Risk Governance and Internal Controls
Risk governance architecture
Risk governance defines who owns risk, how appetite is set, and how risk is monitored. Key elements: board-approved risk appetite and tolerance statements, a risk management framework, a three-lines model, and escalation routes.
Three lines model
- First line: operational management owns and manages risk.
- Second line: risk and compliance functions set frameworks, advise and challenge.
- Third line: internal audit provides independent assurance. Questions often test that internal audit must be independent of the first and second lines; placing internal audit under the CFO is a classic red flag.
Internal control
Controls are preventive or detective, manual or automated. The control environment (tone at the top, ethics, competence) underpins all other components. Segregation of duties, authorisation limits, reconciliations and exception reporting are common controls. Controls provide reasonable, not absolute, assurance.
Traps
- Confusing risk appetite (what risk is acceptable) with risk capacity (what can be borne).
- Treating risk registers as static documents rather than live tools.
- Assuming more controls are always better; over-control adds cost and bureaucracy.
- Believing internal audit manages risk - it assures.
Worked example
A payments team both initiates and approves transfers. Which issue arises? Lack of segregation of duties, a control weakness raising fraud and error risk. Rule of thumb: no single person should control a transaction end-to-end; separate initiation, authorisation and reconciliation.