Governance, Frameworks, and Standards
Governance questions ask who is accountable, what authority they have, and which framework does what. Candidates lose marks by naming standards without explaining their scope or by conflating the three lines.
Roles and accountability
The board sets risk appetite and oversees the framework; the risk committee provides focused oversight; the CRO leads the framework and challenge; risk owners are accountable for specific risks; internal audit provides independent assurance. The IIA three lines model distinguishes first-line ownership and management of risk, second-line expertise, support, monitoring and challenge, and third-line independent assurance. The second line does not own the risk, and the third line does not manage it.
Frameworks and standards
- ISO 31000:2018 gives principles, a framework and a process. It is guidance and is not certifiable.
- COSO ERM 2017 frames enterprise risk management around governance and culture, strategy and objective-setting, performance, review and revision, and information, communication and reporting, with 20 principles. It is strong on linking risk to strategy and performance.
- ISO 27001 is a certifiable ISMS standard; ISO 22301 is a certifiable business continuity standard; NIST CSF organizes outcomes into Identify, Protect, Detect, Respond and Recover, with a Govern function added in CSF 2.0.
- Regulatory regimes such as Basel III and Solvency II impose their own capital and governance expectations.
Worked example
A firm wants a board-level ERM language, an auditable information security management system, and a common risk process. Reasoning: use COSO ERM for enterprise governance and strategy linkage, ISO 27001 for the certifiable ISMS, and ISO 31000 as the shared process vocabulary. Map objectives and controls once, then cross-reference, so the same control is not documented three times. The board approves appetite statements with numeric and qualitative limits; committees receive evidence against those limits.
Traps that cost marks
Claiming ISO 31000 certification; treating COSO and ISO 31000 as interchangeable; writing policies without delegated authority or limits; confusing second-line challenge with third-line assurance; an appetite statement with no measurable limits; duplicating frameworks instead of mapping them; assuming a framework guarantees effective risk management.