FRM Exam Part II · Risk, Regulation and Organizational Structure

Risk Governance and Board Oversight for FRM Part II

Updated 11 October 2026 · Fact-checked

Risk governance is the structure of authority, roles and reporting that controls how a firm takes risk. The board sets strategy and risk appetite, the CRO leads independent risk oversight, and three lines of defense separate risk-taking, risk control and independent assurance. To solve questions, identify who owns each task.

Understand Risk Governance and Board Oversight

Risk governance answers one question: who decides how much risk the firm takes, and who checks it? Without clear answers, risk-takers can load up on risk for bonuses while nobody with authority stops them. Many post-crisis failures were governance failures as much as modelling failures.

The board of directors holds ultimate responsibility. It approves business strategy, the risk appetite statement and the overall risk framework. It oversees senior management and challenges them. Most boards delegate detailed work to a board risk committee, usually made up mostly of independent, non-executive directors, some with risk expertise. The committee reviews risk reports, limits, stress test results and breaches, and advises the full board. The board still keeps accountability.

The Chief Risk Officer (CRO) runs the independent risk function. The CRO builds and maintains the risk framework, aggregates risk across the firm, reports to the board and senior management, and challenges business decisions. Good practice gives the CRO stature and independence: a direct line to the board risk committee, access to it without the CEO present, and removal or appointment only with board involvement. The CRO should not be paid on the revenue of the businesses being overseen.

Risk appetite is the aggregate level and type of risk a firm is willing to accept to pursue its strategy. Risk tolerance is the more specific, quantified boundary around that appetite, often set by business line or risk type, such as a maximum loss or a minimum capital ratio. Risk limits are the day-to-day operational controls that keep the firm within tolerance. Appetite is broad and board-level; limits are granular and operational.

The three lines of defense model splits duties. The first line is the business units and front office, which own and manage risk daily. The second line is independent risk management and compliance, which set policy, monitor, challenge and report. The third line is internal audit, which gives independent assurance to the board on whether the first two lines work. Strong risk culture, meaning shared attitudes toward taking and managing risk, makes the structure work in practice.

Key formulas to remember

Hierarchy of risk statements: Risk appetite (board, broad) → Risk tolerance (quantified boundaries) → Risk limits (operational); Appetite is set by the board; limits are set and monitored by management and risk. Do not swap the levels.
Three lines of defense: 1st: business units own risk | 2nd: risk management and compliance oversee | 3rd: internal audit assures; The first line owns the risk. The second line is independent of risk-taking. The third line is independent of both.
Board responsibilities: Board = approve strategy + approve risk appetite + oversee management + hold accountability; Committees advise and review, but accountability stays with the full board.
CRO independence test: Independence = separate from revenue + direct board access + board involvement in appointment and removal; If an option has the CRO reporting only to the CFO or paid on trading profit, it weakens governance.

How to solve Risk Governance and Board Oversight questions

Governance questions are about assigning the right task to the right body. Use this routine on any scenario.

1Read the scenario and list each party named: board, risk committee, CEO, CRO, business unit, compliance, internal audit.
2Identify what the question asks: who owns it, who oversees it, or who assures it.
3Classify each activity as taking and owning risk (1st line), independent monitoring and challenge (2nd line), or independent assurance (3rd line).
4Check for conflicts of interest or lost independence, such as the CRO reporting to a business head or audit reviewing its own design work.
5For appetite questions, decide the level: strategic and board-level (appetite), quantified boundary (tolerance), or operational control (limit).
6Eliminate options that put accountability below the board or make risk functions dependent on revenue.
7Choose the option that matches good-practice principles, and recheck that it answers the exact question asked.

Quickest way: Own, Oversee, Assure

When to use it: Use on any multiple-choice question that asks which line, body or officer is responsible for a task.

Ask: does this person take the risk or run the process? That is the first line.
Ask: does this person set policy, measure, monitor or challenge independently? That is the second line, usually the CRO's function.
Ask: does this person test whether controls and governance work and report to the board or audit committee? That is the third line.
For board questions, pick strategy, appetite and oversight; reject daily limit management.
Pick the answer that keeps the risk function independent of revenue.

