Charta is on Google Play: practise on the go. Get the app
Charta

Explain what a firm's board of directors is responsible for, and what part it plays, in risk management.

FRM® Part I · Foundations of Risk Management · The Governance of Risk Management · FRM1.FR.3.c

The idea

The board of directors oversees risk and does not run it. Its responsibilities are to approve the firm's strategy and risk appetite, to make sure management has a capable framework, resources and systems to stay within that appetite, and to oversee compensation so pay does not reward risk beyond appetite. Good practice commonly includes oversight of the chief risk officer's independence and an appropriate board part in that person's appointment, evaluation and, if necessary, removal. Arrangements vary by firm, governance code and jurisdiction. Most boards delegate detailed work to a risk committee made up of independent directors with risk expertise, but the full board stays accountable. Directors must challenge management, ask for independent assessments and review reports on limits, stress tests and breaches. Setting daily desk limits, building models or pricing individual trades belongs to management. The common mistake is to confuse oversight with management.

A practice question

From the question bank, with the reason each wrong option is wrong.

Which of the following is a primary responsibility of the board of directors in risk management?

  1. Setting the day-to-day trading limits for each individual desk and for each trader on itWhy not: Allocating desk limits is a management task carried out within the board-approved appetite.
  2. Building and maintaining the firm's VaR and credit modelsWhy not: Model development belongs to management and the risk function, not to the board.
  3. Approving the firm's risk appetite and overseeing management's adherence to it - correct
  4. Pricing and approving each new client transactionWhy not: Pricing individual transactions is an operational decision for management, not a board matter.

The board oversees: it approves strategy and risk appetite, and holds management accountable. Operational limit-setting, modelling and pricing are management work.

A harder one

Which action best demonstrates the board fulfilling its responsibility for the independence of the risk function?

  1. Board or risk committee approval of the CRO's appointment, dismissal and pay, plus guaranteed direct access - correct
  2. Allowing the CEO alone to hire, assess and dismiss the CRO to keep one clear management lineWhy not: If the CEO alone controls the CRO, a CEO who favours risk-taking can silence the risk function.
  3. Paying the CRO a bonus tied to the firm's trading profit so that the CRO shares in the firm's overall successWhy not: Pay linked to profit gives the CRO a stake in the risks being taken and erodes independence.
  4. Having the CRO attend board meetings only when invited by the heads of the business linesWhy not: Access controlled by business heads can keep unwelcome risk information from the board.

Good practice commonly includes board control of the CRO's appointment, removal and pay plus unfiltered access, which protects the risk function from pressure by the units and by senior executives (arrangements vary by firm, code and jurisdiction).

The hardest tier

A board compensation committee is setting the annual bonus pool after a year of record trading revenue. Which input should most influence the committee's decision to ensure that pay respects the risk appetite?

  1. The revenue reports submitted by the business heads, since the pool is a fixed share of the revenue earnedWhy not: Revenue alone shows nothing about the risk taken to earn it, so using it alone rewards excess risk.
  2. Peer-firm bonus levels, so that the firm can retain staffWhy not: Competitive benchmarking is relevant to retention but does not test whether pay is consistent with the risk appetite.
  3. The external auditor's opinion on the trading desks' financial statement disclosuresWhy not: The audit opinion covers the fair presentation of accounts, not the risk taken to produce the profits.
  4. An assessment by the CRO of the risk, capital use and stress losses behind the revenue - correct

Boards must adjust pay for the risk behind the profit. The CRO provides the independent view of risk and capital consumption that links compensation to appetite.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in The Governance of Risk Management