Charta is on Google Play: practise on the go. Get the app
Charta

Outline best practices in governing the risk management processes of a firm.

FRM® Part I · Foundations of Risk Management · The Governance of Risk Management · FRM1.FR.3.b

The idea

Good risk governance is the structure of oversight, responsibility and accountability around risk-taking, and it rests on a few repeatable practices. The board approves a risk appetite statement and oversees it through a risk committee. Good practice commonly includes a chief risk officer of senior standing, independent of revenue-producing units, who reports to the CEO and has direct access to the board. Arrangements vary by firm, code and jurisdiction. The three lines of defence assign ownership. Business units own and manage risk. Independent risk management and compliance oversee and challenge. Internal audit gives independent assurance. Limits, escalation of breaches, independent model validation and price verification, enterprise-wide reporting and pay aligned with risk complete the picture. All of this is supported by a risk culture set by tone at the top. The usual exam trap is a risk function that reports to, or is paid from, the units it monitors.

A practice question

From the question bank, with the reason each wrong option is wrong.

In the three lines of defence model, which function constitutes the first line?

  1. The independent risk management functionWhy not: Independent risk management and compliance are the second line, which oversees and challenges the first.
  2. The internal audit functionWhy not: Internal audit is the third line, giving independent assurance to the board and audit committee.
  3. The board risk committeeWhy not: The board committee provides oversight above the three lines; it is not a line of defence itself.
  4. The business units that take risk and own it day to day - correct

The first line owns and manages risk, the second line sets frameworks and independently monitors and challenges, and the third line (internal audit) provides independent assurance.

A harder one

Which reporting arrangement for the chief risk officer best supports good risk governance?

  1. Reporting to the head of the largest trading business, who understands the firm's key risks bestWhy not: A CRO who reports to a revenue-producing head cannot challenge that business independently.
  2. Reporting to the CEO, with direct access to the board risk committee and board approval for appointment and removal - correct
  3. Reporting to the CFO, with the CFO deciding the CRO's pay and tenureWhy not: Placing the CRO under the CFO subordinates risk to a finance agenda and gives the CRO no independent standing.
  4. Reporting to the head of internal audit so that the second and third lines are combinedWhy not: Merging the second and third lines removes the independent assurance that internal audit provides over risk management.

The CRO needs seniority, independence from revenue and a line to the board so that concerns can be escalated without filtering by those being monitored.

The hardest tier

A bank has a sophisticated VaR system. The board approves the risk appetite statement annually, risk reports go monthly to the board with breach escalation, variable pay is deferred, and the CRO reports to the head of the largest trading business. Which feature is the most serious governance weakness?

  1. The CRO's reporting line to the head of a revenue-producing business - correct
  2. Deferral of part of variable pay over several yearsWhy not: Deferral is a recommended practice that aligns pay with long-term outcomes, so it is a strength.
  3. Annual board approval of the risk appetite statement, which is a standard cycleWhy not: Annual approval, refreshed when conditions change, is normal practice and is not the main flaw here.
  4. Monthly board risk reports with breach escalationWhy not: Regular reporting with escalation is good practice; the weak point is who the risk function answers to.

Independence is the foundation of the second line. Sophisticated measurement and good reporting cannot compensate for a CRO who answers to the unit he or she must challenge.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in The Governance of Risk Management