FRM Exam Part I · The Governance of Risk Management

Three Lines of Defense and the Role of the CRO

Updated 11 October 2026 · Fact-checked

The three lines of defense model splits risk duties among three groups. The first line, business units, owns and manages risk. The second line, risk management and compliance, oversees and challenges. The third line, internal audit, gives independent assurance. The CRO leads the second line and needs independence and access to the board.

Understand Three Lines of Defense and the Role of the CRO

Start with a simple question: who is responsible for risk in a bank? The answer is not one person or one department. The three lines of defense model spreads the job across three groups so that no group checks only its own work.

The first line is the business: traders, lenders, and the front-office and operations staff who take risk. They own the risk. They must identify it, measure it, and keep it within the limits and policies the firm has set. Risk ownership never moves to the risk department.

The second line is the independent risk management function, usually together with compliance. It designs the risk framework, sets or proposes limits, monitors exposures, challenges the first line, and reports to senior management and the board. It must be independent of revenue generation. If risk staff are paid mainly on trading profit, the checks lose their value.

The third line is internal audit. It gives the board and audit committee independent assurance that the framework, controls and governance work as designed. It reviews both the first and second lines. It does not manage risk day to day and it does not set limits. Audit looks back and tests; risk management works continuously and looks forward.

The chief risk officer (CRO) heads the risk management function. The CRO is a senior executive who is responsible for the firm-wide risk framework, for aggregating and reporting risk across the firm, and for advising the board and the CEO. Good practice has the CRO report to the CEO and also have a direct, unfiltered line to the board's risk committee. The CRO should have enough seniority and stature to challenge business heads. Removal or appointment should involve the board, so that the CRO cannot be silenced by the people being overseen.

Key formulas to remember

First line of defense: Business units = risk owners; They take, manage and are accountable for risk day to day within limits.
Second line of defense: Risk management + compliance = oversight and challenge; Independent of revenue generation. Designs framework, monitors, reports.
Third line of defense: Internal audit = independent assurance; Reports to the board or audit committee. Tests the first and second lines.
CRO reporting line: CRO → CEO (administrative) and CRO → board risk committee (direct access); Dual access supports independence. Board involvement in appointment, removal and pay is a good practice.
Independence test: Risk staff pay and career ≠ dependent on the profit of the units they oversee; Conflicts of interest weaken the second line.

How to solve Three Lines of Defense and the Role of the CRO questions

Most questions on this topic ask you to place a duty in the right line, or to judge whether a CRO arrangement supports independence. Use the same method each time.

1Read the scenario and list who does what: who takes the risk, who monitors it, who tests the controls.
2Label each actor as first line (owns risk), second line (oversees and challenges) or third line (independent assurance).
3Check the verb. Owns, manages, takes means first line. Sets framework, monitors, challenges, aggregates means second line. Reviews, tests, assures means third line.
4Check independence: reporting line, pay linkage, seniority and access to the board.
5Identify any breach, such as risk staff reporting to the head of trading, or audit setting limits.
6Eliminate options that move risk ownership away from the business or give audit a management role.
7Pick the answer that keeps ownership in the first line and preserves independence of the second and third.

Quickest way: Verb and reporting-line check

When to use it: Use this on any multiple-choice question that asks which line performs a task or which CRO arrangement is best.

Find the key verb: own or manage (line 1), oversee or challenge (line 2), assure or audit (line 3).
Find the reporting line: a CRO reporting only to the CFO or head of business is a red flag.
Reject any option where risk ownership sits with risk management.
Reject any option where audit performs routine risk management.
Choose the option that keeps the CRO independent with access to the board.

Common mistakes in Three Lines of Defense and the Role of the CRO

Saying the risk management function owns the firm's risks.
The name suggests the department is responsible for all risk.
Fix: Ownership stays with the business (first line). The second line oversees and challenges.
Treating internal audit as part of the second line or as a risk manager.
Both review risk, so the roles seem similar.
Fix: Audit is the third line, gives independent assurance to the board, and does not manage risk or set limits. Risk management works continuously; audit tests periodically.
Placing compliance in the first line.
Compliance staff sit close to the business.
Fix: Compliance is normally second line because it oversees adherence to rules and is independent of revenue.
Accepting a CRO who reports only to the head of a business or to the CFO.
Candidates focus on seniority and miss the conflict.
Fix: Look for reporting to the CEO plus direct access to the board risk committee, with the board involved in appointment and removal.
Thinking independence means the CRO is cut off from the business.
Independence is confused with isolation.
Fix: The second line must understand the business and work with it, but it must not depend on business profit for pay or career.

Worked examples

Example 1

A bank's trading desk breaches its approved VaR limit. A separate team monitors limits daily and escalates the breach to the CRO. Later, a team reports to the audit committee on whether the escalation process worked as designed. Identify the line of defense of each party.

Show the solution

The trading desk takes and manages the risk and must stay within limits, so it is the first line.
The team that monitors limits daily and escalates breaches oversees and challenges, so it is the second line (risk management).
The team that reports to the audit committee on whether the process worked gives independent assurance, so it is the third line (internal audit).

Answer: Trading desk: first line. Limit monitoring team and CRO: second line. Team reporting to the audit committee: third line.

Example 2

Which arrangement best supports the independence of the CRO? A) CRO reports to the head of trading and is paid a bonus based on trading profit. B) CRO reports to the CEO, has direct access to the board risk committee, and the board approves appointment and removal. C) CRO reports only to the CFO and is not involved in board meetings. D) CRO is part of internal audit and also approves trades.

Show the solution

Test each option for conflict of interest and board access.
A: reporting to trading and profit-linked pay creates a direct conflict, so reject.
C: reporting only to the CFO and no board involvement limits access, so reject.
D: mixes the third line with first-line trade approval, so reject.
B: reports to the CEO, has direct board access, and board control of appointment and removal protect against pressure.

Answer: B

Exam tips

Memorize one verb per line: own, oversee, assure. Most questions reduce to matching a verb.
Expect scenarios that describe a governance failure; find which line was missing or compromised.
For CRO questions, look for seniority, board access, and independence from revenue-based pay.
Watch for options that say risk management is responsible for all risk. That is almost always wrong.
Be ready to contrast internal audit and risk management: audit is independent assurance, risk management is ongoing oversight.

Practice questions from The Governance of Risk Management

Three Lines of Defense and the Role of the CRO in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

FRM Part IIThree Lines of Defense Model

Three Lines of Defense and the Role of the CRO: frequently asked questions

What is the difference between internal audit and the risk management function?

Risk management is the second line. It sets the framework, monitors exposures and challenges the business on an ongoing basis. Internal audit is the third line. It independently tests whether the framework and controls work, and reports to the board or audit committee.

Who owns risk in the three lines of defense model?

The first line, the business units, owns risk. They take it and manage it within set limits. The second line oversees and challenges, but it does not take over ownership.

Who should the CRO report to?

Good practice is for the CRO to report to the CEO and to have direct access to the board risk committee. This protects the CRO from pressure by the business units being overseen.

Why does the independence of the risk function matter?

Risk staff must be able to challenge profitable activity without fear for their pay or career. If their rewards depend on the profit of the units they oversee, warnings may be softened or ignored.