Risk Governance, Appetite, and Culture
Risk governance defines who decides, who oversees, and how accountability flows. Candidates should understand the roles of the board (sets appetite, oversees ERM, ensures tone at the top), board risk committee, CRO, senior management (owns risk within strategy), internal audit (independent assurance), and risk owners (accountable for specific risks). Know the Three Lines Model and the principle of independence of oversight and assurance from the first line.
Risk appetite should be articulated in a risk appetite statement/framework, translated into risk tolerances and limits at business-line level, and embedded in decision-making, incentives, and reporting. Distinguish appetite, tolerance, capacity, and limits. Risk culture comprises shared values, attitudes, and behaviors toward risk; indicators include speak-up mechanisms, whistleblowing, incentive alignment, escalation behavior, and tone at the top. Understand three lines versus older three lines of defense terminology.
Traps: saying the board manages risk day-to-day (management does); treating appetite as a numeric limit only (it is a statement of willingness plus qualitative dimensions); assuming a strong compliance function equals a strong risk culture; and confusing the CRO's oversight role with first-line ownership.
Rule of thumb: Appetite flows top-down; escalation flows bottom-up. Worked example: a board states zero appetite for regulatory breaches, a low appetite for operational loss events above $500k, and a moderate appetite for market risk. Business units translate these into limits, and breaches escalate to the risk committee within defined timeframes.