 When the potential for risk is large, the CRO must report to the CEO and/or the board of directors for future action.Although the CRO's job is to minimize the potential risk in the company, risk as a factor cannot not be eliminated fully from a company.The introduction of the Sarbanes-Oxley act (SOX) has promoted the need and adaptation of the CRO role.