Answer-first summary for fast verification
Answer: The third line of defense should continuously monitor the bank's implementation of its ERM framework to ensure its effectiveness.
## Explanation In the three lines of defense model: - **First line of defense**: Business line managers who own and manage risks - **Second line of defense**: Risk management and compliance functions that provide oversight and guidance - **Third line of defense**: Internal audit that provides independent assurance **Option A is correct** because the third line of defense (internal audit) should indeed continuously monitor and provide independent assurance on the effectiveness of the ERM framework implementation. This aligns with their role of providing objective assessment and ensuring the framework is working as intended. **Option B is incorrect** because business line managers (first line) should not have unilateral authority to make risk mitigation decisions without oversight. The three lines of defense model requires appropriate checks and balances - the second line provides oversight and the third line provides independent assurance. Business decisions regarding risk mitigation should be made within the bank's established risk appetite framework and with appropriate oversight from the risk management function. The CRO's goal to ensure the ERM framework reflects the bank's risk appetite and risk culture requires proper governance where all three lines work together with clear roles and responsibilities.
Author: LeetQuiz .
Ultimate access to all questions.
A community bank uses the three lines of defense approach to manage its operational risk exposures. The bank is in the process of implementing an enterprise risk management (ERM) framework, and the CRO decides to extend the three lines of defense approach to its implementation of ERM. The CRO also wants to ensure that the ERM framework appropriately reflects the bank's risk appetite and risk culture. Which of the following actions should the CRO recommend for the bank to take?
A
The third line of defense should continuously monitor the bank's implementation of its ERM framework to ensure its effectiveness.
B
Business line managers, as part of the first line of defense, should have the authority to make decisions regarding risk mitigation without oversight from the second or third lines of defense.
No comments yet.