Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

A global bank's cyber strategy is aligned with the three lines model. The first-line technology team has reported that all controls tested are effective, based on its own self-assessment. The second line has not independently challenged this, and internal audit's next review is 18 months away. Which is the most significant governance weakness?

The key weakness is the lack of second-line challenge. First-line ownership and self-assessment are normal, but without independent oversight by risk management, control effectiveness rests on self-reporting until internal audit arrives, leaving a long period without independent verification of the cyber controls.

  1. AThe first line is performing control self-assessments
  2. BInternal audit's review cycle is longer than one year
  3. CAbsence of effective second-line challenge means control effectiveness is not independently verified between audit cyclesCorrect
  4. DThe technology team owns cyber risks in its area

Explanation

First-line ownership and self-assessment are appropriate. The gap is that the second line, which should set standards, monitor and challenge, has not done so, leaving assurance dependent on self-reporting for a long period. The audit cycle alone is not the key failing since the second line should fill the interim.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions