IAA or other assurance providers...