Initially, the risk officer may be responsible for managing all risks through one or more risk programs. As the breadth and complexity of risk management increases, it is necessary for the risk officer to delegate the management of certain control activities to others, while retaining oversight and ownership of the outcomes.

When the risk officer delegates the day to day management responsibilities and authority to another employee, the risk officer will approve a risk management program to set expectations. A risk management program is the set of related risk policies and procedures delegated to the employee.

Delegation empowers employees with responsibility and authority within their risk specialty. Risk management programs are generally created when key control activities become more complex. Risk management programs follow the six components described in the CRMF.

The ultimate benefit of risk management programs is to enable employees with the unique specialized knowledge to make educated decisions that either reduce the maximum impact of a risk event or increase the reward for taking on a reasonable risk, while still maintaining the CRMF so that the risk officer can be held accountable.

Common risk programs include:

• Change management
• Vendor management
• Compliance 
• Inventory management
• Ethics and whistleblower

All CRMF components must be present for risk management programs to be effective. Depending on the risk management program, one of the components of the CRMF may play a larger or smaller role. For instance, in a change management program, training and information and communication may play a larger role. Similarly, in an inventory management program, internal control environment, control activities, and assurance may play a more prominent role. The important concept to remember is that each program considers all the CRMF components.

Figure 1: Risk Management Programs