Skip to content

FRM Part II · FRM Exam Part II · Introduction to Operational Risk and Resilience

A bank has a central operational risk function that runs a framework, and each business line has an embedded operational risk manager who reports solely to the business line head and sets the line's own control testing standards. The central function only receives summary reports quarterly. Which assessment is most accurate?

The embedded managers act as first-line staff, so effective second-line oversight is missing unless the central function can independently set standards, challenge assessments and obtain timely information. Quarterly summaries alone give weak challenge, and merging the function into audit would compromise audit independence.

  1. AThe structure is ideal, because it maximizes first-line ownership with no need for second-line challenge
  2. BThe embedded managers function as first-line risk staff, so the bank lacks effective second-line oversight of business-line risk assessment unless the central function can independently challenge and set standardsCorrect
  3. CThe structure creates a third-line function because the managers test controls
  4. DThe central function is redundant and should be merged into internal audit

Explanation

Embedded managers reporting only to the business head and setting their own standards are part of the first line (or a 1.5 line). Without the central function holding authority to set standards, challenge and receive timely information, second-line independence is weak. Testing controls does not make them third line, since the third line must be independent of management, and merging into audit would damage audit independence.

Did you get it right without looking?

One question tells you little. A timed set on Introduction to Operational Risk and Resilience shows your real accuracy, how long you take and where you lose marks.

More Introduction to Operational Risk and Resilience questions