Charta is on Google Play: practise on the go. Get the app
Charta

Outline the three lines of defense approach to governing operational risk and contrast what each line is responsible for.

FRM® Part II · Operational Risk and Resilience · Risk Governance · FRM2.ORR.2.c

The idea

The three lines of defence divide operational risk responsibilities so that those who take risk are not the only ones judging it. The first line, business line management and its support functions, owns the risks and controls. It identifies and assesses risk, runs controls, remediates weaknesses and reports. The second line is the independent corporate operational risk management function. It designs the framework, tools and methodology, challenges the first line's assessments, monitors the risk profile and reports to senior management and the board. The third line is internal audit, which gives independent assurance that the framework and the first two lines work as intended. It does not design or run them. The usual mistakes are letting the second line do the first line's assessments, or giving audit a design role, because both blur independence. Know who owns, who challenges and who assures.

A practice question

From the question bank, with the reason each wrong option is wrong.

In the three lines of defense model for operational risk, which function forms the first line?

  1. The corporate operational risk management functionWhy not: This independent function is the second line, which designs the framework and challenges the first line.
  2. Business line management, owning risks and controls - correct
  3. Internal audit, which gives independent assuranceWhy not: Audit is the third line, providing independent assurance.
  4. The board risk committee, which oversees the frameworkWhy not: A governance body, not one of the three lines.

The first line is business line management, including its support functions: it identifies, assesses, controls and reports the risk it takes. The second line challenges and the third line assures.

A harder one

Which responsibility belongs to the second line of defense, the corporate operational risk management function?

  1. Designing framework tools and challenging first-line assessments - correct
  2. Owning and operating the controls over the processes it overseesWhy not: Control ownership is a first-line duty.
  3. Giving independent assurance that the framework operates as designedWhy not: Independent assurance is the third line's role.
  4. Approving the bank's operational risk appetite and tolerance statementWhy not: The board approves the statement; the function advises and monitors.

The second line is independent of the businesses: it builds the framework, methodology and tools, challenges and monitors the first line, and reports. It does not own the controls or give final assurance.

The hardest tier

Risk and control self-assessments are completed by staff of the corporate operational risk function, who interview business units and fill in the templates, while business managers only sign them off. Internal audit reviews the process once a year. What is the main weakness?

  1. Internal audit should perform the assessments itself because it is independentWhy not: Would compromise the third line's independence and leave the first line without ownership.
  2. The second line should have no contact with the business so as to protect its independenceWhy not: Overcorrects: the second line engages with the first line and challenges it; independence does not mean no contact.
  3. Nothing is wrong, since Basel assigns the assessments to the second lineWhy not: Basel has the first line identify and assess its risks; the second line provides tools and challenge.
  4. The first line does not own its assessments, and the second line is doing its work - correct

First-line management owns identification and assessment of its risks and controls; the second line provides the method and challenges the results. When the second line fills the templates, ownership and challenge are lost.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Risk Governance