Skip to content

FRM Part II · FRM Exam Part II · Risk Governance

A bank assigns its operational risk function the following: it designs the framework, challenges business line risk and control self-assessments, aggregates risk reporting to the board, and also directly owns and operates the controls in each business unit to ensure they work. Which criticism is most appropriate?

The problem is that the operational risk function owns and operates business controls. That makes it responsible for the first line's work, compromising its independent challenge and weakening business management accountability. Its other tasks, framework design, challenge and board reporting, are appropriate second-line responsibilities.

  1. AThe function should not report to the board
  2. BOwning and operating business controls compromises the second line's independence and blurs first-line accountability for managing riskCorrect
  3. CThe function should not challenge self-assessments
  4. DThe function should delegate framework design to internal audit

Explanation

Designing the framework, challenging assessments and aggregated reporting are proper second-line tasks. Running business controls transfers first-line ownership to the second line, removing independent challenge and weakening accountability of business management. Internal audit should stay independent too, so delegating design to it is wrong.

Did you get it right without looking?

One question tells you little. A timed set on Risk Governance shows your real accuracy, how long you take and where you lose marks.

Practise Risk GovernanceFree diagnostic mock

More Risk Governance questions