Explain what a risk management framework involves and how risk is governed
The idea
A risk management framework does not seek to minimise risk but to take the intended risks in the intended amounts and to avoid the unintended ones. It comprises risk governance, which sets the risk tolerance at the senior level and establishes accountability; risk identification and measurement; risk infrastructure, meaning the people, data and systems; policies and processes; monitoring and reporting; and strategic risk analysis. Governance must sit above the risk-taking units, because a function reporting to those it monitors cannot constrain them.
A practice question
What is the objective of enterprise risk management?
- To eliminate risk from the organisationWhy not: A firm that bore no risk would earn no return. The aim is to choose which risks and how much.
- To take the intended risks in intended amounts and avoid unintended ones — correct
- To minimise the cost of insuranceWhy not: Insurance is one response among four, and cost minimisation is not the framework's purpose.
An organisation that takes no risk earns no return. The framework is about deliberateness, not avoidance.
A harder one
Why must the risk governance function be independent of the risk-taking units?
- Because regulators forbid contact between themWhy not: They work together constantly; independence concerns the reporting line, not communication.
- Because independent functions are cheaper to operateWhy not: Independence usually costs more. It is bought for credibility, not economy.
- Because a function reporting to those it monitors cannot credibly constrain them — correct
Independence of reporting line is what gives the risk function the standing to say no. Without it, monitoring becomes advisory at exactly the moments it matters.
The hardest tier
Which element of the framework is most often the binding weakness in practice?
- Risk infrastructure — correct
- The existence of a written risk policyWhy not: Easy to produce and almost universally present, which is why its presence proves little.
- The appointment of a chief risk officerWhy not: Also common, and the role is only as effective as the data and systems beneath it.
The data and systems needed to measure exposures accurately and promptly are the usual weak point. Policies and titles are easy to establish, but aggregating exposures across products and entities in time to act on them is expensive and technically demanding, and it is where most failures are traced.
In the app: 9 practice questions on this outcome, a narrated walkthrough with diagrams, spaced review that brings it back before you forget it.
Take the free diagnostic →