FRM Part II · FRM Exam Part II · Risk Governance
In the three lines of defence model commonly used for operational risk governance, which function is primarily responsible for independently assessing whether the first and second lines are operating effectively and reporting to the audit committee?
Internal audit is the third line of defence. It independently assures the board or audit committee that governance, risk management and internal controls work effectively, whereas business lines own risk and the operational risk function provides oversight and challenge as the second line.
- ABusiness line management
- BInternal auditCorrect
- CThe operational risk management function
- DThe compliance function
Explanation
Internal audit is the third line. It gives independent assurance to the board or audit committee on the design and effectiveness of governance, risk management and controls. Business management owns risks (first line), while the risk and compliance functions oversee and challenge (second line).
Did you get it right without looking?
One question tells you little. A timed set on Risk Governance shows your real accuracy, how long you take and where you lose marks.
More Risk Governance questions
- A bank's board has approved an operational risk framework, but the document does not say how much operational risk the bank is willing to ac…
- A bank's operational risk committee reviews key risk indicators (KRIs) with amber threshold 4 and red threshold 7 failed settlements per wee…
- A bank's internal audit finds that the operational risk reports to the board contain only realized loss totals by business line, with no for…
- A bank's operational risk function receives monthly loss data from business lines. The Chief Risk Officer notices that several divisions rec…
- Which of the following BEST describes the 'tone from the top' in risk culture?
- A bank's internal audit reviews the operational risk framework. Under the Basel principles, which finding would most clearly indicate a weak…