Answer: Business line managers, as part of the first line of defense, should have the authority to take on risk exposures within the bank's risk appetite limits.

B is correct. Business line managers are part of the first line of defense. As the primary risk owners, they should have the authority to expose the bank to risks within its risk appetite limits. This ensures that risk-taking is managed at the point of origination and is aligned with the bank's overall risk strategy and tolerance. A is incorrect. The risk management function, which is part of the second line of defense, should have the responsibility of continuously monitoring the bank's implementation of its ERM framework to ensure its effectiveness. The third line of defense, which includes internal or external auditors, is meant to provide an independent review of the firm's risk management framework. C is incorrect. Risk culture indicators are useful for tracking the current state and trends in risk culture as part of an ERM program. However, they are not designed to accurately quantify the losses that could occur due to failures in risk culture. Quantifying such losses is complex and often requires a combination of qualitative and quantitative assessments. D is incorrect. The third line of defense, not the second, is responsible for performing an independent review of the design and effectiveness of the firm's risk management framework. This review should be conducted by auditors who are independent of both the risk management function and the firm's senior management to ensure objectivity and integrity in the assessment process.

Author: LeetQuiz Editorial Team