Chief Risk Officer (CRO) Certificate

Virtual Orientation: noon–5 p.m. ET
Feb. 10–11, 2027

Virtual Modules: 4–9 p.m. ET
Feb. 16 and 23; March 9, 16 and 23; April 6, 13 and 20; May 4, 11 and 18, 2027

Final Module + Practicum: 9 a.m.–5 p.m. ET (Pittsburgh, PA; virtual option available)
June 14–16, 2027

The final module and practicum will be held in person at our main campus in Pittsburgh:

Heinz College of Information Systems and Public Policy
Carnegie Mellon University
4800 Forbes Avenue
Pittsburgh, PA 15213

A virtual option will be offered for the final module and practicum; students will not be required to travel to complete the program.

Earning your executive education certificate is just the beginning of a lifelong relationship with Carnegie Mellon University; we’re here to help you advance your career throughout your professional life. The Heinz College Executive Advantage program is meant for people who always want to be ahead of the curve — those who want to lead the conversation, not just be a part of it.

Executive Advantage was designed with you — C-suite executives and lifelong learners — in mind. In addition to the valuable skills you gain through our executive certificate programs, you now have access to workshops, leadership summits and conferences.

Feb. 11, 2027 (Virtual)

The Chief Risk Officer increasingly serves as both the leader of the enterprise risk function and a strategic adviser to senior management and the board. This opening module examines the CRO’s evolving mandate, responsibilities, relationships and leadership challenges. Participants will explore how effective CROs establish credibility, create enterprise-wide ownership of risk, balance risk oversight with business enablement and position risk management as a contributor to organizational performance and resilience. The module establishes the foundation for the program and introduces the operating context in which the modern CRO leads.

Key Topics

• Evolving role, mandate and responsibilities of the CRO
• Enterprise risk leadership and organizational accountability
• CRO relationships across the C-suite, board and risk functions
• Risk culture, business enablement and effective challenge

Learning Objectives

• Define the responsibilities and leadership expectations of the modern CRO.
• Establish effective relationships and accountability for risk across the enterprise.
• Balance independent risk oversight with support for business objectives and informed risk-taking.
• Assess how the CRO function can contribute to enterprise performance, resilience and decision-making.

Feb. 16, 2027 (Virtual)

Effective enterprise risk management begins with clear governance, defined risk boundaries and consistent approaches for identifying and assessing risk. This module examines how CROs establish the structures, decision rights, frameworks and processes necessary to govern risk across the enterprise. Participants will explore how risk appetite and tolerances translate enterprise strategy into practical boundaries for decision-making and how risk assessment methodologies are used to identify, evaluate, aggregate and prioritize exposures.

Key Topics

• Enterprise risk governance, frameworks, roles and accountability
• Risk appetite, capacity, tolerances, limits and escalation
• Risk identification, assessment and prioritization methodologies
• Risk aggregation, interdependencies and enterprise risk profiles

Learning Objectives

• Design governance structures that establish clear enterprise risk accountability.
• Develop and operationalize risk appetite, tolerances and limits.
• Apply appropriate methodologies to identify, assess and prioritize enterprise risks.
• Aggregate risk information into an enterprise view that supports management action and escalation.

Feb. 23, 2027 (Virtual)

Risk management creates the greatest enterprise value when it improves strategic choices rather than simply identifying threats. This module examines how CROs integrate risk, uncertainty and economic considerations into strategy development and major enterprise decisions. Participants will explore strategic risk assessment, risk/reward trade-offs, scenario-based decision-making, the economics of mitigation and approaches for evaluating when to accept greater risk in pursuit of strategic objectives.

Key Topics

• Strategic risk identification and integration with enterprise strategy
• Risk/reward trade-offs and decision-making under uncertainty
• Economics of risk mitigation, acceptance, avoidance and transfer
• Scenario planning and risk-adjusted investment decisions

Learning Objectives

• Integrate risk considerations into strategic planning and major enterprise decisions.
• Evaluate risk/reward trade-offs associated with alternative strategic choices.
• Assess the economic value and cost of different risk-management responses.
• Apply scenario analysis to support decisions under conditions of uncertainty.

