FRM Exam Part II · Introduction to Operational Risk and Resilience

Operational Risk Governance and the Three Lines of Defense

Updated 11 October 2026 · Fact-checked

Operational risk governance is the structure that sets who owns, oversees and challenges operational risk. The board sets direction and risk appetite. Senior management implements it. Under the three lines of defense, business units own risk, an independent risk function oversees it, and internal audit gives independent assurance.

Understand Operational Risk Governance and Three Lines of Defense

Operational risk is the risk of loss from inadequate or failed internal processes, people and systems, or from external events. Basel includes legal risk in this definition and excludes strategic and reputational risk. Because it arises everywhere in a firm, someone must be clearly accountable. That is what governance does.

Start at the top. The board approves the operational risk framework, sets the risk appetite and tolerance, and reviews the framework periodically. It does not run daily controls. Senior management turns board direction into policies, processes, systems, clear reporting lines and adequate resources. It must also make sure staff understand their responsibilities.

The three lines of defense split the work. The first line is the business units. They own the risks they create, identify and assess them, run controls and report events. The second line is the independent operational risk (or corporate risk) function. It designs and maintains the framework, challenges the first line, monitors risk against appetite and reports to senior management and the board. The third line is internal audit. It independently reviews whether the framework and controls work, including the second line, and reports to the board or its audit committee.

Risk appetite is the amount and type of risk the firm is willing to accept to pursue its strategy. For operational risk it is often expressed as limits or thresholds on loss amounts, key risk indicators, control failures or event counts. Risk tolerance is the maximum deviation allowed around appetite. Breaches trigger escalation to management and, if serious, the board.

The key test in exam questions is independence. The second line must be independent of the business so it can challenge it. Internal audit must be independent of both. A control owner cannot also be the assurance provider for the same control.

Key formulas to remember

First line: Business units = own and manage operational risk and controls; Day-to-day identification, assessment, control and reporting.
Second line: Independent risk function = framework design, oversight, challenge, monitoring and reporting; Must be independent of business lines. It does not own the business risks.
Third line: Internal audit = independent assurance on framework and controls; Reports to the board or audit committee. Reviews first and second lines.
Board responsibility: Board = approve framework + set risk appetite and tolerance + periodic review; Oversight, not daily management.
Risk appetite breach logic: Actual risk metric > limit or tolerance → escalate; Appetite is expressed through measurable limits and indicators.

How to solve Operational Risk Governance and Three Lines of Defense questions

Use this method for any governance or three lines question.

1Identify the actor in the scenario: board, senior management, business unit, risk function or internal audit.
2Ask what the activity is: owning risk, setting or implementing policy, challenging and monitoring, or giving independent assurance.
3Match the activity to the right role using the three line definitions.
4Check independence. Does the person judging a control also run it?
5Check whether the issue is about risk appetite: is a metric above its limit and does it need escalation?
6Eliminate options that give the board daily control duties or give audit ownership of risk.
7Pick the option that keeps ownership in the first line, challenge in the second and assurance in the third.

Quickest way: Own, Challenge, Assure

When to use it: Use when an MCQ asks which line or body is responsible for an activity.

Doing or owning the risk or control? First line.
Setting framework, monitoring, challenging? Second line.
Independently testing or reviewing everything? Third line (internal audit).
Approving appetite and framework? Board. Implementing it? Senior management.
Reject any option that breaks independence.

Common mistakes in Operational Risk Governance and Three Lines of Defense

Saying the risk function owns operational risk.
The name sounds like it owns the risk.
Fix: The first line owns risk. The second line oversees and challenges.
Thinking internal audit is part of the second line.
Both are independent of the business.
Fix: Audit is the third line. It gives assurance on the first and second lines and reports to the board or audit committee.
Giving the board responsibility for day-to-day controls.
The board is at the top, so it seems to control everything.
Fix: The board approves the framework and appetite and reviews it. Senior management implements it.
Treating risk appetite as a single loss number that never changes.
Appetite is often taught with one example limit.
Fix: Appetite is set by the board, expressed through limits, indicators and tolerances, and reviewed as strategy and conditions change.
Including strategic and reputational risk in the Basel operational risk definition.
Broad everyday use of the term.
Fix: Basel includes legal risk but excludes strategic and reputational risk.
Ignoring independence when the first line self-assesses its own controls.
Self-assessment is a valid first line tool.
Fix: First line self-assessment is fine, but the second line must challenge it and audit must test it.

Worked examples

Example 1

A bank's payments team finds a recurring reconciliation break. The operational risk function reviews the team's risk and control self-assessment, disagrees with a control rating and asks for rework. Later internal audit tests reconciliation controls. Which line performs each action? Which is the correct description of the risk function's role?
A) It owns the reconciliation control
B) It challenges the first line's assessment
C) It gives final independent assurance to the audit committee
D) It approves the bank's risk appetite

Show the solution

The payments team runs the process and self-assesses: first line.
The risk function reviews and disputes the rating: that is effective challenge, a second line activity.
Internal audit tests controls independently: third line.
Option A describes the first line. Option C describes internal audit. Option D describes the board.
Option B matches the second line.

Answer: B. The risk function challenges the first line's assessment. Payments is first line and audit is third line.

Example 2

A bank's board sets a tolerance of no more than 5 operational loss events above USD 1 million in a year. By September there have been 6 such events. The business head proposes to wait until year end to report. What should happen under good governance, and who is responsible for each step?

Show the solution

Compare the metric to the tolerance: 6 events exceeds the limit of 5, so it is a breach.
The first line should report the events promptly and explain causes.
The second line monitors metrics against appetite and must escalate the breach to senior management, and to the board if required by policy. Waiting until year end is not acceptable.
Senior management decides remedial actions and allocates resources.
The board reviews the breach and decides whether appetite, tolerance or the strategy needs changing.
Internal audit later reviews whether escalation and remediation worked.

Answer: The tolerance is breached (6 > 5). It must be escalated now. The first line reports, the second line monitors and escalates, senior management remediates, the board oversees appetite, and audit provides later assurance.

Exam tips

Match every activity to one of own, challenge or assure before reading the options.
Watch for independence traps, such as the risk function approving its own controls or audit designing them.
Remember the board approves appetite and the framework. Senior management implements them.
Questions often combine governance with a case: find the breach, then name who escalates and who is accountable.
Use Basel wording: operational risk includes legal risk and excludes strategic and reputational risk.

Practice questions from Introduction to Operational Risk and Resilience

Operational Risk Governance and Three Lines of Defense in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

FRM Part IOperational Risk Governance and Frameworks

Operational Risk Governance and Three Lines of Defense: frequently asked questions

What are the three lines of defense in operational risk?

The first line is business units, which own and manage the risks. The second line is the independent risk function, which sets the framework and challenges the business. The third line is internal audit, which gives independent assurance.

What is the board's role in operational risk management?

The board approves the operational risk framework, sets the risk appetite and tolerance, and reviews them periodically. It oversees senior management but does not run daily controls.

How does risk appetite apply to operational risk?

It sets how much operational risk the firm will accept to pursue its strategy. It is usually expressed through limits, thresholds and key risk indicators. Breaches are escalated to management and, if serious, the board.

Is internal audit part of the second line?

No. Internal audit is the third line. It is independent of both the business and the risk function and reviews both, reporting to the board or audit committee.