Skip to content

FRM Part II · FRM Exam Part II · Risk Mitigation

In the three lines model commonly applied by banks, a business unit's head of operations identifies, owns and tests the day-to-day controls in her area, while an independent operational risk function challenges her assessments and internal audit periodically evaluates the whole framework. Which statement is correct?

The business unit is the first line because it owns risks and controls, the independent operational risk function is the second line providing oversight and challenge, and internal audit is the third line providing independent assurance over the whole framework.

  1. AThe business unit is the first line and owns the risk and its controls; operational risk is the second line; internal audit is the third lineCorrect
  2. BThe operational risk function is the first line because it designs all controls for the business
  3. CInternal audit is the second line because it challenges management assessments
  4. DThe business unit is the second line because it reports to the head of operations

Explanation

The first line owns and manages risks and controls; the second line provides oversight, framework and independent challenge; the third line gives independent assurance. The scenario maps exactly to this, so the other options misassign roles.

Did you get it right without looking?

One question tells you little. A timed set on Risk Mitigation shows your real accuracy, how long you take and where you lose marks.

Practise Risk MitigationFree diagnostic mock

More Risk Mitigation questions