Governance, Risk, and Compliance Foundations
This domain tests whether you can explain how governance, risk, and compliance operate as one connected system rather than three silos, and how a board's stated appetite becomes an operational decision someone can be held to.
The three disciplines
- Governance is the system of direction and oversight: the board and its committees, delegation of authority, tone at the top, and accountability for risk-taking.
- Risk management is the coordinated set of activities to direct and control risk (ISO 31000:2018), from establishing context through identification, analysis, evaluation, treatment, and review.
- Compliance is both an outcome (obligations are met) and a management system (ISO 37301 describes a compliance management system built on risk-based design). Compliance is not a synonym for legal.
Appetite, tolerance, capacity
Risk capacity is the maximum risk the organization could bear before existential harm - a constraint. Risk appetite is the amount and type of risk it is willing to pursue to meet objectives - a board-level choice, documented in a statement with qualitative boundaries and quantitative limits. Tolerance is the acceptable variation around a specific objective or metric. Appetite is set by the governing body; tolerance is operationalized through limits, thresholds, and key risk indicators that trigger escalation.
The Three Lines Model
The IIA's 2020 model: the first line is operational management, which owns and manages risk; the second line is risk, compliance, and quality functions, which provide expertise, challenge, and monitoring but do not own the risk; the third line is internal audit, which gives independent assurance to the governing body. External audit and regulators sit outside the model.
Worked example
A board states: "We accept only low risk of regulatory breach." Compliance converts this into a tolerance - no more than 2% of tracked regulatory obligations overdue - and a KRI that escalates to the board risk committee at 1.5%. The overdue log reaches 1.7%: inside tolerance, so management escalation only. At 2.5% the tolerance is breached and the board must decide whether appetite has been exceeded, even if no regulator has noticed. Every link in that chain has a named owner.
Traps that cost marks
- Treating second-line challenge as risk ownership.
- Assuming "no regulatory finding" means "within appetite."
- Confusing capacity (a hard constraint) with appetite (a deliberate choice).
- Letting internal audit take management decisions, which destroys third-line independence.