FRM Part II · FRM Exam Part II

Risk Governance: formula sheet

Full chapter guide

Key formulas

First line role: Business units = risk ownership + day-to-day control; They identify, assess, manage and report risk within limits and appetite.
Second line role: Risk management and compliance = framework + oversight + challenge; Independent of the business. Sets policy, monitors limits, aggregates and reports risk.
Third line role: Internal audit = independent assurance to the board; Reviews the first and second lines and the framework. Does not own risk or design business controls.
Independence rule: Independence rises from line 1 to line 3; Audit has the highest independence and reports to the board or its audit committee.
Cascade order: Strategy → Risk appetite → Risk tolerance → Risk limits and triggers → Business decisions; Each level is more granular. Limits must be consistent with, and usually tighter than, tolerance.
Limit headroom: Headroom = Limit − Current exposure (or metric); Negative headroom means a breach that must be escalated. Compare it with the tolerance boundary as well.
Utilisation: Utilisation (%) = Current exposure ÷ Limit × 100; Used for early warning. Amber and red triggers are often set at set percentages of the limit.
Risk capacity vs appetite: Risk appetite ≤ Risk tolerance boundary ≤ Risk capacity; Risk capacity is the maximum risk the firm can bear before breaching capital, liquidity or regulatory constraints. Appetite must sit inside it.
Culture chain: Tone from the top → incentives and accountability → staff behavior → operational risk outcomes; Use this chain to answer scenario questions. Find where it breaks.
Sound pay design features: Risk-adjusted metrics + deferral + clawback/malus + part paid in equity or long-term instruments; Aims to align pay with long-term risk, not just current-year profit.
Control-function pay rule: Pay of control staff must be independent of the performance of the business they monitor; Protects the independence of risk, compliance and audit.
Three lines of defense: 1st line: owns risk | 2nd line: oversight and challenge | 3rd line: independent assurance; Confusing the lines is a common error.
Operational risk definition (Basel): Operational risk = loss from inadequate or failed internal processes, people and systems, or from external events; Includes legal risk. Excludes strategic and reputational risk.
Three lines of defense: 1st: business line management | 2nd: independent operational risk function | 3rd: independent review or audit; The second line challenges the first. The third line gives independent assurance on both.
Board vs senior management: Board: approves framework, appetite and tolerance | Senior management: implements and reports; A common trap is mixing these roles.
Operational resilience: Resilience = ability to deliver critical operations through disruption, within tolerance for disruption; Applies to any cause of disruption, not just cyber.
Resilience building blocks: Identify critical operations → set tolerance → map dependencies → test severe but plausible scenarios → manage incidents; Use as a checklist when judging answer options.
BCBS 239 data quality attributes: Accuracy and integrity | Completeness | Timeliness | Adaptability; These are the risk data aggregation capability principles. Match each failure in a case to one attribute.
BCBS 239 reporting attributes: Accuracy | Comprehensiveness | Clarity and usefulness | Frequency | Distribution; These are the risk reporting practice principles. Distribution means the right reports reach the right people securely.
COSO internal control components: Control environment | Risk assessment | Control activities | Information and communication | Monitoring activities; Five components. Tone at the top and integrity sit in the control environment.
Three lines of defense: 1st: business owns risk | 2nd: risk and compliance oversee | 3rd: internal audit assures; Audit must stay independent of the first two lines and report to the board or its audit committee.
Control types: Preventive | Detective | Corrective; Preventive stops the error (segregation of duties). Detective finds it (reconciliation). Corrective fixes it (remediation).

Quick revision

Governance sets who owns, limits, monitors and reports operational risk.
The board approves the framework and risk appetite; management implements it.
First line owns and manages risk in day-to-day business activity.
Second line provides independent oversight, challenge and the risk framework.
Third line is independent internal audit assurance to the board.
Risk appetite is the broad level of risk the firm is willing to accept to pursue its objectives.
Risk tolerance is a more specific, measurable boundary around that appetite.
Tone from the top matters, but incentives decide behavior in practice.
Pay tied only to short-term results can encourage excessive risk taking.
Good reporting is timely, accurate, and sent to the right level with action owners.
Internal controls should be tested, and weaknesses tracked until fixed.
In a case, find the failing element first: role, limit, culture, data or control.

Common mistakes

Giving the board responsibility for daily operational controls. Fix: Remember the board approves and oversees. Management runs the framework day to day.
Saying the operational risk function owns the risks. Fix: The first line owns and manages risk. The second line designs the framework and challenges.
Saying risk management owns the risk. Fix: The business owns risk. Risk management oversees and challenges.
Placing compliance in the first line. Fix: Compliance is a second line function. Its role is oversight, even if staff are located near the business.
Treating risk appetite and risk tolerance as identical Fix: In exams, appetite is the broad level and types of risk sought. Tolerance is the acceptable variation, expressed as a boundary on a metric.
Thinking a limit and a tolerance are the same number Fix: Limits are operational and normally tighter than tolerance, giving early warning before the tolerance is breached.
Treating risk culture as the same as written policy Fix: Remember culture is actual behavior. A strong policy with weak behavior is a weak culture.
Saying tone from the top means only the CEO's speeches Fix: Tone is shown by decisions, promotions, pay and how breaches are handled. Actions outweigh words.
Treating the business line as a customer of the risk function rather than the owner of risk Fix: Remember the first line owns and manages its risks. The second line sets standards and challenges.
Giving the board the job of implementing controls Fix: The board approves and reviews the framework and appetite. Senior management implements it.

Exam tips

Memorize the verb map: approve, implement, own, challenge, assure.
Expect case questions where a loss traces back to culture or unclear ownership; pick the governance fix, not a technical one.
Watch for options that break independence between lines.
Know that risk appetite is approved by the board and cascaded by management.
Use precise Basel-style wording: sound practice expects a documented, board-approved framework.
Match the verb to the line: own and manage is line 1, oversee and challenge is line 2, assure is line 3.
Look for independence clues such as reporting lines and compensation. They often decide the answer.
In failure cases, ask which line should have caught the issue first. Usually it starts with the first line.