The Governance of Risk Management: formula sheet

Key formulas

Governance versus management

Governance = who decides, oversees and is accountable; Risk management = identify, measure, monitor, control, report

Use this to separate the two terms in definition questions.

Risk management process cycle

Identify → Assess/Measure → Respond (avoid, reduce, transfer, accept) → Control → Monitor and Report → Review

The process is continuous, not one-off.

Responsibility split

Board: appetite and oversight | Risk committee: detailed review | CRO: independent risk function | Management: execution within appetite | Business lines: own risks

Most exam questions test matching a duty to the right party.

Ordering of risk concepts

Risk profile ≤ Risk tolerance (limits) ≤ Risk capacity, with risk appetite set below capacity

A common framework ordering. Check the definitions in the question, since terms are used differently across sources.

Limit utilization

Utilization = Current exposure ÷ Limit

Above 100% is a breach and must be escalated.

Risk-adjusted incentive idea

Risk-adjusted performance = Return ÷ Risk (or Return − Capital charge)

Used to link pay to risk taken, for example RAROC-style measures.

First line of defense

Business units = risk owners

They take, manage and are accountable for risk day to day within limits.

Second line of defense

Risk management + compliance = oversight and challenge

Independent of revenue generation. Designs framework, monitors, reports.

Third line of defense

Internal audit = independent assurance

Reports to the board or audit committee. Tests the first and second lines.

CRO reporting line

CRO → CEO (administrative) and CRO → board risk committee (direct access)

Dual access supports independence. Board involvement in appointment, removal and pay is a good practice.

Independence test

Risk staff pay and career ≠ dependent on the profit of the units they oversee

Conflicts of interest weaken the second line.

Quick revision

• The board holds ultimate responsibility for risk oversight and sets the firm's risk appetite.
• Risk appetite is the amount and type of risk a firm is willing to take to pursue its objectives; limits turn it into daily constraints.
• A risk appetite statement should link to strategy, capital and business plans, and be understood across the firm.
• Risk culture is the shared attitudes and behavior toward risk; tone from the top matters but is not enough alone.
• First line: business units that take risk and own it day to day.
• Second line: independent risk management and compliance that set policy, measure and challenge.
• Third line: internal audit gives independent assurance to the board on the other two lines.
• The CRO leads the risk function, needs independence and direct access to the board, and should not report only to revenue-generating heads.
• Compensation tied to short-term profit without risk adjustment encourages excess risk taking.
• Common crisis failures: weak board challenge, fragmented risk information, ignored limit breaches and poor incentives.
• Good governance needs clear accountability, escalation paths and timely, accurate risk reporting.
• Risk limits breached should be escalated and not quietly waived.

Common mistakes

• Treating risk governance and risk management as the same thing. Fix: Remember governance is the structure of authority and accountability; risk management is the process carried out within it.
• Saying the risk committee replaces the board's responsibility. Fix: The board delegates work but stays ultimately accountable for risk.
• Treating risk appetite and risk tolerance as identical. Fix: Appetite is the desired level of risk. Tolerance is the acceptable deviation or limit. Follow the definitions given.
• Thinking the RAS is only quantitative. Fix: Remember qualitative statements on risk types, conduct and reputation also belong in a RAS.
• Saying the risk management function owns the firm's risks. Fix: Ownership stays with the business (first line). The second line oversees and challenges.
• Treating internal audit as part of the second line or as a risk manager. Fix: Audit is the third line, gives independent assurance to the board, and does not manage risk or set limits. Risk management works continuously; audit tests periodically.
• Saying high pay itself caused the crisis. Fix: The problem was the structure: short-term, asymmetric pay not adjusted for risk. Fixes change timing and measures, not just size.
• Treating the CRO as reporting only to the head of a business line. Fix: Good practice gives the CRO independence from revenue units and direct access to the board or its risk committee.

Exam tips

• Expect scenario questions that hide an independence flaw in the reporting line or pay structure.
• When two answers look right, prefer the one that keeps final accountability with the board.
• Know the exact split between governance and risk management; definition questions use it.
• Learn the process cycle in order, including the feedback step.
• Watch for options that give the risk committee or CRO ownership of business risks; these are usually wrong.
• Know who does what: board approves, management implements, CRO monitors and reports independently.
• Expect scenario questions where incentives cause excess risk taking. The answer usually involves risk-adjusted pay.
• Watch for definition traps among capacity, appetite, tolerance and profile.