Skip to content

FRM Part I · FRM Exam Part I · The Governance of Risk Management

A bank's board is reviewing its risk governance after an internal audit report finds that the risk management function has been reviewing its own limit-setting methodology and reporting the result to the CRO as assurance. Which conclusion is most consistent with the three lines of defense model?

The self-review is not independent assurance. Under the three lines of defense model, internal audit, as the third line, should independently assess the risk function's effectiveness and report to the board. A function cannot provide objective assurance over its own methodology.

  1. AThe arrangement is acceptable because the second line is best placed to assess its own work
  2. BThe assurance is not independent; the board should rely on internal audit's independent assessment of the risk function's effectivenessCorrect
  3. CThe first line should replace the second line in validating limits
  4. DExternal rating agencies should take over validation of the methodology

Explanation

The third line, internal audit, provides independent assurance to the board over the first and second lines. A function reviewing its own work lacks independence, so that review cannot serve as assurance. Handing validation to the first line would create a worse conflict.

Did you get it right without looking?

One question tells you little. A timed set on The Governance of Risk Management shows your real accuracy, how long you take and where you lose marks.

Practise The Governance of Risk ManagementFree diagnostic mock

More The Governance of Risk Management questions