Governance, Ethics and Risk Culture

Introduction

Fraud, cyber risk and financial crime are often described as failures of technology, procedures or individual behaviour. In practice, serious incidents usually reveal a broader governance failure: unclear accountability, weak challenge, incentives that reward volume over integrity, ineffective escalation, or a culture in which employees fear speaking up. Governance and ethics therefore form the organisational infrastructure through which financial-crime controls become reliable—or ineffective.

For banks, insurers and other financial institutions, governance is not limited to the board’s formal compliance with law. It concerns how authority is allocated, how decisions are challenged, how risk information travels, and how the organisation responds when commercial objectives conflict with customer protection or legal obligations. Risk culture is the shared pattern of values, assumptions and behaviours through which employees understand and manage risk.

This chapter examines board and senior-management accountability, the three-lines model, compliance independence, conduct risk, whistleblowing, conflicts of interest, remuneration, ethical decision-making and the development of a speak-up and control-conscious culture.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain the relationship between governance, ethics, risk culture and financial-crime management.
2. Evaluate the responsibilities of boards, senior managers and control functions.
3. Apply the three-lines model to fraud, cyber risk and financial-crime risks.
4. Analyse conduct risk, conflicts of interest and remuneration-related risk.
5. Explain the purpose and characteristics of effective whistleblowing arrangements.
6. Use ethical decision-making frameworks in practical banking and insurance scenarios.
7. Recommend measures for developing a speak-up and control-conscious culture.

1. Governance, Ethics and Risk Culture

1.1 Governance as an accountability system

Corporate governance is the system by which an organisation is directed, controlled and held accountable. It includes the distribution of authority among the board, executive management, shareholders, control functions and other stakeholders. In a financial institution, governance must answer five connected questions:

• Who owns a risk?
• Who is authorised to make the relevant decision?
• Who independently challenges that decision?
• Who receives timely and reliable information?
• Who is accountable when controls fail?

Governance is effective when responsibility is explicit, information is credible, challenge is independent and consequences are proportionate. It is ineffective when responsibility is dispersed, committees merely endorse management proposals, or risk information is suppressed or presented too late.

1.2 Ethics and compliance

Compliance asks whether conduct meets applicable laws, regulations and internal rules. Ethics asks whether conduct is responsible, fair and defensible, including where the law is incomplete or ambiguous. Legal compliance is a minimum standard; ethical conduct requires consideration of customers, markets, colleagues and society.

For example, a bank may technically comply with disclosure requirements while designing a product that customers are unlikely to understand. A claims department may follow an internal procedure while treating vulnerable policyholders unfairly. Ethical governance addresses these situations by considering purpose, fairness, transparency, consequences and the institution’s duty to maintain trust.

1.3 Risk culture

Risk culture is not a slogan or a single survey score. It is demonstrated through repeated behaviour. Observable indicators include:

• whether staff escalate unusual transactions;
• whether managers welcome inconvenient information;
• whether control breaches are recorded honestly;
• whether targets are adjusted when risk increases;
• whether senior people are held accountable;
• whether employees believe that speaking up is safe; and
• whether lessons from incidents are implemented rather than merely documented.

A strong culture does not mean avoiding all risk. Financial institutions must take calculated risks to provide credit, insurance and payment services. A strong culture means that risk-taking is understood, authorised, monitored and consistent with the institution’s purpose and capacity.

2. Board and Senior-Management Accountability

2.1 The board’s role

The board is ultimately responsible for the institution’s strategy, governance and oversight. It does not perform every control, but it must ensure that an adequate control environment exists. In relation to fraud, cyber risk and financial crime, board responsibilities commonly include:

1. approving risk appetite and financial-crime policies;
2. ensuring that risk management is integrated with strategy;
3. appointing competent senior leaders and monitoring their performance;
4. receiving meaningful information about incidents, vulnerabilities and trends;
5. challenging optimistic assumptions and management explanations;
6. ensuring adequate resources for compliance, cyber security, audit and investigations;
7. overseeing regulatory obligations and remediation; and
8. demonstrating that misconduct is unacceptable, regardless of revenue or seniority.

The board should not rely solely on aggregate indicators such as the number of alerts closed. It should ask whether alerts are being closed effectively, whether thresholds suppress meaningful cases, whether backlogs are increasing, and whether customer harm is being identified.

