Skip to content

FRM Exam Part I · The Governance of Risk Management

Governance Failures and Lessons from Financial Crises

Updated 11 October 2026 · Fact-checked

Governance failures are breakdowns in how a firm's board, management and control functions oversee risk. In the 2007-2009 crisis they included weak board oversight, pay that rewarded short-term risk taking, and poor risk reporting. To answer exam questions, name the failure, link it to its effect, then state the remedy.

Understand Governance Failures and Lessons from Financial Crises

Governance is the system of oversight, incentives and accountability that decides how much risk a firm takes and who checks it. If the system is weak, even good models and good people cannot stop a firm from taking risks it cannot bear.

The 2007-2009 crisis exposed several recurring weaknesses. Board oversight was often poor: many boards lacked risk expertise, did not challenge management, and approved strategies without understanding the risks inside them. Risk management was weak in status: in some firms the risk function had little authority against revenue-generating business lines, and risk officers had limited access to the board.

Compensation misalignment was a central theme. Bonuses were often tied to short-term revenue or profit and paid in cash up front. Traders and managers shared in gains but not in later losses. This is a one-way payoff, similar to holding a call option, and it encourages taking more risk. Profits booked today could reverse years later, after the bonus was paid.

Weak risk reporting and data were another failure. Firms could not quickly aggregate exposures across business lines, so management did not see concentrations such as total exposure to subprime mortgages. Reports were also too technical or too backward-looking for boards to use. Other weaknesses included over-reliance on models and external ratings, silos between units, and unclear risk appetite.

The lessons that followed: give the board real risk expertise and a risk committee; give the Chief Risk Officer independence, seniority and direct board access; set and enforce a clear risk appetite; align pay with risk through deferral, clawback and payment in equity; and improve data aggregation and timely, readable risk reporting. Regulators turned many of these into formal expectations.

How to solve Governance Failures and Lessons from Financial Crises questions

Governance questions are conceptual. Use the same sequence every time so you do not mix up causes, effects and remedies.

  1. 1Read the scenario and identify the governance area involved: board oversight, risk function authority, compensation, or risk reporting and data.
  2. 2Name the specific failure in standard terms, for example short-term bonus tied to revenue or no direct CRO access to the board.
  3. 3Link it to the risk behaviour it causes, such as excess risk taking, ignored limits or hidden concentrations.
  4. 4Match the remedy to the failure: deferral and clawback for pay, independent CRO for authority, risk committee for board oversight, data aggregation for reporting.
  5. 5Check each option for absolute words like always or never, and for remedies that fix a different problem.
  6. 6Pick the option that fits the failure, its effect and its remedy together.

Quickest way: Failure-to-fix matching

When to use it: Use for short MCQs asking which action best addresses a stated weakness, or which weakness a scenario shows.

  1. Reduce the scenario to one keyword: pay, board, CRO, data, or appetite.
  2. Recall the paired fix: pay → deferral, clawback, long-term measures; board → risk expertise and committee; CRO → independence and board access; data → aggregation and timely reports.
  3. Eliminate options that fix a different area, even if they sound sensible.
  4. Choose the option that targets the root cause, not just the symptom.

Common mistakes in Governance Failures and Lessons from Financial Crises

  • Saying high pay itself caused the crisis.

    Headlines stressed bonus size.

    Fix: The problem was the structure: short-term, asymmetric pay not adjusted for risk. Fixes change timing and measures, not just size.

  • Treating the CRO as reporting only to the head of a business line.

    Students confuse the reporting line with day-to-day work.

    Fix: Good practice gives the CRO independence from revenue units and direct access to the board or its risk committee.

  • Blaming models alone and ignoring governance.

    Quantitative students focus on VaR flaws.

    Fix: Models failed partly because management and boards over-relied on them and did not challenge assumptions. That is a governance failure.

  • Confusing deferral with clawback.

    Both delay or reduce pay.

    Fix: Deferral delays payment of part of a bonus. Clawback lets the firm recover pay already paid if losses or misconduct appear later.

  • Proposing more reports as the fix for weak reporting.

    More seems better.

    Fix: The issue was aggregation, accuracy, timeliness and clarity. Fewer, clearer, firm-wide reports serve the board better.

Worked examples

Example 1

A bank pays traders a large cash bonus each year based on that year's trading revenue. After the crisis, losses appear on positions opened years earlier. Which change best reduces the incentive problem? (A) Pay bonuses quarterly (B) Defer part of the bonus, pay part in equity, and allow clawback (C) Increase base salary only (D) Base the bonus on trading volume

Show the solution
  1. Identify the failure: pay is tied to short-term revenue and paid in cash, so traders keep gains but do not bear later losses.
  2. Effect: it encourages excess risk taking, with profits booked now and losses arriving later.
  3. Test (A): quarterly payment makes the horizon even shorter. Reject.
  4. Test (C): higher fixed pay lowers risk-taking incentives somewhat but does not link pay to long-term outcomes. It is not the best fix.
  5. Test (D): volume rewards activity, not risk-adjusted results. Reject.
  6. Test (B): deferral, equity payment and clawback make pay depend on outcomes that emerge later. This matches the failure.

Answer: (B)

Example 2

After a loss, a review finds that the board never saw total firm-wide exposure to one type of mortgage asset, because each business line reported separately in different formats. Identify the governance weakness and the main remedy.

Show the solution
  1. The board lacked a combined view of exposure. This points to risk reporting and data aggregation, not compensation.
  2. Silos also played a role: units did not share consistent data.
  3. The effect is hidden concentration, so risk limits could not be enforced at firm level.
  4. Remedy: build the capability to aggregate risk data across the firm, standardise definitions, and produce timely, clear reports for the board and senior management.
  5. Support this with a CRO who has firm-wide responsibility and direct access to the board.

Answer: The weakness is poor risk data aggregation and reporting, with silos hiding a concentration. The remedy is firm-wide data aggregation, consistent reporting and a CRO with firm-wide authority and board access.

Exam tips

  • Expect scenario questions: you are given a symptom and must choose the weakness or the fix. Practise the failure-to-fix pairing.
  • Watch for options that are true statements but answer a different problem, such as a pay fix offered for a reporting failure.
  • Treat absolute wording like always or only with suspicion.
  • Link this topic to risk appetite, the three lines of defense and BCBS 239, since questions often mix them.

Practice questions from The Governance of Risk Management

Governance Failures and Lessons from Financial Crises in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Governance Failures and Lessons from Financial Crises: frequently asked questions

What were the main governance failures in the 2007-2009 crisis?

Common themes were weak board oversight, a risk function with limited authority, compensation that rewarded short-term risk taking, poor risk data and reporting, and over-reliance on models and ratings. Exam questions usually test whether you can match each failure to its effect and remedy.

How does compensation affect risk taking in FRM Part I?

If bonuses reward short-term gains but do not penalise later losses, staff gain from upside and bear little downside, so they take more risk. Remedies include deferral, payment in equity, clawback and measures adjusted for risk.

Why does the CRO need independence?

A CRO who answers to revenue-focused management may be overruled or ignored. Independence and direct access to the board let the CRO challenge risk taking and escalate concerns.

Is this topic calculation based?

No. It is conceptual, so questions test recognition of failures and the best remedies. Learn the pairings and read each option carefully.