FRM Part II · FRM Exam Part II · Risk Governance
A bank is reviewing a loss event in which a settlement control failed for several months. Findings: (1) the operations team knew the control was failing but did not escalate; (2) the operational risk department reviewed the unit's reports quarterly and accepted them without testing; (3) internal audit's last review of the area was three years earlier, rated satisfactory. Which conclusion is most consistent with the three lines of defense model?
All three lines failed in their own roles. Operations did not escalate a known control failure, the operational risk function did not challenge or test the reports, and internal audit's assurance was out of date. Each line has a distinct duty, so blaming only one is incorrect.
- AAll three lines failed in their distinct roles: ownership and escalation, effective challenge, and periodic independent assuranceCorrect
- BOnly the first line failed, because the other lines depend entirely on first-line reporting
- COnly the third line failed, because it is ultimately responsible for control effectiveness
- DThe model itself is invalid because three lines produced a loss
Explanation
The first line failed to escalate a known issue, the second line failed to provide effective challenge by accepting reports untested, and the third line's assurance coverage was stale for a risk area. Responsibility for control effectiveness stays with the first line, but each line has its own duty. A loss shows weakness in implementation, not that the model is invalid.
Did you get it right without looking?
One question tells you little. A timed set on Risk Governance shows your real accuracy, how long you take and where you lose marks.
More Risk Governance questions
- Which feature most clearly distinguishes an effective operational risk governance framework from a purely compliance-driven one?
- A bank's key risk indicator (KRI) for failed settlements has amber and red thresholds of 40 and 60 failures per month. Over six months, fail…
- A bank's operational risk framework uses the three lines of defense model. Which activity is most appropriately the responsibility of the se…
- Which activity is most clearly a second-line responsibility in an operational risk governance framework?
- A bank's key risk indicator (KRI) for failed reconciliations has an amber threshold at 40 breaks per month and a red threshold at 70. Over s…
- When a board is setting operational risk appetite, which approach best reflects sound governance practice?