Charta is on Google Play: practise on the go. Get the app
Charta

Characterise the part played by the board and by its various committees in governing operational risk, and set their roles side by side.

FRM® Part II · Operational Risk and Resilience · Risk Governance · FRM2.ORR.2.b

The idea

The board carries ultimate responsibility for operational risk governance, although it may delegate work to committees. It approves and reviews the framework and the risk appetite and tolerance statement, and it oversees senior management. The board risk committee advises on appetite and monitors how management implements the framework and what the risk profile looks like. The audit committee oversees internal audit, the independence of its review of the framework, and the integrity of financial reporting and controls. The remuneration committee makes sure pay and incentives reward risk-aware, compliant behaviour rather than raw revenue. Below the board sits an executive operational risk committee of senior managers. It reviews risk profile, key risk indicators and losses, and escalates upward. A common error is to confuse the executive committee with the board committees. Remember who approves, who monitors and who assures.

A practice question

From the question bank, with the reason each wrong option is wrong.

Which board committee typically oversees the internal audit function and the independence of its review of the operational risk framework?

  1. The board remuneration committee, which sets pay for executivesWhy not: Sets and reviews pay and incentives; it does not oversee internal audit.
  2. The board nominations committee, which selects directorsWhy not: Deals with board and senior appointments, not audit oversight.
  3. The executive asset-liability committee, which manages the balance sheetWhy not: A management committee for balance sheet and liquidity matters, not a board committee for audit oversight.
  4. The board audit committee - correct

The audit committee oversees internal audit and the integrity of financial reporting and controls, including that the audit's review of the framework is independent.

A harder one

Which statement correctly distinguishes the board risk committee from the board audit committee in operational risk governance?

  1. The audit committee advises on appetite; the risk committee oversees independent assuranceWhy not: Reverses the two committees' roles.
  2. The risk committee is made up of executives and reports to the chief executiveWhy not: Describes an executive management committee; the risk committee is a board committee.
  3. The risk committee advises on appetite and monitors implementation; the audit committee oversees assurance - correct
  4. The audit committee designs the framework tools so that internal audit becomes the framework expertWhy not: Designing the tools would compromise the independence of the audit's later review.

The risk committee helps the board set appetite and monitors implementation and risk profile, while the audit committee oversees internal audit and independent review. Neither is a management committee.

The hardest tier

Internal audit reports a serious weakness in the corporate operational risk function's methodology. The head of internal audit reports administratively and functionally to the chief financial officer, who is also responsible for the controls audited. Which feature is most problematic?

  1. Audit reports to an executive it audits, compromising independence; it should report to the audit committee - correct
  2. The audit committee receives the full report directly from the head of internal auditWhy not: This is the intended practice, not a weakness; the audit committee should see audit findings unfiltered.
  3. Audit reviewing the operational risk function's methodology and loss data processWhy not: Independent review of the framework and the second line is within audit's remit.
  4. The report goes to the executive operational risk committee for approval before the board sees itWhy not: Not what the scenario describes; the issue is audit's reporting line, not a committee approving the report.

Internal audit is the third line and needs independence from the executives whose work it reviews, so it reports functionally to the audit committee. Reviewing the framework is proper for audit.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Risk Governance