Risk Governance
What the exam tests
Risk governance tests who owns risk, who oversees it, and how independence is preserved. Expect questions on board responsibilities, risk committees, the chief risk officer, the three lines of defense, and the difference between governance and management.
Core rules and concepts
- The board sets risk appetite and oversees the risk framework; senior management implements it. The board cannot delegate accountability to the CRO.
- A board risk committee should have independent members and direct access to the CRO and internal audit.
- The three lines of defense are: business units that own and manage risk; a risk and compliance function that oversees and challenges; and internal audit that provides independent assurance.
- The CRO should be independent of revenue-producing units and should have stature, resources, and access to the board.
- In Pakistan, the SECP Code of Corporate Governance 2019 and SBP governance and risk management guidelines require boards to approve risk strategies and receive regular risk reports.
- Risk committees approve limits, review exceptions, and escalate breaches.
Worked example
A bank’s board-approved risk appetite statement caps single-obligor exposure at 10% of Tier 1 capital. Tier 1 capital is PKR 40 billion, so the cap is PKR 4 billion. A relationship manager proposes a PKR 4.6 billion facility. The credit committee cannot approve it within delegated authority. The correct action is to decline or restructure the facility, or ask the board to approve a temporary, documented exception after assessing concentration risk. Approval by the CRO alone would not cure the breach because the CRO does not own the board’s appetite.
Traps that cost marks
Do not place internal audit under the CFO or CRO. Do not describe the board as managing risk day to day. Do not equate compliance with risk management: compliance tests rules, risk management takes risk deliberately within limits. Do not let a committee approve exposures outside its delegated authority.