Governance, Risk Management and Internal Controls
The Three Lines and the Board
Candidates should understand the division of responsibilities: the board sets strategy and risk appetite and provides challenge; the first line owns and manages risk; the second line provides independent oversight, frameworks, and limits; the third line (internal audit) provides independent assurance and reports to the board or audit committee. Key concepts include fitness and propriety of directors and senior managers, the senior manager or prescribed responsibility regime, conflicts of interest at board level, the risk appetite statement and its cascade into limits, and the control environment (policies, procedures, segregation of duties, reconciliation, authorisation).
Traps
Questions often blur risk ownership and risk oversight: the second line does not own business risk. Another trap is treating internal audit as part of the control process rather than as assurance over it. Independence questions frequently hinge on reporting lines: audit should have unrestricted access to the audit committee, and the head of audit should not be performance-managed by the CFO.
Rule of thumb
If a proposal makes the second line responsible for executing a control, or makes audit responsible for fixing a finding, the answer is wrong. Ownership stays with the business; oversight and assurance are separate.
Worked example
A compliance function is asked to sign off every new client onboarding file. That converts the second line into a first-line control and creates a conflict with its oversight role. Better design: the business performs and evidences due diligence against a compliance-owned policy, compliance monitors a sample, and audit independently tests the framework.