 Per the terms and conditions the CRO must decide to spread the risk to an external party or to retain the risks.If he spreads the risk then it moves to an external party, but it can also go to a subsidiary.In general, the companies transfer risk by purchasing different kinds of insurance.