Skip to content

FRM Exam Part II · Governance

Risk Culture, Compensation and Regulatory Expectations in Banks

Updated 11 October 2026 · Fact-checked

Risk culture is the set of norms and behaviours that shape how staff identify, discuss and act on risk. Compensation shapes those behaviours by rewarding or punishing risk-taking. Supervisors, through Basel principles, expect board oversight, independent risk functions, sound credit standards and risk-adjusted pay. Exam questions ask you to spot the governance failure and name the fix.

Understand Risk Culture, Compensation and Regulatory Expectations

Risk culture is how people in a firm think about risk and behave when they face it. It is not a policy document. It shows in who speaks up, who is listened to, and what gets rewarded. A strong culture has tone from the top, open challenge, clear accountability and consistent consequences.

Incentives drive behaviour. If traders or loan officers are paid on volume or short-term profit, they have reason to take risks whose losses fall later or on others. This is an asymmetry: the person keeps the upside, the firm and shareholders (and sometimes taxpayers) bear the downside. Sound pay design links rewards to risk-adjusted results over a longer horizon.

Common design tools include deferral of bonuses, payment partly in shares or instruments that lose value after losses, malus (reducing unpaid awards) and clawback (recovering paid awards). Risk and control staff should be paid independently of the businesses they oversee. The board, usually through a remuneration committee with risk input, owns the pay policy.

Supervisors set expectations in guidance such as the Basel Committee's principles for the management of credit risk and for corporate governance. The themes are consistent. The board approves strategy and risk appetite. Senior management implements it. Credit is granted under sound, well-defined criteria. Credit is monitored and administered continuously. Controls and independent review are in place. Exceptions are tracked and escalated.

Lessons from the credit crisis repeat the same failures. Underwriting standards fell as lenders sold loans on (originate-to-distribute). Risk was concentrated and poorly aggregated. Risk managers lacked authority or were overruled. Models and ratings were over-trusted. Pay rewarded short-term volume. When you read a case, match each symptom to one of these failures.

Key formulas to remember

Risk-adjusted performance (RAROC)
RAROC = (Revenue − Costs − Expected loss) ÷ Economic capital
Used to link pay and performance to risk taken. Pay on raw profit ignores the capital consumed.
Bonus adjustment mechanisms
Deferral + payment in equity or similar instruments + malus + clawback
Malus applies to unpaid (deferred) awards; clawback applies to amounts already paid.
Basel credit risk principle areas
Environment → Granting → Administration and monitoring → Controls → Supervisory role
A way to recall the structure: board and management set the environment, then sound credit granting, ongoing administration, adequate controls.
Lines of defence
1st: business owns risk; 2nd: independent risk and compliance; 3rd: internal audit
Culture failures often show up as a weak or overruled second line.

How to solve Risk Culture, Compensation and Regulatory Expectations questions

Use the same sequence for any scenario question on culture, pay or supervisory expectations.

  1. 1Read the scenario and identify who acts: board, senior management, business line, risk function or audit.
  2. 2Find the behaviour that went wrong, such as relaxed underwriting, ignored limits or an overruled risk officer.
  3. 3Ask what incentive explains it: volume, short-term bonus, or no consequence for breaches.
  4. 4Name the failed governance element: tone from the top, independence of risk, risk appetite, pay policy or controls.
  5. 5Match it to the supervisory principle, for example sound credit-granting criteria or independent credit review.
  6. 6Choose the remedy that fixes the cause, not the symptom: deferral, malus, independence, escalation or board oversight.
  7. 7Check the options for absolutes such as always or never, and for fixes that sit with the wrong party.

Quickest way: Cause, owner, fix

When to use it: Use when you have about 90 seconds and the options are long and similar.

  1. Spot the incentive or governance gap in the stem in one line.
  2. Decide who owns it: the board for appetite and pay policy, management for implementation, second line for challenge.
  3. Eliminate options that fix the symptom only, such as adding one more report.
  4. Prefer the option that aligns reward with long-term risk-adjusted outcomes or restores independence.

Common mistakes in Risk Culture, Compensation and Regulatory Expectations

  • Treating risk culture as a written policy or a training programme.

