Regulatory Framework and Governance
Regulatory Framework and Governance
Governance questions test whether you understand the architecture of rules, not just individual provisions. A candidate must be able to distinguish primary legislation from delegated regulation, from regulatory guidance, and from internal policy. The hierarchy matters: a statute sets the mandate, a regulator's rules operationalize it, guidance explains expectations without creating new legal duties, and internal policy translates all of it into firm-specific behavior. Questions frequently test which layer an obligation originates from.
Understand the roles of the board, senior management, and the compliance function. The board owns the risk appetite and oversight; management executes; compliance advises, monitors, and escalates. A common trap is conflating accountability (the board and designated senior officers) with responsibility (the business lines that own their risks). Another trap: assuming the compliance function owns every risk. It does not; the first line owns risk, compliance provides independent challenge.
Know the supervisor's toolkit: licensing and approvals, information requests, thematic reviews, on-site inspections, remediation directives, and enforcement powers. Questions often probe proportionality, supervisory expectations versus binding rules, and how regulatory change is implemented (gap analysis, policy updates, training, testing).
Worked example / rule of thumb: When a question asks "what must the firm do," first ask which layer the requirement sits in. If it is guidance, the firm has discretion on method but not on outcome; document the rationale for any deviation. Rule of thumb: board approves appetite and framework, management implements, compliance assures, internal audit provides independent assurance.
Watch for questions on regulatory relationships: transparency with supervisors, self-identification of issues, and the consequences of concealment.