Charta is on Google Play: practise on the go. Get the app
Charta

Characterise present-day banking and supervisory approaches to overseeing a cyber-risk management framework, including the division of duties.

FRM® Part II · Operational Risk and Resilience · Cyber-resilience: Range of practices · FRM2.ORR.8.b

The idea

Oversight of a cyber-risk framework starts with the board, which approves the cyber strategy and risk appetite and must receive reporting it can understand. Senior management implements the framework and allocates resources. Day to day duties follow the three lines of defence. The first line, the business and technology units, owns and operates the controls, such as patching, access management and monitoring. The second line, the risk and information security oversight functions led by a chief information security officer or equivalent, sets policy, challenges the first line and monitors the risk against appetite. The third line, internal audit, independently assures that the framework and controls work. Authorities differ. Some issue cyber-specific rules, and others extend existing operational risk, IT and outsourcing requirements to cover cyber. The usual trap is placing oversight under the function it must challenge, which weakens independence. Match each duty to the correct line.

A practice question

From the question bank, with the reason each wrong option is wrong.

Who is ultimately responsible for approving a bank's cyber-risk strategy and risk appetite?

  1. The chief information security officer acting aloneWhy not: The CISO designs and oversees the framework but the board remains accountable for approving strategy and appetite.
  2. The board of directors (or equivalent governing body) - correct
  3. The internal audit functionWhy not: Internal audit provides independent assurance; it does not set strategy or risk appetite.
  4. The external managed security providerWhy not: Responsibility cannot be handed to a provider; the institution's own board stays accountable.

The board sets and approves strategy and appetite and holds management to account. The CISO, auditors and providers have supporting roles but not final accountability.

A harder one

A bank's technology department patches servers, manages user access and monitors networks day to day. In the three lines of defence model, which line is this?

  1. First line: it owns and operates the cyber controls - correct
  2. Second line: it sets the cyber policy and independently challenges risk assessmentsWhy not: This describes the oversight function; running controls day to day is ownership of risk, which sits in the first line.
  3. Third line: it independently tests whether the controls are effectiveWhy not: Independent testing is internal audit; a team operating the controls is not independent of them.
  4. Board level: it approves risk appetite and reviews the strategyWhy not: Setting appetite is a board duty; operating controls is a management and business function.

The first line owns the risk and runs the controls. The second line sets policy and challenges, the third line gives independent assurance, and the board sets appetite.

The hardest tier

An audit finds the board receives only monthly counts of blocked intrusion attempts. Which change would best improve board oversight of the cyber-risk framework?

  1. Sending the board the full technical vulnerability logs so it can approve each patchWhy not: Overloads the board with operational detail; the board should oversee appetite and framework, not individual patches.
  2. Moving all reporting to internal audit so that management no longer informs the boardWhy not: Audit reporting is one source but management and the second line must still report risk against appetite.
  3. Dropping board reporting and leaving cyber entirely to the CISO to avoid information leaksWhy not: Removes accountability; the board must stay informed to approve strategy and appetite.
  4. Risk-based metrics tied to appetite, plus board-level cyber knowledge - correct

Oversight needs information the board can understand and relate to its appetite, plus the skill to challenge it. Raw logs, audit-only reporting or no reporting each fail to support the board's role.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Cyber-resilience: Range of practices