Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

A bank uses three lines of defence for cyber risk. The CISO's team designs controls and monitors threats, business units run systems daily, and internal audit reviews. A new proposal would have the CISO's team also perform the independent assurance of its own control effectiveness. What is the main governance concern?

The main concern is loss of independence: the team that designs and runs cyber controls would be evaluating its own effectiveness, creating a conflict of interest. Independent assurance should come from a separate function, such as internal audit, so the board receives objective evidence about control performance.

  1. AIt would remove the second line's ability to set policy
  2. BIt would compromise independence because the function designing and operating controls would assess itselfCorrect
  3. CIt would increase the board's reporting burden only
  4. DIt would violate the requirement that business units run no systems

Explanation

Independent assurance must come from a party not responsible for the controls being assessed. Self-assessment by the designer of controls creates a conflict of interest, so the independent third line (or independent challenge) must remain separate. The other options mischaracterise the concern.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions