Risk Management Framework and Governance
Domain focus
The BKR syllabus tests whether you can explain how a Malaysian bank's board and senior management own risk. Expect questions on the three lines of defence, board risk committees, risk appetite statements (RAS), the role of the CRO, new product approval and technology risk governance under BNM's RMiT.
Core rules
- The board approves the risk management framework and RAS and receives independent risk reporting; it cannot delegate ultimate responsibility.
- First line: business units identify and own risk. Second line: independent risk and compliance set limits, challenge and monitor. Third line: internal audit provides independent assurance.
- The CRO should be independent of revenue lines, have direct access to the Board Risk Committee, and not chair a committee dominated by business heads.
- BNM's Corporate Governance policy document expects directors to understand material risks and to align remuneration with risk outcomes.
- New products require a pre-launch risk assessment and approval under BNM's new product guidance; material outsourcing needs due diligence and board oversight.
Worked example
A bank's Head of Corporate Banking chairs the Management Risk Committee, which approves credit limits. The CRO reports to that committee. This collapses the first and second lines: the business head controls risk decisions. The fix is to separate the committees, have the CRO report to the Board Risk Committee, and document the change.
Traps
Do not call internal audit the second line. Do not say the CRO sets risk appetite alone. Do not treat the RAS as a qualitative statement only - it needs limits and metrics.