Risk Management Fundamentals and Governance
Foundations and governance
Risk management begins with a simple definition: risk is the effect of uncertainty on objectives. That definition matters in questions because it includes upside and downside, and it ties risk to objectives rather than to a list of hazards. Candidates should know the governance chain: the board sets risk appetite, approves the framework, and oversees the chief risk officer; a risk committee coordinates; business units own risk; the three lines model separates ownership (first line), independent oversight (second line), and assurance (third line). Distinguish appetite, tolerance, and capacity. Appetite is the amount and type of risk the organization is willing to pursue to meet strategic objectives. Tolerance is the quantified boundary within appetite for a specific risk. Capacity is the maximum risk the organization can bear before breaching capital, liquidity, or reputational limits.
Traps appear when questions use appetite, tolerance, and capacity interchangeably, or imply that governance is only a policy manual. Governance is decision rights, accountability, escalation, and evidence that the framework operates. Another trap is treating risk management as a compliance exercise; strong answers connect risk to strategy, performance, and resource allocation. Watch for questions that assume the second line owns operational risk - it does not; the business owns it, while the second line challenges and aggregates.
Worked example: a board states it will accept no more than a 5% annual chance of losing more than $10 million from any single event. That is appetite expressed as a statement plus a metric. The CFO then sets a $2 million single-event tolerance for a business unit. The unit's modeled worst case is $4 million, so it exceeds tolerance but may still sit within capacity; the answer is to reduce exposure or escalate, not simply to buy insurance.
Rule of thumb: appetite is a statement, tolerance is a number, capacity is a hard boundary.