Risk Management Fundamentals and Governance
Risk Management Fundamentals and Governance
This domain tests whether you can classify a risk correctly, trace accountability through the governance hierarchy, and convert a board risk appetite into limits a desk can actually operate. Questions are scenario-driven - a limit breach, a new product, an unclear escalation path - rather than definition recall.
Taxonomy and the three lines
Market, credit, counterparty, liquidity, operational, compliance and conduct, strategic and reputational risk. Only some are capitalised; strategic and reputational risk normally sit in the appetite statement without a Pillar 1 charge. Risk aggregation must state its correlation assumptions, because silo totals understate group risk.
The three lines of defence: the first line (business) owns and manages risk; the second line (risk function, compliance) sets frameworks, challenges, aggregates and monitors, but never owns the risk; the third line (internal audit) gives independent assurance to the audit committee. The CRO should report to the board risk committee with a reporting line that protects independence from revenue.
From appetite to limit
Board approves the risk appetite statement (qualitative statement plus quantitative metrics). Tolerance is acceptable deviation around it. Limits are hard boundaries with pre-agreed escalation: trigger, owner, timeframe, remediation. Hierarchy: appetite statement, risk policies, procedures, desk limits, triggers.
Worked example
An RCSA on a new instant-payment channel rates the likelihood of a duplicate-payment event 4 of 5 and impact 5 of 5: inherent score 20. Two controls exist, same-day reconciliation and automated duplicate detection, assessed as 45% effective. Residual = 20 x (1 - 0.45) = 11. The operational risk appetite threshold for this process is 9. Because 11 exceeds 9 the process is outside appetite: escalate to the operational risk committee, add a compensating pre-settlement velocity check, and re-score within 30 days. Note the ordering: score inherent, apply effectiveness once, compare to threshold.
Traps
- Saying the second line accepts or owns risk. It challenges; the business accepts.
- Netting controls twice, or applying effectiveness before the impact assessment.
- Confusing risk appetite (what we want) with tolerance (how much deviation is allowed).
- Writing a risk appetite statement with no escalation rule - most marks sit in the and-then-what step.
- Assuming internal audit sets limits or signs off risk acceptance.