FRM Exam Part II · Integrated Risk Management
Risk Culture and Lessons from Risk Failures in Banks
Updated 11 October 2026 · Fact-checked
Risk culture is the shared norms, attitudes and behaviours that shape how people in a firm identify, discuss and act on risk. Incentives and communication drive it. To answer exam questions, find the root cause in the case, map it to a governance or integration gap, and pick the fix that addresses that cause.
Understand Risk Culture and Lessons from Risk Failures
Risk models and limits only work if people use them honestly. Risk culture is the set of values and behaviours that decide whether staff raise bad news, respect limits and think about risk when they act. A firm can have a good framework on paper and still fail because its culture rewards ignoring it.
Three forces shape culture. Tone from the top: the board and senior management show what they value by what they reward, tolerate and punish. Incentives: pay that rewards short-term revenue without adjusting for risk pushes people to take hidden or tail risk. Bonuses paid fully in cash for one year's profit are the classic example. Communication: if risk managers cannot challenge business lines, or bad news is filtered before reaching the board, risk is not integrated into decisions.
Good practice includes clear risk appetite set by the board, accountability across the three lines of defense, an independent chief risk officer with direct board access and real authority, pay that is risk-adjusted and deferred, and open channels for escalation and challenge. Compensation can use deferral, clawback and malus so that losses revealed later reduce earlier pay.
Past failures show integration gaps. Common patterns are: risks managed in silos so no one saw the combined exposure; models trusted beyond their limits; limits breached or overridden without consequence; weak challenge from risk functions; and reliance on metrics like VaR that missed tail and liquidity risk. In many failures the information existed somewhere in the firm but did not reach decision makers, or was ignored.
In the exam, treat each case as a diagnosis. Ask what went wrong (incentive, governance, communication, model, data), and which control would have caught it. The best answer links cause to fix.
How to solve Risk Culture and Lessons from Risk Failures questions
Use this method for any case or concept question on risk culture and failures.
- 1Read the stem and list the facts: who took the risk, how they were paid, who could challenge, what was reported.
- 2Classify the root cause: incentive misalignment, weak governance, poor communication, silo risk management, model over-reliance, or limit breach.
- 3Match the cause to the integration gap, such as risk not aggregated across desks or the risk function lacking independence.
- 4Check each option against the cause. Eliminate options that treat a symptom (for example, a new model) when the cause is behavioural.
- 5Prefer the fix that changes behaviour or information flow: risk-adjusted pay, deferral and clawback, escalation channels, empowered CRO, board-set risk appetite.
- 6Watch for absolute words such as always or only. Culture issues rarely have a single cause.
- 7Confirm your answer matches the exact question: cause, consequence or remedy.
Quickest way: Cause, Gap, Fix in three lines
When to use it: Use it for scenario MCQs when time is short and options look similar.
- Name the cause in one word: pay, voice, silo, model or limit.
- Name the gap it exposes: who did not see or act on the risk.
- Choose the option that closes that gap directly, usually a change in incentives, independence or escalation rather than a technical tweak.
Common mistakes in Risk Culture and Lessons from Risk Failures
Choosing a better model as the fix for a culture failure.
Quantitative candidates assume every failure is a measurement problem.
Fix: Ask whether the information existed and was ignored. If so, the fix is governance, incentives or escalation.
Thinking higher pay is the problem rather than how pay is structured.
Headlines blame bonuses in general.
Fix: The issue is pay not adjusted for risk or time. Remedies are risk-adjusted metrics, deferral, clawback and malus.
Treating risk culture as the risk function's job alone.
Confusing culture with the second line.
Fix: The board and senior management set tone, and the business lines own risk as the first line. The risk function challenges and monitors.
Assuming a breach of limits proves the framework was weak.
Mixing up design and enforcement.
Fix: Separate design from enforcement. A good limit that is routinely overridden signals a cultural and governance failure.
Blaming a single cause in a failure case.
Wanting one clean answer.
Fix: Failures usually combine incentives, silos, weak challenge and model reliance. Pick the option that best fits the question asked.
Worked examples
Example 1
A trading desk's bonuses are paid in cash each year based on that year's revenue. The desk builds large positions in instruments with small frequent gains and rare large losses. Which change best addresses the root cause? A) Raise the VaR confidence level to 99.9%. B) Defer part of the bonus and link it to risk-adjusted results with clawback. C) Replace the desk head. D) Reduce reporting frequency to the board.
Show the solution
- Facts: pay depends on one-year revenue and ignores risk.
- Cause: incentive misalignment that rewards tail risk-taking.
- Gap: traders gain from upside but do not bear later losses.
- Option A changes a measure, not the incentive. Option C treats a person, not the system. Option D worsens communication.
- Option B aligns pay with risk and time horizon.
Answer: B
Example 2
After a large loss, a review finds that the risk team had flagged the concentrated exposure several times, but reports were summarised by business heads before reaching the board. What is the main integration gap and the best remedy?
Show the solution
- Facts: risk team identified the exposure, but the board did not see the warnings.
- Cause: communication filtered by the business line, so the risk function lacked independence and direct access.
- Gap: escalation and aggregation failed, so senior decision makers had no unfiltered view.
- Remedy: give the chief risk officer direct, unfiltered access to the board or risk committee, with clear escalation rules and board-level reporting of limit breaches.
- A new model would not fix this because the information was already available.
Answer: The gap is filtered communication and a risk function without independence. The remedy is direct CRO access to the board and formal escalation of concerns and limit breaches.
Exam tips
- Most questions are cause-and-fix scenarios. Decide the root cause before reading the options.
- Distractors often offer a technical fix for a behavioural problem. Reject them.
- Know the compensation tools by name: deferral, clawback and malus, and risk-adjusted performance metrics.
- Link tone from the top, risk appetite, three lines of defense and CRO independence together in your mind, as they appear in one story.
- Do not rely on memorised case details. Use the facts given in the stem.
Practice questions from Integrated Risk Management
- A bank's risk committee notes that its credit, market and liquidity stress tests are each run by separate teams using unrelated macroeconomi…
- A bank designs a reverse stress test. Which description best matches the approach?
- A review of several institutional failures finds that each had risk reports showing the problem, yet senior management took no action. The r…
- In the three-lines model commonly used to describe risk governance, which responsibility belongs to the first line?
- A bank's risk team computes stand-alone economic capital of 60 for credit risk, 40 for market risk and 20 for operational risk. When aggrega…
Risk Culture and Lessons from Risk Failures in other exams
The same ground in other exams, if you are preparing for more than one or want another angle on it.
Risk Culture and Lessons from Risk Failures: frequently asked questions
What is risk culture in banks?
It is the shared attitudes and behaviours that decide how staff identify, discuss and act on risk. It is shaped by tone from the top, incentives and communication. A strong culture makes people respect limits and raise concerns early.
How do incentives affect risk taking in banks?
Pay based on short-term revenue without a risk adjustment rewards people for taking hidden or tail risk. They keep the gains and others bear later losses. Deferral, clawback and risk-adjusted metrics reduce this problem.
What do risk failures teach about integration gaps?
They often show risks managed in silos, weak challenge from risk functions, and information that did not reach decision makers. Firms also over-relied on models. The lesson is to aggregate risk and give the risk function independence and board access.
How should I approach case questions on this topic?
Identify the root cause first: incentive, governance, communication, silo or model. Then pick the option that fixes that cause directly. Avoid options that only treat symptoms.