FRM Part II · FRM Exam Part II · Introduction to Operational Risk and Resilience
A bank has a central operational risk function that runs a framework, and each business line has an embedded operational risk manager who reports solely to the business line head and sets the line's own control testing standards. The central function only receives summary reports quarterly. Which assessment is most accurate?
The embedded managers act as first-line staff, so effective second-line oversight is missing unless the central function can independently set standards, challenge assessments and obtain timely information. Quarterly summaries alone give weak challenge, and merging the function into audit would compromise audit independence.
- AThe structure is ideal, because it maximizes first-line ownership with no need for second-line challenge
- BThe embedded managers function as first-line risk staff, so the bank lacks effective second-line oversight of business-line risk assessment unless the central function can independently challenge and set standardsCorrect
- CThe structure creates a third-line function because the managers test controls
- DThe central function is redundant and should be merged into internal audit
Explanation
Embedded managers reporting only to the business head and setting their own standards are part of the first line (or a 1.5 line). Without the central function holding authority to set standards, challenge and receive timely information, second-line independence is weak. Testing controls does not make them third line, since the third line must be independent of management, and merging into audit would damage audit independence.
Did you get it right without looking?
One question tells you little. A timed set on Introduction to Operational Risk and Resilience shows your real accuracy, how long you take and where you lose marks.
More Introduction to Operational Risk and Resilience questions
- A risk manager argues that operational risk differs from market and credit risk in an important way. Which statement best captures this diff…
- In the three lines model commonly used in operational risk governance, which activity is the responsibility of the second line rather than t…
- A bank's operational risk function asks each business unit to assess its own key processes, rate the likelihood and impact of potential fail…
- A payments firm identifies its retail payment processing service as critical. Management states that the maximum tolerable outage is 4 hours…
- A bank fined for mis-selling products by staff who ignored internal policy records the fine and customer compensation. Under the Basel frame…
- Which statement best describes the role of an internal loss database in an operational risk management framework?