2.2 Senior management

Senior management converts board expectations into operating arrangements. Its responsibilities include assigning risk ownership, establishing procedures, setting performance expectations, funding controls, responding to incidents and ensuring that weaknesses are corrected. A chief executive cannot delegate accountability for the control environment simply by appointing a compliance officer. However, accountability can and should be allocated to named managers with appropriate authority and resources.

A useful distinction is between responsibility and accountability. Responsibility concerns the duty to perform an activity. Accountability concerns being answerable for its outcome. A manager may assign responsibility for customer due diligence to an operations team but remains accountable for ensuring that the process is properly designed, resourced and monitored.

2.3 Information quality and escalation

Governance depends on information quality. Information provided to a board should be accurate, sufficiently complete, timely and decision-useful. A dashboard that reports only closed cases can create a false impression of effectiveness. More useful reporting may include:

• material incidents and near misses;
• overdue remediation actions;
• suspicious-activity reporting trends;
• access-control exceptions;
• control failures by business unit;
• staff turnover in high-risk functions;
• whistleblowing themes;
• repeat findings; and
• the age and severity of unresolved issues.

Escalation should be based not only on financial loss but also on legal, customer, reputational, systemic and ethical impact. A small payment may reveal a major control weakness; a near miss may provide more valuable information than a loss that is detected only after the fact.

3. The Three-Lines Model

The three-lines model clarifies how governance and risk management roles relate to one another. It is a model of contribution and accountability, not a justification for transferring ownership to compliance or audit.

3.1 First line: management and operational control

The first line consists of business and operational functions that own risks and operate controls. Examples include relationship managers, claims handlers, payment operations, information-technology teams and product managers. Their duties include:

• identifying risks arising from daily activities;
• following approved procedures;
• applying customer and transaction controls;
• recording exceptions;
• escalating suspicious or unusual activity; and
• correcting weaknesses.

The first line cannot argue that compliance “owns” a risk merely because compliance provides advice. The business that creates or accepts the risk normally owns it.

3.2 Second line: risk, compliance and specialist oversight

The second line provides expertise, frameworks, monitoring and challenge. It may include compliance, enterprise risk, information-security risk, data protection and financial-crime prevention. The second line typically:

• develops policies and risk methodologies;
• advises the first line;
• monitors compliance with standards;
• reviews risk assessments;
• reports material issues; and
• supports training and remediation.

Second-line independence must be practical, not merely shown on an organisational chart. The function should have access to senior management and the board, sufficient resources, professional competence and authority to escalate concerns.

3.3 Third line: internal audit

Internal audit provides independent and objective assurance on governance, risk management and controls. It should evaluate whether the first and second lines are appropriately designed and operating effectively. Internal audit should not design or operate controls that it later audits, because doing so creates a self-review threat.

3.4 Oversight by the board and external parties

The board, particularly its audit or risk committee, oversees the three lines. External auditors, regulators, law-enforcement agencies and other external reviewers may provide additional assurance, but they do not replace management’s responsibility.

3.5 Common failures in applying the model

The three-lines model fails when roles overlap or gaps appear. Common examples include a business unit assuming that compliance approval guarantees a safe decision; compliance becoming operationally responsible for customer due diligence; internal audit giving detailed management instructions; or the board receiving multiple reports that use inconsistent definitions. The solution is not rigid separation but clear mandates, coordinated assurance and preserved independence.

4. Independence of Compliance and Control Functions

Compliance independence means that professional judgments can be made without inappropriate commercial pressure. It does not mean isolation from the business. Effective compliance officers understand products and operations, engage constructively with managers and remain able to disagree.

Important safeguards include:

• a formal mandate approved by the board or an appropriate committee;
• direct or unrestricted access to the board and relevant committees;
• authority to escalate material concerns;
• adequate budget, staffing, skills and technology;
• transparent appointment, evaluation and removal processes;
• protection from retaliation;
• separation of compliance monitoring from sales incentives; and
• documented responses when management rejects compliance advice.

Independence has both structural and behavioural dimensions. Structural independence concerns reporting lines, authority and resources. Behavioural independence concerns professional courage, evidence-based judgment and willingness to challenge influential colleagues. A compliance officer who reports formally to the board but fears losing a bonus for delaying a profitable product is not meaningfully independent.

5. Conduct Risk and Customer Outcomes

Conduct risk is the risk that an institution’s behaviour causes unfair outcomes, market harm or loss of trust. It includes misconduct that is deliberate, negligent or caused by poorly designed systems. Examples include mis-selling, misleading communications, unfair claims handling, manipulation of benchmarks, misuse of confidential information, discriminatory service and failure to protect vulnerable customers.

