Financial Risk Manager Part 2

Get started today

Ultimate access to all questions.

Explanation:

In the three lines of defense model, business line managers act as the first line of defense. They own and manage the risks associated with their activities, which includes having the authority and responsibility to take on risks within the defined boundaries of the bank's risk appetite.

Option A is incorrect because the third line of defense (internal audit) provides independent assurance, but does not perform continuous daily monitoring of implementation; that is a management function.
Option C is incorrect because while risk culture indicators are useful, risk culture is qualitative and its failures cannot be accurately quantified into expected losses.
Option D is incorrect because the executive committee is part of senior management, not typically classified as the second line of defense (which comprises risk management and compliance functions), nor does it perform an independent review akin to internal audit.

Explanation:

Option A is incorrect because the third line of defense (internal audit) provides independent assurance, but does not perform continuous daily monitoring of implementation; that is a management function.
Option C is incorrect because while risk culture indicators are useful, risk culture is qualitative and its failures cannot be accurately quantified into expected losses.
Option D is incorrect because the executive committee is part of senior management, not typically classified as the second line of defense (which comprises risk management and compliance functions), nor does it perform an independent review akin to internal audit.

Comments (0)

No comments yet.

Question A community bank uses the three lines of defense approach to manage its operational risk exposures. The bank is in the process of implementing an enterprise risk management (ERM) framework, and the CRO decides to extend the three lines of defense approach to its implementation of ERM. The CRO also wants to ensure that the ERM framework appropriately reflects the bank’s risk appetite and risk culture. Which of the following actions should the CRO recommend for the bank to take?

Exam-Like

Community

UAnonymous

Last updated: July 5, 2026 at 07:28

The third line of defense should continuously monitor the bank’s implementation of its ERM framework to ensure its effectiveness.

Business line managers, as part of the first line of defense, should have the authority to take on risk exposures within the bank’s risk appetite limits.

The bank should implement a set of risk culture indicators as part of its ERM framework in order to accurately quantify the losses that could occur due to failures of risk culture.

As part of the second line of defense, the executive committee should perform an independent review of the bank’s risk management framework.