Skip to content

FRM Part I · FRM Exam Part I · The Governance of Risk Management

In the three lines of defense model used for risk governance at a bank, which function constitutes the third line of defense?

Internal audit is the third line of defense. It provides independent assurance to the board and audit committee on whether the first line (business units) and second line (risk management and compliance) are working effectively, and it sits outside day-to-day risk-taking and risk oversight.

  1. ABusiness unit managers who originate and own risk-taking positions
  2. BThe independent risk management function led by the CRO
  3. CThe internal audit function providing independent assurance to the boardCorrect
  4. DThe compliance team monitoring adherence to regulations

Explanation

In the standard model, the first line is the business units that own risk, the second line is independent risk management and compliance oversight, and the third line is internal audit, which gives independent assurance to the board. The CRO's function is second line, so option B is wrong.

Did you get it right without looking?

One question tells you little. A timed set on The Governance of Risk Management shows your real accuracy, how long you take and where you lose marks.

Practise The Governance of Risk ManagementFree diagnostic mock

More The Governance of Risk Management questions