Governance, Ethics, and Compliance
Core idea
Governance provides the structure of accountability within which risk decisions are made. Candidates must understand the board's role in setting appetite and overseeing the risk framework, the distinction between executive management (who run risk) and oversight functions (who challenge it), and the three-lines model: operational management owns risk, a risk and compliance function provides frameworks and challenge, and internal audit provides independent assurance.
Ethics and compliance
Know the difference between compliance (meeting legal and regulatory obligations), ethics (doing what is right beyond minimum requirements), and conduct risk (the risk that behaviour harms customers, markets or the firm). Understand conflicts of interest, whistleblowing channels, speak-up culture, tone at the top, and the role of codes of conduct. Recognise regulated concepts such as fitness and propriety, senior manager accountability, treating customers fairly, and market abuse.
Traps
Questions often test independence: internal audit must not design the controls it later audits, and a risk committee must not be dominated by the executives whose risks it oversees. Another trap is equating legal compliance with ethical adequacy; something can be lawful yet unacceptable. Watch also for the assumption that a policy's existence demonstrates a compliant culture.
Worked rule of thumb
Apply a two-question test to any governance arrangement: who is accountable, and who independently challenges them? If the same person answers both, independence is compromised. A well-governed decision shows a named accountable executive, documented rationale against appetite, and evidence of challenge from a separate function.