FRM Exam Part II · Case Study: Investor Protection and Compliance Risks in Investment Activities

Controls, Governance and Operational Resilience in Investment Firms

Updated 11 October 2026 · Fact-checked

Compliance and conduct losses fall when a firm combines board-led governance, clear three-lines-of-defense roles, monitoring and trade surveillance, training, and protected whistleblowing. In exam questions, match each control to the failure it prevents or detects, then judge whether it is preventive, detective or corrective and whether it is independent.

Understand Controls, Governance and Operational Resilience

Compliance risk is the risk of legal or regulatory sanctions, financial loss or reputational damage when a firm fails to follow laws, rules and standards. In investment activities, the damage often comes from conduct: mis-selling, insider trading, market manipulation, conflicts of interest and weak client protection. Controls exist to stop these events or catch them early.

Start with governance. The board sets the firm's risk appetite and the tone at the top. Senior management turns that into policies, resources and consequences for breaches. A strong compliance culture means staff follow the spirit of the rules, not only the letter. Pay, promotion and discipline must reward good conduct. If bonuses reward sales volume only, culture weakens.

Next, the three lines of defense. The first line is the business, which owns the risk and runs day-to-day controls. The second line is compliance and risk management, which sets standards, advises and monitors. The third line is internal audit, which gives independent assurance to the board. Weak independence or unclear ownership is a frequent root cause in case studies.

Controls fall into types. Preventive controls stop a breach before it happens, such as pre-trade limits, restricted lists, suitability checks and segregation of duties. Detective controls find breaches after or as they occur, such as trade surveillance, which runs rules and alerts on orders and trades to spot patterns like spoofing, front-running, wash trades or insider dealing. Analysts review alerts, escalate real cases and record the outcome. Too many false positives overload staff, so alerts need tuning.

People controls complete the picture. Training builds awareness and must be role-specific and repeated. Whistleblowing gives staff a safe channel to report misconduct, with confidentiality and protection from retaliation. Operational resilience is the ability to keep delivering critical services through disruption. For compliance it means surveillance, records and reporting systems keep working, and breaches are reported and remediated quickly.

Key formulas to remember

Three lines of defense: 1st line = owns and manages risk; 2nd line = oversight and challenge; 3rd line = independent assurance; Internal audit sits in the third line. Compliance sits in the second line.
Control types: Preventive (before) | Detective (during or after) | Corrective (fix and learn); Surveillance is detective. Pre-trade limits and restricted lists are preventive.
Surveillance cycle: Data capture → rule or model alert → analyst review → escalation → regulator reporting if required → tuning; Poor data or unmonitored channels create blind spots.
Whistleblowing essentials: Confidential channel + protection from retaliation + independent investigation + board visibility; Missing any element reduces staff willingness to report.
Culture test: Tone at the top + incentives aligned with conduct + accountability for breaches; Written policy alone is not a strong culture.

How to solve Controls, Governance and Operational Resilience questions

Use this method for any scenario question on compliance controls, governance or resilience.

1Identify the failure or risk in the case: mis-selling, manipulation, insider dealing, conflict of interest or a reporting breach.
2Find the root cause: governance gap, weak incentives, missing control, poor data, low independence or ignored warnings.
3Classify each control mentioned as preventive, detective or corrective, and as first, second or third line.
4Match the control to the failure. For example, order-pattern abuse needs surveillance; mis-selling needs suitability checks and incentive review.
5Check independence and escalation: does the reviewer report outside the business, and does the board see the issue?
6Check people controls: training relevance, and whether staff can report safely.
7Choose the option that fixes the root cause, not just the symptom.
8Reread the question stem for words like best, first or most effective.

Quickest way: Failure to control match

When to use it: When you have about a minute per question and four plausible options.

Underline the failure in the stem.
Ask: is the need to prevent, detect or fix?
Eliminate options that are the wrong type or wrong line of defense.
Eliminate options where the business polices itself with no independent challenge.
Pick the option addressing governance or incentives if the stem hints at culture.

Common mistakes in Controls, Governance and Operational Resilience

Treating internal audit as part of the second line.
Both audit and compliance review controls, so they seem alike.
Fix: Audit is the third line and gives independent assurance to the board. Compliance and risk are second line.
Calling trade surveillance a preventive control.
It sounds protective.
Fix: Surveillance mostly detects misconduct after or as trades happen. Pre-trade limits and blocks are preventive.
Believing a written code of conduct creates a good culture.
Policies are visible and easy to cite.
Fix: Culture depends on tone at the top, incentives and consequences. Look for how behavior is rewarded and punished.
Assuming more alerts mean better surveillance.
More output feels like more coverage.
Fix: Too many false positives hide real cases. Good surveillance tunes thresholds and tests coverage.
Ignoring whistleblower protection when assessing a channel.
Students focus on having a hotline.
Fix: A hotline works only with confidentiality, anti-retaliation protection and independent investigation.
Treating operational resilience as only disaster recovery.
Business continuity is the familiar term.
Fix: Resilience covers critical services, dependencies, third parties and the ability to keep controls and reporting running through disruption.

Worked examples

Example 1

An investment firm pays relationship managers mostly on product sales volume. A review finds many retail clients hold products unsuitable for their risk profile. The compliance team reports to the head of sales. Which change best addresses the root cause?

Show the solution

Failure: mis-selling and weak suitability, a conduct and investor-protection issue.
Root causes: incentives reward volume, and compliance lacks independence from the business.
Training alone or a new hotline would not remove the incentive to oversell.
Best fix: change pay to include conduct and suitability measures, and have compliance report independently to senior management and the board.

Answer: Realign incentives to conduct and make compliance independent of sales, with board oversight.

Example 2

A bank's surveillance system flags a trader who repeatedly places large orders and cancels them within seconds before trading the other side. Classify the control, name the likely abuse, and state the next step.

Show the solution

The system reviews trades and orders after or as they occur, so it is a detective control.
Placing and cancelling large orders to move prices, then trading the other side, matches spoofing, a form of market manipulation.
Next step: an analyst reviews the alert with order data and communications, then escalates to compliance.
If confirmed, the firm follows its process for discipline and regulatory reporting, then tunes rules to capture similar patterns.

Answer: Detective control; likely spoofing; analyst review, escalation to compliance, and regulatory reporting if confirmed.

Exam tips

Always label the control as preventive, detective or corrective, and as first, second or third line.
When the stem mentions bonuses or pressure to hit targets, think culture and incentives before technical fixes.
Prefer options with independence and board escalation over business self-checks.
For whistleblowing, look for confidentiality, anti-retaliation and independent investigation together.
Watch for best or first in the stem. Several options may be good, but one fixes the root cause.

Practice questions from Case Study: Investor Protection and Compliance Risks in Investment Activities

Controls, Governance and Operational Resilience: frequently asked questions

What is the role of the board in compliance culture?

The board sets risk appetite and the tone at the top, and holds senior management accountable. It receives independent reporting from compliance, risk and audit. Senior management then builds policies, resources and incentives that support the culture.

How does trade surveillance work in investment firms?

Systems capture orders, trades and often communications, then apply rules or models to flag suspicious patterns. Analysts review alerts, escalate genuine concerns and report to regulators where required. Firms tune the rules to reduce false positives and close gaps.

Why does whistleblowing matter for operational risk?

Staff often see misconduct before management does. A trusted channel lets the firm catch problems early, before they become large losses or fines. It works only if reporters are protected and cases are investigated independently.

What is operational resilience in a compliance context?

It is the ability to keep critical services and control functions running through disruption. For compliance, this means surveillance, record-keeping and reporting continue to work, including when third parties fail.