Charta is on Google Play: practise on the go. Get the app
Charta

Explain what Basel expects from banks regarding how their operational risk management framework is governed.

FRM® Part II · Operational Risk and Resilience · Risk Governance · FRM2.ORR.2.a

The idea

The Basel Committee's Principles for the Sound Management of Operational Risk expect a bank to run an operational risk management framework that is fully integrated into its overall risk management, not a stand-alone exercise. The board approves and periodically reviews the framework and oversees senior management. Senior management develops a clear governance structure with well-defined, transparent and consistent lines of responsibility. It submits that structure to the board and makes sure the framework is implemented consistently at every level of the organisation. The framework should be documented, covering definitions, roles, tools and reporting. The principles apply to all banks, in proportion to size, complexity and risk profile. The usual mistake is to treat governance as the operational risk function's job alone. The exam point is that the board approves and oversees, and management implements.

A practice question

From the question bank, with the reason each wrong option is wrong.

Under the Basel principles for operational risk, which party is expected to approve and periodically review the operational risk management framework?

  1. The board of directors - correct
  2. The chief operational risk officer acting aloneWhy not: The corporate operational risk function designs and maintains the framework, but approval belongs to the board.
  3. The head of internal auditWhy not: Audit reviews the framework independently; approving it would compromise that independence.
  4. The heads of the business linesWhy not: Business lines apply the framework in the first line; they do not approve the rules that govern them.

Basel places approval and periodic review of the framework with the board, which also oversees senior management's implementation. Management and the risk function develop it; audit reviews it independently.

A harder one

Under the Basel principles, who is expected to develop the operational risk governance structure with clear lines of responsibility, and who approves it?

  1. The board develops it and senior management approves itWhy not: Reverses the roles: the board approves and oversees, while management develops and implements.
  2. Senior management develops it and submits it to the board for approval - correct
  3. The corporate operational risk function develops and approves it on its ownWhy not: The second line has no authority to approve the structure that governs the bank; the board does.
  4. Internal audit develops it and the audit committee approves itWhy not: Audit gives independent assurance and does not design the structure it later reviews.

Senior management develops a clear, transparent governance structure with consistent lines of responsibility and takes it to the board for approval, then ensures it is implemented consistently. The board approves; management builds and implements.

The hardest tier

After a large loss event, the board chair says that appointing a chief operational risk officer means the board has delegated operational risk governance and has no further duty. Which response best reflects Basel's expectations?

  1. The statement is correct because the chief operational risk officer becomes accountable once appointedWhy not: Delegating tasks does not transfer the board's retained responsibility for approval and oversight.
  2. The board may delegate tasks but still approves the framework and appetite and oversees management - correct
  3. The statement is wrong because the board must run risk identification and assessment itself in each unitWhy not: Overcorrects: identification and assessment sit with first-line management, challenged by the second line.
  4. The statement is wrong because the board must review every loss above any amountWhy not: Basel sets no loss-by-loss review rule; the board sets appetite and receives escalation per thresholds.

Boards can use committees and a risk function, but remain responsible for approving and reviewing the framework and appetite and for overseeing senior management. Day-to-day identification and assessment are not board tasks.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Risk Governance