Risk Management Framework and Governance
The framework as a control system
A risk management framework is the documented structure of roles, policies, processes, and limits through which an organization identifies, measures, controls, monitors, and reports risk. Candidates should be able to distinguish the three lines model: the first line (business units) owns risk and takes it; the second line (risk, compliance) sets frameworks, challenges, and aggregates; the third line (internal audit) provides independent assurance. A frequent trap is assigning risk ownership to the second line - the CRO advises and aggregates but does not own business risk.
Governance components
Know the elements: board-level risk appetite statement, delegated authority and limits, committee structure (board risk committee, management risk committee, ALCO), policy hierarchy (board policy, framework, standards, procedures), and escalation paths. Understand that risk appetite is set top-down and translated into cascading limits and tolerances; risk capacity is the maximum risk the institution can bear before breaching capital or liquidity constraints, and appetite must sit below capacity. Questions often test whether a limit breach is a governance failure (escalation and remediation) rather than merely an operational error.
Culture and incentives
Governance includes conduct, tone at the top, whistleblowing channels, and compensation that does not reward excessive risk-taking. Traps: confusing a strong control environment with a strong risk culture; assuming a framework prevents risk rather than managing it; treating the three lines as sequential rather than independent.
Rule of thumb
For any scenario, ask: who owns it, who sets the limit, who monitors independently, and who escalates? If a single function answers more than one of these questions without challenge, the governance answer is likely deficient. Worked example: a trading desk exceeds its VaR limit; the desk (first line) reports, risk (second line) verifies and escalates to the CRO and committee, audit (third line) later tests the process - the breach itself is not a governance failure, but unreported or unescalated breach is.