March 9, 2027 (Virtual)

Operational disruptions can originate from people, processes, systems, external events or dependencies across an increasingly interconnected enterprise. This module examines how CROs identify, assess, manage and monitor operational risk while strengthening the organization’s ability to withstand and recover from disruption. Participants will explore operational risk frameworks, critical business services and dependencies, business continuity, crisis preparedness and resilience strategies designed to maintain essential operations under adverse conditions.

Key Topics

• Operational risk identification, assessment, controls and monitoring
• Critical business services, processes, systems and dependencies
• Business continuity, disruption preparedness and recovery
• Enterprise resilience, operational scenarios and response strategies

Learning Objectives

• Apply operational risk frameworks to identify and manage significant enterprise exposures.
• Identify critical business services and the dependencies required to sustain them.
• Evaluate continuity, recovery and response strategies for significant disruptions.
• Develop approaches that strengthen enterprise operational resilience.

March 16, 2027 (Virtual)

CROs must understand both traditional financial risks and the potential financial consequences of broader enterprise risks. This module examines financial risk management and the quantitative methods used to translate uncertainty and exposure into information that supports management decisions. Participants will explore financial risk categories, scenario and stress-testing techniques, approaches for quantifying nonfinancial risks and mechanisms for financing, transferring, mitigating or accepting risk.

Key Topics

• Financial risk, including credit, liquidity, market and capital exposures
• Enterprise risk quantification and financial impact analysis
• Scenario analysis, stress testing, probability, severity and uncertainty
• Risk financing, insurance, transfer, mitigation and retention

Learning Objectives

• Identify and evaluate significant financial risk exposures.
• Apply quantitative approaches to estimate the financial impact of enterprise risks.
• Use scenario analysis and stress testing to evaluate potential risk outcomes.
• Evaluate alternative approaches for financing, transferring, mitigating or retaining risk.

March 23, 2027 (Virtual)

Enterprise dependence on technology, digital platforms, cloud environments and data has made technology risk a core component of the CRO portfolio. This module provides CROs with an executive-level framework for overseeing cyber, technology and data risk without requiring them to become technical specialists. Participants will examine technology dependencies, cyber threats, data risks, digital resilience, regulatory expectations and approaches for assessing, monitoring and responding to significant technology-related exposures.

Key Topics

• Cybersecurity and enterprise technology risk
• Cloud, infrastructure, data, privacy and digital dependencies
• Technology risk governance, regulatory requirements and controls
• Cyber resilience, incident response, recovery and risk transfer

Learning Objectives

• Evaluate cyber, technology and data risks from an enterprise risk perspective.
• Establish appropriate governance and oversight for significant technology exposures.
• Assess the business implications of technology dependencies, failures and cyber events.
• Evaluate response, resilience and risk-transfer strategies for technology-related risks.

April 6, 2027 (Virtual)

Organizations increasingly depend on complex networks of suppliers, service providers, technology partners, outsourced functions and other external relationships. This module examines how CROs develop an enterprise approach to identifying and managing risks created by these dependencies. Participants will explore third- and fourth-party risk, supply-chain disruption, concentration and geographic exposure, regulatory considerations and practical approaches for monitoring, mitigating, diversifying, transferring or exiting external relationships.

Key Topics

• Third- and fourth-party risk management
• Supply-chain, geographic and concentration risk
• Vendor due diligence, monitoring, contracting and regulatory requirements
• Dependency mapping, diversification, contingency planning and exit strategies

Learning Objectives

• Identify significant risks arising from third parties and external dependencies.
• Assess supply-chain, concentration and ecosystem exposures across the enterprise.
• Establish effective governance and monitoring throughout the third-party lifecycle.
• Develop appropriate mitigation, contingency, diversification and exit strategies.