Common mistakes in Risk Governance and Board Oversight

Placing compliance or risk management in the first line because they sit close to the business.
Physical or reporting proximity to the front office feels like ownership.
Fix: Judge by function. Independent monitoring and challenge is second line, whatever the seating plan.
Saying internal audit manages or mitigates risk.
Audit finds control weaknesses, so it seems to be part of control.
Fix: Audit gives independent assurance and recommendations. Management owns the fixes.
Treating risk appetite and risk tolerance as identical.
Everyday language uses them interchangeably.
Fix: Appetite is the broad level and type of risk the firm will accept. Tolerance is the specific quantified boundary around it. Limits then operationalize tolerance.
Believing the CRO makes the risk decisions or owns business risk.
The title suggests ultimate control.
Fix: Business lines own risk. The CRO provides independent oversight, aggregation, challenge and reporting, with escalation rights to the board.
Thinking delegating to a risk committee removes board accountability.
Delegation sounds like transfer of responsibility.
Fix: The committee supports the board. The full board stays accountable for the risk framework and appetite.
Accepting a CRO compensated mainly on firm profits or reporting to the CFO or a business head.
It seems efficient or aligns incentives.
Fix: This undermines independence. Look for direct board access and pay that is not tied to the revenue of overseen units.

Worked examples

Example 1

A bank's trading desk exceeds a Value at Risk limit. The desk head asks the CRO's team to raise the limit because the desk is profitable. The CRO refuses and escalates to the board risk committee. Which statement best describes this governance?
A. The CRO is acting as first-line risk owner
B. The second line is exercising independent challenge and escalation
C. Internal audit is performing its assurance role
D. The board is setting an operational limit

Show the solution

The desk is the front office, so it is the first line and owns the risk.
The CRO's team monitors limits independently and challenges the desk. That is second-line activity.
Escalating to the board risk committee is the independence and access that good governance requires.
Option A is wrong because the CRO does not own the desk's risk. Option C is wrong because audit reviews after the fact and does not monitor limits daily. Option D is wrong because limits are management-level controls; the board sets appetite.

Answer: B. The second line is exercising independent challenge and escalation.

Example 2

A bank's board states it will 'maintain a strong capital position and avoid earnings volatility that threatens the dividend'. Management then sets a minimum CET1 ratio of 11% and a maximum quarterly trading loss of $200 million. Desk-level VaR caps are set from these. Classify the three items.

Show the solution

The board's statement is broad, strategic and about the type and level of risk accepted. It is the risk appetite.
The 11% CET1 minimum and the $200 million maximum quarterly loss are specific quantified boundaries around that appetite. They are risk tolerances.
The desk-level VaR caps are operational controls that keep activity within tolerance. They are risk limits.
The chain runs appetite, then tolerance, then limits, with the board owning the first and management and risk owning the later ones.

Answer: Appetite: the board statement. Tolerances: the 11% CET1 minimum and the $200 million quarterly loss cap. Limits: the desk VaR caps.

Exam tips

Questions usually describe a scenario and ask which line or body should act. Label every person as first, second or third line before reading the options.
Watch for independence traps: CRO paid on revenue, CRO reporting to the CEO only, or audit designing the controls it later tests.
Use exact terms: appetite, tolerance and limit are tested as separate levels.
Expect case-style stems on failures such as weak risk culture, where the right answer is usually stronger board challenge, clear accountability and escalation.
If two options look right, prefer the one that keeps final accountability with the board and independence with the risk function.

Practice questions from Risk, Regulation and Organizational Structure

Risk Governance and Board Oversight: frequently asked questions

What is the role of the chief risk officer in FRM Part II?

The CRO leads the independent risk function. The CRO builds the risk framework, aggregates and reports risk to the board and senior management, and challenges business decisions. The CRO needs independence and direct access to the board risk committee.

What is the difference between risk appetite and risk tolerance?

Risk appetite is the broad level and type of risk the firm is willing to accept to pursue its strategy. Risk tolerance is a more specific, quantified boundary around that appetite, such as a maximum loss or minimum capital ratio. Limits then turn tolerance into daily controls.

Who is in each of the three lines of defense?

The first line is the business units that own and manage risk. The second line is independent risk management and compliance, which set policy and monitor. The third line is internal audit, which gives independent assurance to the board.

Does the board risk committee replace the full board?

No. The committee reviews risk reports, limits and stress tests in more depth and advises the board. The full board remains accountable for strategy and risk appetite.