    Policies are easy to see, while culture is about behaviour.

    Fix: Look for evidence in behaviour: challenge, escalation, consequences and rewards.

  • Confusing malus and clawback.

    Both reduce pay after bad outcomes.

    Fix: Malus cuts unvested or deferred pay. Clawback recovers pay already received.

  • Assuming high pay itself is the problem.

    Media coverage focuses on size of bonuses.

    Fix: The exam focuses on structure: horizon, risk adjustment and alignment, not the amount.

  • Giving ownership of risk appetite to the risk function alone.

    Risk managers measure risk, so they seem to own it.

    Fix: The board approves risk appetite. Management implements it. The risk function challenges and monitors.

  • Blaming crisis credit failures only on models or ratings.

    Model failures are memorable.

    Fix: Include weak underwriting, originate-to-distribute incentives, concentrations and overruled risk staff.

  • Choosing a fix that makes the business line self-police.

    First-line ownership sounds sensible.

    Fix: The business owns risk, but oversight needs an independent second line and audit.

Worked examples

Example 1

A bank pays loan originators a bonus based on the volume of mortgages approved in the year. Default losses appear two to three years later. Which change best improves alignment with risk?
A. Raise the bonus rate on volume
B. Defer part of the bonus and make it subject to malus if loans perform badly
C. Pay the bonus monthly instead of annually
D. Remove the bonus and pay a higher fixed salary to risk staff only

Show the solution
  1. The problem is a timing mismatch: reward is immediate, losses come later.
  2. Option A strengthens the volume incentive and worsens the problem.
  3. Option C shortens the horizon further, so it worsens alignment.
  4. Option D does not change originator incentives, since it affects only risk staff.
  5. Option B ties reward to later loan performance through deferral and malus, which fixes the cause.

Answer: B

Example 2

A bank's chief risk officer flags that a large corporate loan breaches the concentration limit. Senior management overrides the limit to win business, and the board is not told. Identify the main governance failures and the correct remedies.

Show the solution
  1. Failure 1: the risk function lacks real authority, since its objection was overruled.
  2. Failure 2: no escalation to the board, so risk appetite approved by the board was not respected.
  3. Failure 3: the business and management incentives favour winning business over limit compliance.
  4. Remedy: require limit exceptions to be escalated to the board or its risk committee with documented approval.
  5. Remedy: give the CRO direct access to the board and independence from the business.
  6. Remedy: include limit compliance in performance assessment and pay.

Answer: The failures are an overruled, weak second line, no board escalation, and incentives rewarding business over limits. Fix them with mandatory escalation of exceptions, a CRO with board access, and pay linked to limit compliance and risk-adjusted results.

Exam tips

  • Questions are usually scenarios. Find the incentive and the governance gap before reading the options.
  • Know who owns what: board for appetite and pay policy, management for implementation, risk function for challenge, audit for assurance.
  • Expect options that treat the amount of pay as the issue. Pick answers about structure, horizon and risk adjustment.
  • For credit crisis cases, list underwriting decline, originate-to-distribute, concentrations, over-reliance on ratings and weak risk voice.
  • Be careful with absolute words in options. Rules of thumb in governance are rarely always true.

Practice questions from Governance

Risk Culture, Compensation and Regulatory Expectations: frequently asked questions

What is risk culture in a bank?

It is the shared norms and behaviours that shape how staff identify, discuss and act on risk. It shows in tone from the top, open challenge, accountability and what is rewarded.

How does compensation affect risk-taking?

Pay based on short-term profit or volume lets staff gain from upside while others bear later losses. Deferral, share-based pay, malus and clawback push rewards toward long-term, risk-adjusted outcomes.

What do the Basel credit risk principles expect?

They expect the board and senior management to set a sound credit risk environment, grant credit on well-defined criteria, monitor credit continuously and keep adequate controls and independent review.

What governance lessons come from the financial crisis?

Weak underwriting, originate-to-distribute incentives, risk concentrations, over-trust in ratings and models, and risk managers without authority recur. Pay that rewarded short-term volume made these worse.