Risk Management Frameworks and Governance
Risk Management Frameworks and Governance
This domain tests whether you can connect a risk framework to board-level governance rather than treat risk as a register kept by one officer. Expect questions on ISO 31000:2018 principles, the COSO ERM 2017 components, risk appetite, and the roles of the board, risk committee, chief risk officer and the three lines.
Core rules
- ISO 31000 is principles-based: risk is the effect of uncertainty on objectives; the process is iterative and should be integrated, structured and tailored.
- COSO ERM 2017 uses five components - governance and culture, strategy and objective-setting, performance, review and revision, and information, communication and reporting - supported by 20 principles.
- The board sets risk appetite and oversees the framework; management executes within approved limits. The three lines model separates operational ownership (first), risk and compliance oversight (second), and independent assurance (third).
- Risk appetite is the amount of risk the organisation is willing to accept in pursuit of objectives. Risk tolerance is the acceptable variation around a specific objective or limit.
Worked example
A company wants a new central registry. The board approves a low appetite for records loss. The first line (registry manager) owns the risk and designs controls. The second line (risk and compliance) challenges the assessment and confirms the appetite statement. Internal audit (third line) tests whether backups and access controls work. The board risk committee receives a one-page report showing residual risk within appetite. Reasoning: each role has a distinct mandate; the board does not manage the control, but it sets the boundary and receives assurance.
Traps that cost marks
- Treating risk appetite as a number without linking it to objectives.
- Confusing risk tolerance with risk appetite.
- Assuming the risk committee owns operational risks; ownership sits with management.
- Describing the three lines as a reporting hierarchy rather than separate mandates.