Learning Outcomes
After reading this article, you will be able to explain the importance of risk governance, distinguish the three lines of defense, describe board and management oversight structures, and analyze how risk appetite frameworks shape organizational risk culture for CFA Level 3. You will also be able to apply the three lines model to CFA-style situational questions.
CFA Level 3 Syllabus
For CFA Level 3, you are required to understand the structure and practical application of risk governance and appetite frameworks. In particular, focus your revision on:
- The components of a robust risk governance framework and the role of board oversight
- The 'three lines of defense' model and distinctions between each line
- How risk appetite is defined, communicated, and embedded in governance
- Oversight roles for risk committees, audit functions, and senior management
Test Your Knowledge
Attempt these questions before reading this article. If you find some difficult or cannot remember the answers, remember to look more closely at that area during your revision.
- Which organizational body is responsible for setting enterprise risk appetite and approving major risk policies?
- Briefly describe the responsibilities of each line in the three lines of defense model.
- What is the primary distinction between risk oversight and risk ownership?
- True or false? The internal audit function should take an active role in day-to-day risk management decisions.
Introduction
Effective risk governance is essential for managing and controlling risk within financial and investment organizations. CFA candidates are expected to know how formal risk appetite is established, how organization-wide risk governance structures are designed, and how the three lines of defense model distributes risk management and oversight responsibilities across different functions. Understanding the roles of management, risk oversight, and independent assurance is critical, as these concepts underpin strong risk-aware culture and effective controls expected at Level 3.
Key Term: risk governance
The system of structures, authorities, and processes by which risk oversight and management is directed and controlled across the organization.
THE RISK GOVERNANCE FRAMEWORK
Robust risk governance creates clear accountability for identifying, assessing, monitoring, and reporting risks across the institution. It ensures that risk-taking is aligned with the institution’s strategic goals and risk appetite set by the board of directors. The framework formally outlines who owns risks, who oversees risk management, and who provides independent assurance of risk controls.
Oversight Structures
The board of directors holds ultimate accountability for risk oversight, setting the risk appetite and culture. Senior management implements the risk framework, delegates risk-taking responsibilities, and ensures embedded risk controls. Risk committees, audit committees, and chief risk officers (CROs) are essential to effective oversight.
Key Term: risk appetite
The level and type of risk an organization is willing to accept in pursuit of its strategic objectives, defined and approved by the board.
The Three Lines of Defense Model
The three lines of defense structure clarifies how risk management is distributed across the organization:
-
First Line: Business units and front-line management. They own and manage risks in daily activities. They are responsible for identifying, assessing, and mitigating risks within their area using established controls.
-
Second Line: Risk management and compliance functions. These functions provide oversight, set risk policies, monitor limits, and support front lines. They do not manage risks day to day but assist with frameworks, training, and risk monitoring.
-
Third Line: Independent assurance, typically internal audit. This function evaluates the design and effectiveness of controls and risk frameworks put in place by the first and second lines. It is entirely independent of operations and risk oversight.
Key Term: three lines of defense
A governance model dividing risk management roles among: (1) front line business risk owners, (2) risk oversight/compliance functions, and (3) internal audit.Key Term: risk oversight
Monitoring, reviewing, and challenging the organization’s risk management practices to ensure risks are managed within the approved risk appetite and policies.Key Term: risk owner
The person, role, or business unit directly responsible for managing a specific risk within approved policies and procedures.
Worked Example 1.1
A CFA candidate is reviewing a scenario where an investment firm’s risk committee notices that the front-office trading desk regularly exceeds daily VAR limits but argues that it is “within the spirit” of risk policy. Who is responsible for reporting and escalating this breach under the three lines model, and what should the second line do?
Answer:
The trading desk (first line) is responsible for risk ownership, including reporting limit breaches. The risk management function (second line) must independently monitor and escalate breaches to senior management and risk committees, ensuring the issue is formally addressed and appropriate controls are enforced.
RISK APPETITE AND CULTURE
The board of directors sets the risk appetite statement, outlining acceptable types and levels of risk. Effective communication of risk appetite is achieved through policy documents, risk limits, and embedding expectations in business planning. Management must ensure strategy and risk-taking are consistent with risk appetite, and make adjustments to business activity if risk limits are threatened.
A healthy risk culture is critical—individuals are expected to act ethically, challenge risk decisions, and escalate issues without fear.
Worked Example 1.2
A global asset manager states in its risk appetite that it will accept liquidity risk up to $10m of daily net outflows but is “zero tolerant” for non-compliance risk. During a quarterly review, compliance finds evidence that an order was executed in breach of regulatory requirements but the financial loss was minimal. What is the responsibility of the risk oversight function, and what should happen to the breach?
Answer:
The risk oversight function (second line) must escalate non-compliance breaches regardless of financial loss, since the risk appetite is zero tolerance for this risk type. The breach should be reported to senior management, and root causes identified, irrespective of financial materiality.
RISK GOVERNANCE ROLES AND OVERSIGHT
- Board of Directors: Establishes risk governance, approves risk appetite statement, reviews risk policy and material risk exposures, and oversees management.
- Senior Management: Implements board-approved risk framework, delegates authority, monitors limits, and sets tone for risk culture.
- Risk Committees: Oversee specific risk areas and review risk reporting from lines one and two; recommend policy changes.
- CRO/risk function: Reports independently to the board/audit risk committee; ensures risks are monitored and escalated.
- Internal Audit: Provides independent assurance that controls work as intended; reports to the audit committee, not management.
Exam Warning
Internal audit should not participate in designing day-to-day controls or risk decisions. Its role is independent assessment only. For the exam, mixing assurance with operational risk management is a frequent error.
Summary
Strong risk governance relies on clear distinction between risk ownership (first line), risk oversight (second line), and independent assurance (third line). Board-approved risk appetite steers risk-taking and is embedded through policy and culture. Oversight functions challenge, support, and monitor management actions to enforce risk discipline and prevent escalation of uncontrolled risks.
Key Point Checklist
This article has covered the following key knowledge points:
- The purpose and structure of risk governance in financial organizations
- Board and management duties in setting risk appetite and oversight
- The three lines of defense model: responsibilities and separation of roles
- Communication and enforcement of risk appetite throughout the organization
- Differences between risk ownership and risk oversight roles
Key Terms and Concepts
- risk governance
- risk appetite
- three lines of defense
- risk oversight
- risk owner