Governance of Risk and Compliance
What governance actually means
Governance is the system by which decisions are made, authority is delegated, and accountability is enforced. For a risk and compliance candidate, the core concepts are the three lines model, the board's risk appetite statement, the compliance charter, and the escalation paths that connect them. The board sets appetite and oversight; management owns and operates controls in the first line; an independent risk and compliance function provides challenge and monitoring in the second line; internal audit gives assurance in the third.
Traps to watch
Questions often blur ownership with assurance. The business unit owns the risk; compliance advises and monitors; audit assures. Another common trap is treating the risk appetite statement as a numeric limit - it is a narrative expression of acceptable risk, supported by tolerances and limits. Also expect questions that test whether a policy approved by the board can be waived by a senior manager: normally no, unless a documented exception process with defined authority exists. Finally, watch for confusion between a policy (mandatory direction), a standard (specific requirements), and a procedure (steps to execute).
Rule of thumb
Ask "who is accountable if this fails?" If the answer is the second line, the governance design is probably wrong - the first line should be accountable, with the second line providing independent challenge.
Worked example
A trading desk exceeds a position limit. The desk head reports it to the chief risk officer, who grants an oral waiver. In an exam, the correct critique is that the waiver bypassed the approved exception process and lacked documented authority; the desk remains accountable for the breach, and the second line should escalate rather than absorb the decision.