Skip to content

FRM Part II · FRM Exam Part II · Risk Governance

A bank's board receives quarterly operational risk reports. Internal audit finds that although the reports show all key risk indicators 'green', business units set the thresholds themselves and have raised them three times in a year after near breaches. Which conclusion is most appropriate?

Threshold-setting lacks independent challenge and proper governance, so the all-green reports give false assurance. Business units raising their own thresholds after near breaches defeats the purpose of indicators; changes should be challenged by the second line and approved within the board's risk appetite framework.

  1. AThe framework is effective because no indicator breached its threshold
  2. BThreshold-setting lacks independent challenge and board-approved governance, so the reports give false assurance on risk appetite adherenceCorrect
  3. CThe indicators should be removed because thresholds make reporting unreliable
  4. DThresholds should be set only by internal audit, which then owns the indicators

Explanation

Repeatedly loosening thresholds after near breaches defeats their purpose. Thresholds need second-line challenge and approval under an agreed governance process tied to appetite. Removing indicators loses information, and audit owning them would breach its independence as the third line.

Did you get it right without looking?

One question tells you little. A timed set on Risk Governance shows your real accuracy, how long you take and where you lose marks.

Practise Risk GovernanceFree diagnostic mock

More Risk Governance questions