FRM Exam Part I · Operational Risk

Operational Risk Governance and Frameworks for FRM Part I

Updated 11 October 2026 · Fact-checked

Operational risk governance is the set of structures, roles and policies that make a bank identify, assess, monitor and control losses from failed people, processes, systems or external events. The three lines of defense split ownership: business units own risk, independent risk and compliance oversee it, and internal audit gives assurance. The board sets risk appetite.

Understand Operational Risk Governance and Frameworks

Operational risk is the risk of loss from inadequate or failed internal processes, people and systems, or from external events. Basel includes legal risk and excludes strategic and reputational risk. Governance answers one question: who is responsible for managing it, and how does the board know it is working?

The three lines of defense model gives the answer. The first line is the business units and their support functions. They take the risk, so they own it and must identify, assess and control it daily. The second line is an independent operational risk management function (and compliance). It designs the framework, challenges the first line, monitors and reports. The third line is internal audit. It independently reviews whether the framework and both other lines work, and it reports to the board or audit committee.

The board of directors approves and periodically reviews the operational risk framework and the risk appetite and tolerance statement. Senior management turns that into policies, clear responsibilities, resources and consistent implementation across the bank. Risk appetite is the level and type of risk the bank is willing to accept. Tolerance is the allowed variation around it, often expressed as limits or triggers such as loss thresholds, key risk indicators (KRIs) and incident counts.

The Basel Committee's principles for the sound management of operational risk (revised in 2021) are grouped by theme. They cover a strong risk culture and a code of conduct, an operational risk management framework that is fully integrated into overall risk management, board oversight, risk appetite and tolerance, senior management responsibility, identification and assessment (using tools such as risk control self-assessment, loss data, scenario analysis and KRIs), change management, monitoring and reporting, control and mitigation, business resilience and continuity, and disclosure. Treat the principles as a checklist of what a good framework contains.

The exam rarely asks for numbers here. It asks you to match a task to a line of defense, to say who owns what, or to spot which principle a bank has breached. Keep roles clean and independence in mind.

Key formulas to remember

Three lines of defense: 1st line = own and manage risk | 2nd line = oversee, challenge, frame | 3rd line = independent assurance; Internal audit is always the third line. The risk function must stay independent of the business it oversees.
Board vs management: Board = approves framework and risk appetite | Senior management = implements and resources it; Board approves and oversees. It does not run day-to-day controls.
Risk appetite vs tolerance: Appetite = amount and type of risk accepted | Tolerance = acceptable deviation, set through limits, KRIs and triggers; Appetite is broad and strategic. Tolerance is operational and measurable.
Core framework tools: Identify and assess: RCSA, loss data, scenario analysis, KRIs | Respond: control, mitigate, transfer, avoid, accept; Remember them as the toolkit behind the Basel identification and assessment principle.

How to solve Operational Risk Governance and Frameworks questions

Use this method for any governance or framework question, whether it asks about roles, appetite or Basel principles.

1Read the stem and underline the activity described (for example, owns the risk, challenges, tests controls, approves appetite).
2Decide whose job that activity is: board, senior management, first line, second line or third line.
3Check independence. Anything independent of the business and reviewing everything is audit or the second line, not the first.
4Separate design from assurance. Designing and monitoring the framework is the second line. Testing whether it works is the third.
5Match to the Basel theme if a principle is cited: culture, framework, board, appetite, management, identification, change, monitoring, control, resilience or disclosure.
6Eliminate options that give the board day-to-day duties, or give audit ownership of risk.
7Pick the answer that keeps ownership in the first line and oversight independent.

Quickest way: Role-matching shortcut

When to use it: Use it when the question asks who is responsible for something, or which line a function belongs to.

Ask: does this function take the risk? If yes, first line.
Ask: does it set standards, challenge or report on risk but not take it? Second line.
Ask: does it independently give assurance to the board? Third line (internal audit).
Ask: does it approve appetite or the framework? Board. Does it implement it? Senior management.
Choose the option that matches and drop any that blur two roles.

Common mistakes in Operational Risk Governance and Frameworks

Putting the operational risk management function in the first line.
It sits inside the bank and works closely with business units, so it feels like part of the business.
Fix: It is the independent second line. The first line is the business and its support functions, which own the risk.
Saying internal audit owns or manages operational risk controls.
Audit reviews controls, so students assume it runs them.
Fix: Audit gives independent assurance as the third line. It does not own risk or design day-to-day controls.
Treating risk appetite and risk tolerance as the same thing.
Textbooks and banks often use the terms loosely together.
Fix: Appetite is the type and level of risk accepted. Tolerance is the permitted deviation, set through limits and KRIs.
Thinking the board manages operational risk daily.
Students overstate board responsibility.
Fix: The board approves and reviews the framework and appetite and provides oversight. Senior management implements.
Believing operational risk includes strategic and reputational risk.
Operational failures often cause reputational damage, which blurs the definition.
Fix: The Basel definition includes legal risk but excludes strategic and reputational risk, though operational events can trigger them.

Worked examples

Example 1

A bank's independent operational risk function reviews a trading desk's risk and control self-assessment, challenges the ratings, and reports aggregate results to the executive risk committee. Which statement best describes this function?

Show the solution

The activity is challenging and reporting on risk, not taking it.
The function is independent of the desk, so it is not the first line.
It is not providing assurance on the whole framework to the board, which is the audit role.
So it acts as the second line of defense.

Answer: It is the second line of defense: independent oversight and challenge of the first line's risk assessments.

Example 2

Which of the following is the responsibility of the board of directors under sound operational risk governance? (A) Performing daily reconciliations (B) Approving and periodically reviewing the operational risk framework and risk appetite (C) Testing control effectiveness independently (D) Recording loss events in the incident database

Show the solution

Daily reconciliations are a first-line control activity, so A is wrong.
Independent testing of controls is internal audit, the third line, so C is wrong.
Recording loss events is carried out by the business units and the second line, so D is wrong.
The board approves and reviews the framework and appetite, so B is correct.

Answer: B

Exam tips

Learn each function's verb: first line owns, second line challenges and designs, third line assures, board approves, management implements.
When a question stresses independence or reporting to the audit committee, the answer is usually internal audit.
Questions on Basel principles are usually conceptual. Match the scenario to the theme, such as culture, appetite or reporting, instead of recalling principle numbers.
Watch for answers that blur lines, such as the business policing itself. These are usually the wrong choices.

Practice questions from Operational Risk

Operational Risk Governance and Frameworks in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Operational Risk Governance and Frameworks: frequently asked questions

What are the three lines of defense in operational risk?

The first line is the business units, which own and manage risk. The second line is the independent risk management and compliance functions, which oversee and challenge. The third line is internal audit, which provides independent assurance to the board.

What is the difference between risk appetite and risk tolerance?

Risk appetite is the amount and type of risk a bank is willing to accept to meet its objectives. Risk tolerance is the acceptable variation around that appetite, usually expressed through limits, KRIs and triggers.

Do I need to memorise the Basel principles for sound management of operational risk?

You need the themes and what they require, not exact numbering. Know that they cover culture, framework, board and management roles, appetite, identification and assessment, monitoring, control, resilience and disclosure.

Is this topic calculation-heavy in FRM Part I?

No. It is mostly conceptual and tests roles, responsibilities and framework components. Use the time you save for quantitative questions elsewhere in the 100-question exam.