FRM Part II · FRM Exam Part II
Risk Governance for FRM Part II: Chapter Guide
Risk governance is the set of structures, roles, policies and limits that decide how a firm takes and controls operational risk. For FRM Part II, learn the framework, the three lines of defense, risk appetite, culture, regulatory principles and reporting. Then apply each to case-style questions: who owns the risk, and what is the gap?
What this chapter covers
This chapter sits in the Operational Risk and Resilience topic of FRM Part II. It explains how a bank organizes itself to identify, own, limit and report operational risk. You are not computing a number here. You are judging whether a structure, a role or a control works.
The six topics build on each other. The framework sets the architecture. The three lines of defense assign ownership. Risk appetite and tolerance set the boundaries. Culture and incentives explain why people follow or ignore those boundaries. The regulatory principles are the benchmark supervisors use to test all of this. Reporting, data and internal controls are how the board and management see what is happening.
The chapter connects to the rest of the paper. Risk appetite and limits appear again in market, credit and liquidity risk. Reporting and data quality link to the Current Issues readings, including digital resilience and artificial intelligence. Case questions on operational loss events often turn out to be governance failures, so this chapter gives you the vocabulary to explain them.
Governance questions are applied and wording-heavy, so they reward candidates who know precise definitions and can spot the failing element in a short case. They are also among the more predictable questions in the paper, because the concepts are stable and the distinctions are clear: first line versus second line, appetite versus tolerance, board versus management. Time spent here is efficient. The same ideas help you read operational risk, resilience and even investment risk cases faster, and wrong options are often easy to eliminate once you know who owns what.
Risk Governance: topics in the order to study them
- 1Operational Risk Governance FrameworkStart with the overall architecture, since every later topic is a component or test of it.
- 2Three Lines of Defense ModelOwnership of risk is the core of the framework, and later topics keep referring to the lines.
- 3Risk Appetite and Risk ToleranceOnce roles are clear, learn the boundaries the board sets and who monitors them.
- 4Risk Culture and IncentivesCulture explains why appetite and roles succeed or fail in practice, so it follows them.
- 5Regulatory Principles for Sound Operational Risk ManagementWith the concepts in hand, you can map them to the supervisory principles and see how they are tested.
- 6Risk Reporting, Data and Internal ControlsFinish with how information and controls close the loop, which also ties into data and resilience themes.
How to prepare Risk Governance
Treat this as a concepts-and-cases chapter. Aim to explain each idea in your own words, then test it on short scenarios.
- Read the framework topic once for the big picture and write a one-page map: board, senior management, three lines, reporting.
- For each line of defense, write down its job in one sentence and one example activity. Practice telling the lines apart.
- Define risk appetite and risk tolerance separately, with one example of each, and note who approves and who monitors.
- List signs of a weak risk culture and the incentive designs that cause them, such as rewards tied only to short-term revenue.
- Go through the regulatory principles and attach each to a governance element. Use the wording as GARP presents it, not a memorized list of numbers.
- Do case-style MCQs. For every miss, name the governance element that was failing and the option trap you fell for.
- Revise using a single sheet of definitions and role distinctions in the final days.
Common mistakes in Risk Governance
Mixing up the second and third lines of defense.
Fix: Remember that the second line oversees and challenges risk-taking, while the third line gives independent assurance on the whole system, usually through internal audit.
Treating risk appetite and risk tolerance as the same thing.
Fix: Keep appetite as the broad level and tolerance as the tighter, measurable boundary. If an option uses a specific limit, think tolerance.
Assuming risk culture is only a statement from senior leaders.
Fix: Look for incentives, accountability and how breaches are handled. Culture shows in behavior and consequences, not slogans.
Putting ownership of risk with the risk function.
Fix: The business line owns the risk it creates. The risk function oversees and challenges.
Memorizing regulatory principles as a list without applying them.
Fix: Link each principle to a scenario and practice naming which principle is breached.
Ignoring data quality in reporting questions.
Fix: Check whether the data is accurate, complete and timely. Poor data undermines both reporting and controls.
Last-day revision: Risk Governance
- Governance sets who owns, limits, monitors and reports operational risk.
- The board approves the framework and risk appetite; management implements it.
- First line owns and manages risk in day-to-day business activity.
- Second line provides independent oversight, challenge and the risk framework.
- Third line is independent internal audit assurance to the board.
- Risk appetite is the broad level of risk the firm is willing to accept to pursue its objectives.
- Risk tolerance is a more specific, measurable boundary around that appetite.
- Tone from the top matters, but incentives decide behavior in practice.
- Pay tied only to short-term results can encourage excessive risk taking.
- Good reporting is timely, accurate, and sent to the right level with action owners.
- Internal controls should be tested, and weaknesses tracked until fixed.
- In a case, find the failing element first: role, limit, culture, data or control.
Risk Governance practice questions
- A bank's operational risk function currently reports to the head of the consumer lending division, who also sets its budget and bonus. The b…
- At a mid-sized bank, the head of the trading desk's business unit appoints a risk coordinator who identifies operational risk events, mainta…
- A bank's operational risk function reports to the head of the retail banking division, who also sets its budget and evaluates its staff. The…
- A firm distinguishes between risk appetite and risk tolerance. Which of the following best illustrates risk tolerance rather than risk appet…
- Which of the following is a responsibility the Basel principles assign to senior management, rather than to the board, regarding operational…
- A bank's internal audit function reports functionally to the audit committee of the board. Which activity is most consistent with internal a…
- A bank wants to strengthen governance of its three lines of defense. Which proposal best preserves the independence of each line while ensur…
- During a review, a bank finds that its business lines routinely operate near their risk limits, but senior managers are rewarded solely on r…
Risk Governance in other exams
The same ground in other exams, if you are preparing for more than one or want another angle on it.
Risk Governance: frequently asked questions
Is Risk Governance a calculation-heavy chapter in FRM Part II?
No. It is mainly conceptual and case-based. You need clear definitions, role distinctions and the ability to spot the governance failure in a scenario.
How is risk governance tested in the exam?
Expect short applied questions in the 80-question paper. They often ask who is responsible, which element has failed, or which action best fixes a weakness.
What is the difference between risk appetite and risk tolerance?
Risk appetite is the broad amount and type of risk a firm is willing to accept to meet its objectives. Risk tolerance is a more specific, measurable limit around that appetite.
Which topic should I study first in this chapter?
Start with the Operational Risk Governance Framework. It gives you the structure that the three lines, appetite, culture, regulation and reporting all fit into.