Set out who is responsible for risk management inside an organisation and show how the three lines of defense model supports sound risk control.
The idea
Risk management is everyone's job, but accountability is layered. The board sets the risk appetite and oversees the framework, and senior management carries it out. The three lines of defense model divides the work. The first line is the business units that take and own the risk day to day, including their own controls. The second line is the independent risk management and compliance functions. They design the framework, set and monitor limits, challenge the first line and report on risk. The third line is internal audit, which gives the board independent assurance that the first two lines work. The usual mistake is to let one line do another's job, for example letting audit design controls or letting sales sign off ratings. Exams ask who owns, who challenges and who assures.
A practice question
Which statement best describes the role of the third line of defense?
- Setting credit limits and monitoring daily exposure against them.Why not: This is the second line's role; audit does not run the limit framework.
- Taking credit decisions within delegated authority and owning the resulting risk day to day in the business.Why not: Describes the first line; audit must not take decisions it later reviews.
- Giving the board independent assurance that first and second line controls are effective. - correct
- Designing the control procedures that business units follow.Why not: Control design belongs to the first and second lines; audit designing them would compromise its independence.
Internal audit is independent of both the business and the risk function and tests whether their controls work, reporting to the board or its audit committee.
A harder one
A relationship manager is paid a bonus on loan volume and also signs off the internal rating of her own clients. What is the correct view of this arrangement under the three lines model?
- It is acceptable, because the first line knows the client best, owns the risk and bears the first loss if the loan fails.Why not: Risk ownership does not remove the conflict of interest created by volume-based pay.
- Internal audit should assign every rating, as it is the only independent function.Why not: Audit is the third line and gives assurance after the fact; assigning ratings would make it part of the process it audits.
- The board should assign each rating personally to guarantee independence.Why not: The board sets appetite and oversees; it does not rate individual obligors, which is an operational task.
- The rating should be set or validated by an independent second-line function, since the first line is conflicted. - correct
Independent challenge is the purpose of the second line. Letting the person who earns from the loan decide its rating removes that challenge.
The hardest tier
A bank's internal audit team has started building and maintaining the credit scorecards used by the business, and it also audits those scorecards each year. What is the main problem with this arrangement?
- There is no problem, because audit has the deepest technical knowledge of the scorecards.Why not: Technical skill does not offset a self-review conflict; independence is the third line's defining feature.
- The only problem is incomplete documentation, since scorecards are normally built by the board and not by audit.Why not: Boards do not build scorecards; the objection is about independence, not documentation.
- Audit is reviewing its own work, which removes the independence needed for objective assurance. - correct
- Audit should have left scorecards to the first line alone, with no second-line validation.Why not: Removes the second line's validation role; the issue is audit's participation, not the existence of validation.
The third line must stay independent of what it assures. Scorecard building belongs to the first or second line, with independent validation and audit assurance on top.
In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.
Start free →More in Governance
- Account for the steps through which risk is taken on, namely credit origination, credit risk assessment and credit approval.
- Review four principles of best-practice credit risk governance: Guidelines, Skills, Limits and Oversight.
- Outline the parameters that most often define a credit-sensitive transaction.
- Lay out what a credit committee does within an organisation.