Risk and Compliance common mistakes
Risk and Compliance · Understand the traps and how to avoid them.
Treating governance as a synonym for management, so when a scenario asks who sets risk appetite and oversees the framework, the candidate picks the executive team or the risk officer instead of the board.
Everyday usage blurs the two words, and candidates answer from general intuition rather than the exam's structural distinction between oversight (governing body) and execution (management).
What to do instead
Memorise the split as a one-line rule: the board approves appetite, policy, and framework and provides oversight; management implements, operates controls, and reports. For each practice question, first label the actor as governing body or management before reading the options.
Confusing the three lines model, assigning assurance or independent challenge to the first line, or placing internal audit inside the second line.
Candidates learn the three lines as a list of functions rather than as a separation-of-duties logic, so they map roles by job title instead of by independence from the activity being controlled.
What to do instead
Anchor each line to its relationship with risk: first line owns and manages risk, second line sets frameworks and challenges, third line gives independent assurance to the governing body. Test each option by asking whether that function could objectively audit its own work.
Selecting the most thorough-sounding control or the most conservative option instead of the one that fits the identified risk, cost, and proportionality, for example recommending full avoidance of a low-impact risk.
Exam options are written to reward judgement, but candidates default to a 'more control is safer' heuristic that ignores proportionality and business context.
What to do instead
Before choosing, restate the risk's likelihood and impact and the stated objective. Eliminate options that are disproportionate to that rating or that contradict a stated constraint, then choose among the remaining options the one that best matches the risk level.
Mixing up inherent and residual risk, or reporting residual risk before controls have been assessed, so the numbers and conclusions in a scenario are misapplied.
The two terms sound interchangeable in casual use, and scenarios often present both figures close together to test whether the candidate tracks which is which.
What to do instead
Use a fixed sequence: identify inherent exposure first, evaluate control design and operation, then derive residual exposure. When a question gives both numbers, write down which is which before evaluating the answer choices.
Treating risk appetite, risk tolerance, and risk capacity as one concept, so the candidate endorses an exposure that exceeds capacity because it sits within appetite.
The terms overlap in ordinary language, and questions deliberately place an exposure between the appetite threshold and the capacity limit to see whether the candidate distinguishes them.
What to do instead
Define each in one sentence: appetite is the amount of risk willingly pursued, tolerance is the acceptable variation around that level, and capacity is the maximum the organisation could absorb. Check any proposed exposure against all three, not just appetite.
Jumping to a treatment decision (avoid, reduce, transfer, accept) before the risk has been properly identified and assessed, or choosing transfer for a risk that cannot be insured or contracted away.
Treatment feels like the actionable part of risk management, so candidates skip the assessment step and pick a plausible-sounding response without checking feasibility.
What to do instead
Apply the sequence identify, analyse, evaluate, treat, monitor and record. For transfer options, verify a counterparty or insurance market actually exists for that risk; if not, eliminate the option regardless of how attractive it sounds.
Confusing compliance risk with legal risk, or assuming that meeting a regulatory obligation automatically discharges the broader compliance and conduct obligation.
Both involve rules, but compliance risk covers the wider exposure of failing to meet obligations and standards, including internal policy and conduct expectations, not just statute.
What to do instead
Classify each scenario by the source of the obligation: statute and case law point to legal risk, while regulatory obligations, internal policy, and conduct standards point to compliance risk. Where both apply, choose the option that addresses the wider obligation set.
Assuming a control that is documented, approved, or tested once is therefore effective, and treating evidence of design as evidence of operating effectiveness.
Audit and compliance language around 'controls in place' encourages a checkbox reading, and candidates overlook that effectiveness requires evidence of consistent operation over time.
What to do instead
Separate design effectiveness from operating effectiveness in every control question. If the scenario shows only a written procedure or a single test, conclude design only; require evidence of repeated operation across the period before concluding the control is effective.
Treating a known issue as closed once a remediation plan or owner is assigned, rather than requiring verified completion and evidence before closure.
Accountability language in scenarios ('the owner committed to a date') reads like resolution, and candidates conflate commitment with completion.
What to do instead
Adopt a closure test: an issue closes only when the fix is implemented, independently validated, and evidenced. Any option that closes on a plan, a promise, or a target date is wrong unless the scenario states the remediation has been tested.
Escalating straight to the regulator or board for a routine issue, or conversely keeping a material breach at team level, showing misjudged escalation thresholds and reporting lines.
Candidates lack a mental model of materiality triggers and reporting routes, so they pick either the most dramatic or the most local option.
What to do instead
Build a short escalation ladder: team, risk and compliance function, executive committee, board or board committee, then external regulator where a legal reporting duty or threshold is met. Match the scenario's severity and any stated legal duty to the lowest rung that satisfies it, escalating further only for materiality or mandatory reporting.