Skip to content

FRM Part II · FRM Exam Part II · Risk Governance

A bank organizes its operational risk governance using three lines of defense. The independent corporate operational risk function (CORF) reports that it has been drafting the business units' risk and control self-assessments on their behalf to save time. Which assessment best reflects the sound-practice principles?

This is unacceptable because business line management owns identification and assessment of operational risk in its activities. The independent risk function should set the framework and challenge the results, not write them. Doing so blurs the lines of defense and weakens both ownership and independent challenge.

  1. AAcceptable, because the CORF has more risk expertise than the business units
  2. BUnacceptable, because business line management owns identifying and assessing the risks in its activities, and the CORF should challenge rather than perform that workCorrect
  3. CAcceptable, provided internal audit signs off on each assessment afterwards
  4. DUnacceptable, because only internal audit may be involved in self-assessments

Explanation

In the first line, business management is responsible for identifying and assessing risks and controls. The CORF designs the framework and provides independent challenge; writing the assessments undermines its independence and weakens ownership. Audit sign-off does not fix the ownership problem, and audit does not do self-assessments.

Did you get it right without looking?

One question tells you little. A timed set on Risk Governance shows your real accuracy, how long you take and where you lose marks.

Practise Risk GovernanceFree diagnostic mock

More Risk Governance questions