Skip to content

FRM Part I · FRM Exam Part I

The Governance of Risk Management for FRM Part I

Governance of risk management is the set of structures, roles and policies that decide how a firm takes, monitors and controls risk. You solve questions by identifying who owns the risk, who challenges it, who oversees it, and which governance element failed. Match each scenario to the right role or principle.

What this chapter covers

This chapter sits in Foundations of Risk Management. It explains how a firm organizes itself to take risk on purpose rather than by accident. You study the board and its committees, the risk management framework, the risk appetite statement, risk culture, the three lines of defense and the role of the Chief Risk Officer (CRO). You also see how these pieces failed in past crises.

The chapter is mostly conceptual. You will see few calculations. Questions test whether you can read a short scenario and name the correct role, responsibility or failure. Wording matters, so you need precise definitions, not a loose feel for the ideas.

It connects to the rest of the paper in several ways. Risk appetite links to VaR limits, stress testing and capital in Valuation and Risk Models. The failures covered here, such as weak oversight of trading and poor incentives, give context for the products and markets you meet in Financial Markets and Products. The same ideas return in Part II under operational risk, enterprise risk management and regulation.

Foundations of Risk Management is one of the four topic areas of FRM Part I, and governance questions are among the more approachable ones because they need clear reading rather than heavy math. With 100 equally weighted questions in 4 hours, every correct answer counts the same, so quick, secure marks here free up time for the quantitative sections. GARP publishes no pass mark, so you cannot afford to leave easy points behind. The material is also useful at work, since it describes the structures you see in real banks and asset managers.

The Governance of Risk Management: topics in the order to study them

  1. 1Risk Governance and Risk Management FrameworkStart here because it sets the vocabulary: board oversight, committees, policies and the process of identifying, measuring, monitoring and controlling risk.
  2. 2Risk Appetite Statement and Risk CultureNext, learn how the board turns its willingness to take risk into limits and behavior, since this builds directly on the framework.
  3. 3Three Lines of Defense and the Role of the CROOnce you know the framework and appetite, you can place each function: business units, risk and compliance, and internal audit, with the CRO linking them to the board.
  4. 4Governance Failures and Lessons from Financial CrisesFinish with the case lessons. They only make sense once you know what good governance looks like, and they work as a final test of the earlier topics.

How to prepare The Governance of Risk Management

Treat this as a reading-and-recall chapter. Your goal is to give each role and concept a crisp definition and a typical exam scenario.

  1. Read the GARP curriculum reading for each topic once, quickly, to see the structure before you memorize anything.
  2. Build a one-page map: board, risk committee, CRO, three lines, with who reports to whom and who owns which decision.
  3. Write your own one-sentence definitions for risk appetite, risk tolerance, risk limits and risk culture, and note how they differ.
  4. For each line of defense, list two or three typical activities. Then practice sorting sample tasks into the right line.
  5. Study each crisis failure as a pattern: what broke (incentives, oversight, information flow, independence) and which governance fix addresses it.
  6. Do practice questions in small sets on your phone. For every miss, write down the exact word in the question that you misread.
  7. Revisit the map a few days before the exam and test yourself from memory.

Common mistakes in The Governance of Risk Management

  • Confusing risk appetite with risk tolerance and risk limits.

    Fix: Use GARP's wording: appetite is the broad level of risk the firm will accept, tolerance and limits are the more specific boundaries that put it into practice.

  • Placing a function in the wrong line of defense.

    Fix: Anchor each line to what it does: owns risk, oversees and challenges, or gives independent assurance. Practice sorting tasks.

  • Assuming the CRO is responsible for taking risk decisions for the business.

    Fix: Remember the first line owns risk. The CRO provides independent oversight, measurement and challenge, and reports to the board.

  • Treating risk culture as just a written policy.

    Fix: Think behavior: incentives, escalation, willingness to challenge and how breaches are handled.

  • Memorizing crisis stories without the governance lesson.

    Fix: For each failure, write the lesson in one line, such as independence, incentives or information flow, since questions test the lesson.

  • Skipping this chapter because it has no calculations.

    Fix: Give it a few short, regular sessions. These marks are the most efficient ones to secure.

Last-day revision: The Governance of Risk Management

  • The board holds ultimate responsibility for risk oversight and sets the firm's risk appetite.
  • Risk appetite is the amount and type of risk a firm is willing to take to pursue its objectives; limits turn it into daily constraints.
  • A risk appetite statement should link to strategy, capital and business plans, and be understood across the firm.
  • Risk culture is the shared attitudes and behavior toward risk; tone from the top matters but is not enough alone.
  • First line: business units that take risk and own it day to day.
  • Second line: independent risk management and compliance that set policy, measure and challenge.
  • Third line: internal audit gives independent assurance to the board on the other two lines.
  • The CRO leads the risk function, needs independence and direct access to the board, and should not report only to revenue-generating heads.
  • Compensation tied to short-term profit without risk adjustment encourages excess risk taking.
  • Common crisis failures: weak board challenge, fragmented risk information, ignored limit breaches and poor incentives.
  • Good governance needs clear accountability, escalation paths and timely, accurate risk reporting.
  • Risk limits breached should be escalated and not quietly waived.

The Governance of Risk Management practice questions

The Governance of Risk Management in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

The Governance of Risk Management: frequently asked questions

Is The Governance of Risk Management a calculation-heavy chapter?

No. It is mostly conceptual, with scenario-based multiple-choice questions on roles, responsibilities and failures. You need precise definitions and the ability to apply them to a short case.

How long should I spend on this chapter?

Less than on the quantitative topics, but do not skip it. A few focused sessions plus regular practice questions usually work, and you can adjust based on your background in banking or risk.

Do I need to memorize specific crisis case details?

Know the main governance lessons and the pattern behind each failure rather than every detail. Questions usually ask what went wrong in governance terms or which control would have helped.

How does this chapter link to the rest of FRM Part I?

Risk appetite connects to limits, VaR and stress testing in Valuation and Risk Models. The failures give context for products and markets, and the ideas return in Part II.