Skip to content

FRM Exam Part II · Risk Governance

Risk Culture and Incentives for FRM Part II

Updated 11 October 2026 · Fact-checked

Risk culture is the shared norms, attitudes and behaviors in a firm that shape how people identify, discuss and act on risk. Tone from the top, accountability and pay design drive it. To answer questions, find the behavior, trace it to the incentive or leadership signal, then pick the fix.

Understand Risk Culture and Incentives

Risk culture is how people in a firm actually behave when they face risk decisions. It is not the policy manual. A bank can have a perfect framework on paper and still lose money because staff hide problems, bend limits or chase targets.

Tone from the top is the message the board and senior management send through what they do, not only what they say. If a CEO praises traders who break limits and make profit, staff learn that limits do not matter. Tone from the middle matters too, because line managers shape daily behavior.

Accountability means people own the risks they take and face consequences for poor outcomes. Under the three lines of defense model, the business line owns risk, risk management and compliance challenge it, and internal audit gives independent assurance. Culture weakens when the first line treats risk as someone else's job, or when the control functions lack authority, independence or access to the board.

Incentives turn culture into action. Pay tied only to short-term revenue rewards taking tail risk, because the gains are paid now and the losses arrive later, often borne by shareholders or taxpayers. Sound practice links pay to risk-adjusted performance, uses deferral, allows clawback or malus, and pays part in instruments that reflect long-term outcomes. Pay for control-function staff should not depend on the units they oversee.

For operational risk, weak culture shows up as unreported incidents, repeated control breaches, rushed sales, rogue trading and misconduct. Strong culture shows up as open escalation, protection for people who raise concerns, and consequences that are applied consistently.

Key formulas to remember

Culture chain
Tone from the top → incentives and accountability → staff behavior → operational risk outcomes
Use this chain to answer scenario questions. Find where it breaks.
Sound pay design features
Risk-adjusted metrics + deferral + clawback/malus + part paid in equity or long-term instruments
Aims to align pay with long-term risk, not just current-year profit.
Control-function pay rule
Pay of control staff must be independent of the performance of the business they monitor
Protects the independence of risk, compliance and audit.
Three lines of defense
1st line: owns risk | 2nd line: oversight and challenge | 3rd line: independent assurance
Confusing the lines is a common error.

How to solve Risk Culture and Incentives questions

Culture questions are scenarios. Work from the behavior to the cause to the remedy.

  1. 1Read the scenario and list the observable behaviors, such as hidden losses, limit breaches or ignored warnings.
  2. 2Classify each as a culture signal: tone from the top, accountability, incentives, communication or challenge.
  3. 3Identify the root cause. Ask who benefits from the behavior and what the pay or promotion system rewards.
  4. 4Check the three lines of defense. Which line failed, and was it independent and empowered?
  5. 5Match the remedy to the cause: change pay design, strengthen escalation, add consequences, or fix board oversight.
  6. 6Eliminate options that treat symptoms only, such as adding a policy without changing incentives.
  7. 7Pick the answer that addresses long-term behavior and is consistent with regulatory expectations.

Quickest way: Cause-first elimination

When to use it: Use when you have about a minute and the options mix symptoms, causes and fixes.

  1. Decide whether the question asks for an indicator, a cause or a remedy.
  2. For causes, look first for pay tied to short-term revenue or leaders who tolerate breaches.
  3. For remedies, prefer options that change incentives or accountability over those adding paperwork.
  4. Reject options that weaken control-function independence.

Common mistakes in Risk Culture and Incentives

  • Treating risk culture as the same as written policy

    Frameworks are easy to see and culture is not.

    Fix: Remember culture is actual behavior. A strong policy with weak behavior is a weak culture.

  • Saying tone from the top means only the CEO's speeches

    The phrase sounds like communication.

    Fix: Tone is shown by decisions, promotions, pay and how breaches are handled. Actions outweigh words.

  • Assuming bonuses are bad in themselves

    Crisis stories focus on pay excess.

    Fix: The problem is design. Short-term, revenue-only, asymmetric pay is the issue. Risk-adjusted, deferred, clawback-able pay is acceptable.

  • Blaming the second line when the first line failed

    Candidates mix up ownership and oversight.

    Fix: The business line owns the risk. Risk management challenges and monitors it.

  • Choosing a new control as the fix for a behavioral problem

    Controls feel concrete.

    Fix: If staff are rewarded for the bad behavior, a control will be bypassed. Fix incentives and accountability first.

Worked examples

Example 1

A bank's trading desk repeatedly exceeds its limits. Breaches are approved after the fact by the desk head, who receives a bonus based on annual desk revenue. Which is the most likely root cause of weak risk culture?
A. Insufficient trading limits
B. Incentives rewarding revenue without regard to risk, with weak challenge
C. Too many staff in the risk function
D. Excessive board reporting

Show the solution
  1. Behavior: repeated limit breaches approved after the fact.
  2. Who benefits: the desk head, paid on revenue, gains when limits are exceeded.
  3. Challenge is weak because the person approving breaches has a conflict of interest.
  4. Option A treats limits as the issue, but limits are already being ignored. Options C and D are unrelated to the cause.

Answer: B

Example 2

A bank wants to improve its pay structure to support a sound risk culture. Which change is most consistent with sound practice?
A. Pay bonuses fully in cash at year-end based on revenue
B. Link the bonus of risk staff to trading desk profits
C. Defer part of bonuses, pay part in long-term instruments and allow clawback
D. Remove all variable pay for the first line

Show the solution
  1. Sound practice aligns pay with long-term, risk-adjusted outcomes.
  2. A pays immediately on revenue, which rewards short-term risk taking.
  3. B undermines the independence of control staff.
  4. C uses deferral, long-term instruments and clawback, which delay and adjust pay for realized risk.
  5. D is not required. Variable pay is acceptable if well designed.

Answer: C

Exam tips

  • Look for the incentive behind the behavior. Most scenario answers trace back to pay or promotion.
  • Know the three lines of defense cold, and who owns, challenges and assures.
  • Prefer remedies that change behavior over those that add reporting.
  • Learn the standard indicators of weak culture: unreported incidents, repeated breaches, fear of escalation and dominant individuals.
  • Watch for options that compromise control-function independence. They are usually wrong.

Practice questions from Risk Governance

Risk Culture and Incentives: frequently asked questions

What is tone from the top in operational risk?

It is the example set by the board and senior management through decisions, rewards and responses to breaches. Staff copy what leaders reward and tolerate. Weak tone often leads to more misconduct and control failures.

How does compensation affect risk culture?

Pay tells staff what the firm values. Revenue-only, short-term bonuses encourage tail risk and hiding problems. Deferral, clawback, risk-adjusted metrics and independent pay for control staff push behavior toward long-term outcomes.

What are indicators of weak risk culture?

Common signs include repeated limit breaches, late or missing incident reporting, staff afraid to escalate, dominant individuals who avoid challenge, and weak consequences for misconduct. High turnover in control functions can also be a warning sign.

Is risk culture measurable?

Firms use proxies such as staff surveys, breach and incident trends, audit findings and escalation patterns. These indicators are imperfect, so judgment is needed to read them together.