Skip to content

FRM Part I · FRM Exam Part I · The Governance of Risk Management

A bank's internal audit reviews its market risk framework and finds that VaR limits are being breached regularly without escalation. Management of the trading business says the risk team should have stopped them. Which statement BEST allocates responsibility under the three lines of defense model?

Responsibility is shared by role: business units own their risk and must stay within limits, the risk function independently monitors and escalates breaches, and internal audit assesses whether both do so effectively. Management cannot shift ownership of risk to the second line, because risk ownership sits with the first line.

  1. AOnly the second line is responsible, because the first line merely executes trades
  2. BThe first line owns and manages the risk it takes and must respect limits, while the second line must monitor and escalate breaches, and audit assesses bothCorrect
  3. CInternal audit is responsible for preventing breaches, since it is the most independent function
  4. DThe board is solely responsible, because no line has authority over limits

Explanation

The first line owns risk and is accountable for staying within limits. The second line independently monitors and challenges, and escalates breaches. The third line assures that these controls work. Placing all responsibility on one line, as in A or C, contradicts the model, and the board oversees rather than replaces the lines.

Did you get it right without looking?

One question tells you little. A timed set on The Governance of Risk Management shows your real accuracy, how long you take and where you lose marks.

Practise The Governance of Risk ManagementFree diagnostic mock

More The Governance of Risk Management questions