Charta is on Google Play: practise on the go. Get the app
Charta

Explain best practices for governing an ERM program and putting it into effect.

FRM® Part I · Foundations of Risk Management · Enterprise Risk Management and Future Trends · FRM1.FR.8.c

The idea

Good ERM governance starts with the board of directors, which oversees risk and approves the risk appetite that management proposes, usually through a risk committee. A chief risk officer, senior and independent of the revenue-generating units, leads the risk function, has direct access to the board, and is not paid on unit profits. Implementation turns the appetite into action: a common risk language, limits and risk budgets cascaded to business units, aggregated and timely reporting, adequate data and systems, and clear accountability. The three lines model is often used: business units own risk, the independent risk and compliance function oversees it, and internal audit gives independent assurance. A frequent mistake is to put risk reporting under the business it monitors. The test is whether risk information actually changes decisions.

A practice question

From the question bank, with the reason each wrong option is wrong.

Which description best fits the role of the chief risk officer (CRO) in an ERM program?

  1. A manager who runs the firm's trading book and is accountable for its profit.Why not: Combines risk oversight with profit responsibility, which undermines independence.
  2. An executive who takes every risk decision on behalf of the business units.Why not: Business units keep ownership of risk-taking; the CRO oversees and challenges.
  3. A role that replaces internal audit as the assurance provider.Why not: Internal audit remains a separate third line of defence.
  4. A senior executive who leads an independent risk function and has direct access to the board. - correct

The CRO provides independent oversight and aggregation, not trading decisions or assurance. Direct board access protects independence.

A harder one

In the three lines model, an internal audit team tests periodically whether the risk framework is working and reports its findings to the audit committee. Which line does internal audit represent?

  1. The third line: independent assurance over the first two lines. - correct
  2. The first line: owning and managing risk in the business.Why not: The first line is business units, which own and manage risk.
  3. The second line: setting policy and monitoring risk alongside management.Why not: The second line is the risk management and compliance functions, not audit.
  4. An additional first-line control located in the risk function.Why not: Audit is independent of the risk function and does not form part of the first line.

First line: business units own risk. Second line: risk management and compliance oversee. Third line: internal audit gives independent assurance.

The hardest tier

A firm proposes that its CRO reports to the head of trading, to ensure market knowledge, and that the CRO's bonus depends on the profits of the business units he oversees. Which change would best strengthen governance?

  1. The CRO reports to the CEO, has board risk committee access, and is not paid on unit profits. - correct
  2. Keep the reporting line to the head of trading and add a second bonus tied to unit profits.Why not: Adds a further profit incentive, deepening the conflict of interest.
  3. Have the CRO report to the CFO and bar contact with the board to preserve confidentiality.Why not: Removing board access weakens independence and escalation.
  4. Make the CRO's bonus depend only on trading profit so that the CRO understands the desk.Why not: Ties pay directly to the profits the CRO is meant to challenge.

A CRO overseeing units whose profits determine pay or who are in the reporting line cannot be independent. Direct lines to the CEO and board and de-linked pay protect the challenge role.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Enterprise Risk Management and Future Trends