Skip to content

FRM Part II · FRM Exam Part II · Risk Governance

During a review, the chief risk officer finds that the first line routinely escalates operational loss events only after the second line asks about them, and business managers regard operational risk as 'the risk department's job'. Which weakness in the three lines of defense model does this best illustrate?

This shows weak first-line ownership and accountability. In the three lines model the business owns its risks and should report events proactively. Treating operational risk as the risk department's job pushes responsibility onto the second line and undermines the whole structure.

  1. AExcessive independence of internal audit
  2. BInadequate first-line risk ownership and accountabilityCorrect
  3. COver-reliance on external auditors for control testing
  4. DInsufficient third-line reporting to regulators

Explanation

A core principle is that business management owns and is accountable for its risks. Escalating only when prompted and treating risk as another function's responsibility shows weak first-line ownership. Nothing in the scenario concerns internal audit independence or external auditors.

Did you get it right without looking?

One question tells you little. A timed set on Risk Governance shows your real accuracy, how long you take and where you lose marks.

Practise Risk GovernanceFree diagnostic mock

More Risk Governance questions