April 13, 2027 (Virtual)

The rapid adoption of predictive, generative and agentic AI introduces new opportunities as well as new forms of enterprise risk. This module prepares CROs to provide effective oversight of AI without requiring deep technical expertise. Participants will examine AI risk identification and classification, governance and accountability, regulatory considerations, testing and assurance, cybersecurity and data concerns, human oversight and ongoing monitoring. Particular attention will be given to the expanding autonomy of agentic systems and the implications for enterprise risk.

Key Topics

• AI risk identification, classification and enterprise risk integration
• AI governance, accountability, regulatory requirements and human oversight
• AI assurance, testing, validation, security and control effectiveness
• Generative and agentic AI risk, monitoring, incidents and response

Learning Objectives

• Identify and assess significant risks associated with enterprise AI deployment.
• Establish governance, accountability and oversight appropriate to different levels of AI risk.
• Evaluate assurance, testing, security and monitoring approaches for AI systems.
• Incorporate AI risk into enterprise risk management and executive reporting processes.

April 20, 2027 (Virtual)

An effective enterprise risk program requires more than sound frameworks — it requires an operating model capable of consistently executing risk management across the organization. This module focuses on the practical disciplines required to structure, staff, manage and operate the CRO function. Participants will examine organizational models, roles and responsibilities, relationships across the Three Lines, talent and capability requirements, risk committees, operating cadences, business engagement, culture and the resources required to sustain an effective risk organization. Positioned at this stage of the program, the module helps participants translate risk strategy, governance and domain-specific risk management into the organizational capabilities and operating practices needed to embed risk management into day-to-day business operations.

Key Topics

• CRO organizational structures, operating models and the Three Lines
• Risk roles, talent, staffing, capabilities and co-sourcing
• Risk committees, operating cadence, escalation and business engagement
• Risk culture, accountability, resources and functional effectiveness

Learning Objectives

• Design an operating model aligned with the organization’s risk profile and business needs.
• Define roles and working relationships across risk, business, assurance and control functions.
• Establish effective operating rhythms, committees and escalation processes.
• Assess the talent, resources, culture and capabilities required to operate an effective CRO organization.

May 4, 2027 (Virtual)

Effective CROs must look beyond static risk registers and periodic assessments to understand how the organization’s risk environment is changing. This module examines how CROs build risk intelligence capabilities that identify emerging exposures, detect changes in existing risks, connect information across risk domains and provide actionable insight to decision-makers. Participants will explore horizon scanning, emerging risks, key risk indicators (KRIs) and early-warning indicators, interconnected risk, scenario analysis and approaches for synthesizing internal and external information into decision-relevant intelligence.

Key Topics

• Enterprise risk intelligence and executive decision support
• Emerging risk, horizon scanning and external risk sensing
• KRIs, early-warning indicators, thresholds and escalation
• Interconnected risk, scenarios, aggregation and forward-looking analysis

Learning Objectives

• Develop risk intelligence processes that support timely enterprise decision-making.
• Identify emerging risks and changes in the external risk environment.
• Design indicators and escalation mechanisms that provide early warning of changing exposure.
• Synthesize interconnected risk information into actionable insight for executives and the board.

May 11, 2027 (Virtual)

Modern CRO organizations require an integrated technology ecosystem capable of supporting risk assessment, controls, monitoring, reporting, compliance and decision-making at enterprise scale. This module examines the evolving technology and tooling available to the CRO, from traditional GRC and integrated risk management platforms to data integration, continuous monitoring, analytics, automation and AI-enabled risk processes. Participants will consider how to design an effective risk technology architecture and evaluate where technology can improve efficiency, visibility, control and risk intelligence.

Key Topics

• GRC and integrated risk management platforms, workflows and capabilities
• Risk data architecture, integration, taxonomies and enterprise connectivity
• Dashboards, analytics, continuous monitoring and risk intelligence tools
• Automation, generative AI and agentic capabilities within the risk function

Learning Objectives

• Evaluate the capabilities required from modern GRC and risk technology platforms.
• Develop an integrated approach to risk data, systems and workflows.
• Identify opportunities to improve monitoring, reporting and decision support through analytics and automation.
• Assess appropriate applications, controls and oversight for AI-enabled risk-management processes.

May 18, 2027 (Virtual)

The effectiveness of the CRO ultimately depends on the ability to influence decisions, communicate risk clearly and continuously strengthen the organization’s risk capabilities. This module focuses on the CRO as an executive leader and trusted adviser to senior management and the board. Participants will examine executive communication, board reporting, effective challenge, risk culture and approaches for assessing ERM maturity and establishing a roadmap for continued improvement.

Key Topics

• Executive influence, communication and effective challenge
• Board risk reporting and decision-relevant risk communication
• ERM maturity assessment and capability benchmarking
• Risk-function transformation and continuous improvement roadmaps

Learning Objectives

• Communicate complex risk issues clearly to executives and boards.
• Develop board reporting that emphasizes insight, exposure, trends and decisions rather than risk data alone.
• Assess the maturity and effectiveness of an enterprise risk management program.
• Develop a practical roadmap for strengthening and maturing the enterprise risk function.

June 14, 2027 (In person at Carnegie Mellon)

Risk management frameworks, risk registers and response plans provide structure for managing uncertainty, but the true test of the CRO comes when a material risk becomes an actual event. At that point, information is often incomplete, conditions evolve rapidly, priorities compete, multiple stakeholders become involved, and management and the board expect decisions before certainty is possible.

This culminating, hands-on workshop places participants in the role of enterprise risk leaders responding to a rapidly evolving risk event. Through an interactive tabletop simulation, participants begin with a relatively straightforward scenario that progressively develops into a compound enterprise event involving operational disruption, cybersecurity, regulatory exposure, reputational consequences and AI-enabled misinformation. As new information and competing demands emerge, participants must assess changing conditions, establish priorities, evaluate response options and trade-offs, coordinate across organizational functions, communicate with senior leadership and the board, and adapt their response as the situation evolves.

The workshop brings together concepts from across the CRO program and challenges participants to demonstrate the judgment, leadership, communication and decision-making capabilities required when risk becomes reality.

Key Topics

• From Risk to Event — Recognizing when a monitored risk becomes an enterprise event requiring coordinated action and escalation.
• Decision-Making Under Uncertainty — Establishing priorities, evaluating trade-offs and making time-sensitive decisions with incomplete and changing information.
• Compound and Cascading Risk — Managing an event as operational, cyber, regulatory, reputational, third-party and AI/misinformation consequences emerge and interact.
• CRO Crisis Leadership — Coordinating stakeholders, advising executive leadership, communicating with the board and adapting the enterprise response as conditions change.

Learning Objectives

• Assess and prioritize rapidly evolving enterprise risks using incomplete and sometimes conflicting information.
• Evaluate response options and trade-offs while balancing business continuity, financial, regulatory, cyber, reputational and stakeholder considerations.
• Lead and coordinate an enterprise risk response across business, technology, cybersecurity, legal, compliance, communications and executive stakeholders.
• Communicate and adapt risk-based recommendations to senior management and the board as new information changes the organization’s risk exposure and response priorities.

Tabletop Structure

The exercise can unfold through a series of timed scenario injects, with each introducing new information or complications. Participants would initially receive what appears to be a manageable operational event. Subsequent injects could introduce a cyber compromise, third-party implications, regulatory notification requirements, social media attention, conflicting internal information, AI-generated misinformation or deepfake content, customer concerns, financial consequences and ultimately board-level scrutiny.

Teams would periodically be required to make decisions, document their rationale, identify what additional information they need, determine escalation and communication requirements and brief senior leadership. The exercise will conclude with a simulated board briefing and after-action review, examining not simply whether teams made the “right” decisions, but how effectively they assessed uncertainty, considered trade-offs, coordinated stakeholders, communicated risk and adapted as the situation changed.