Conduct risk differs from traditional operational risk because it focuses on behaviour and outcomes, not only process failure. A process may operate exactly as designed and still produce unfair outcomes.

A conduct-risk framework should examine the customer journey:

1. product design and target market;
2. marketing and sales communications;
3. pricing, underwriting or credit decisions;
4. onboarding and disclosure;
5. account servicing and complaints;
6. claims, collections or recovery;
7. exit, cancellation or remediation.

Useful questions include: Was the product suitable? Could a reasonable customer understand the key terms? Were incentives likely to encourage unsuitable sales? Were complaints analysed for systemic patterns? Did the institution repair harm promptly?

Conduct indicators should combine quantitative and qualitative evidence. For example, complaint volumes, cancellations, refund rates, employee turnover, quality-assurance results and whistleblowing themes may reveal emerging problems. No single metric proves good conduct.

6. Conflicts of Interest

A conflict of interest arises when personal, professional or organisational interests could improperly influence judgment. A conflict may be actual, potential or perceived. The fact that no improper decision has yet occurred does not eliminate the need to manage a material conflict.

Typical examples include:

• a lender approving finance for a company owned by a senior employee’s relative;
• an insurance broker receiving greater commission for one product;
• an employee trading securities while possessing confidential information;
• a procurement manager selecting a supplier with whom they have a private relationship; and
• a compliance officer investigating a process for which they previously held operational responsibility.

A practical conflict-management process is:

1. Identify the interests and relationships involved.
2. Assess whether impartiality, confidentiality or customer interests could be affected.
3. Disclose the conflict to an appropriate authority.
4. Control it through recusal, independent review, information barriers, reassignment or approval limits.
5. Record the decision and rationale.
6. Monitor whether the control remains effective.

Disclosure alone is not always sufficient. A customer may technically consent to a conflicted arrangement without understanding its consequences. Where the conflict is serious, withdrawal from the decision may be necessary.

7. Remuneration and Incentive Design

Remuneration communicates what the organisation truly values. If bonuses depend heavily on sales, loan growth, claims reduction or transaction volume, employees may rationally prioritise those outcomes even when formal policies emphasise customer protection.

Sound remuneration design should:

• balance financial and non-financial performance;
• include risk-adjusted and conduct-related measures;
• discourage excessive short-term risk-taking;
• allow malus or clawback where permitted and appropriate;
• recognise effective control performance; and
• avoid rewarding the concealment of problems.

A simple conceptual representation is:

This is not an accounting formula and does not prescribe a particular compensation system. It expresses the principle that variable reward should reflect both results and the manner in which results were achieved. “Risk adjustments” may include losses, control failures or deferred outcomes; “conduct penalties” may include substantiated misconduct or failure to escalate. The design must comply with applicable employment, regulatory and contractual rules.

For example, a sales employee who reaches a target by selling unsuitable products should not receive the same reward as one who achieves the target through appropriate advice. Similarly, a manager who reports a serious weakness early may have performed better from a governance perspective than one who meets targets while concealing the weakness.

8. Whistleblowing and Speak-Up Arrangements

Whistleblowing is the reporting of suspected wrongdoing, risk or misconduct through an internal or external channel. It differs from an ordinary complaint because it commonly concerns wrongdoing affecting the organisation, customers, markets or the public interest.

An effective speak-up system should provide:

• multiple reporting channels, including confidential or anonymous options where legally permitted;
• clear examples of reportable concerns;
• accessibility for employees, contractors and relevant third parties;
• impartial triage and investigation;
• confidentiality and protection of information;
• protection against retaliation;
• timely acknowledgement and updates;
• documented outcomes and remediation; and
• board oversight of themes and recurring issues.

The objective is not merely to collect allegations. It is to create a trustworthy process that converts information into action. Poor systems discourage reporting through inaccessible forms, unclear ownership, repeated delays, leaks of identity or visible retaliation against reporters.

Managers are crucial. A policy cannot create speak-up culture if a supervisor dismisses concerns as disloyalty. Managers should listen, preserve evidence, avoid conducting informal retaliation, escalate appropriately and avoid promising outcomes they cannot guarantee.

Anonymous reporting can increase access for people who fear retaliation, but it can complicate investigation. Institutions should therefore permit anonymous reports where feasible while using fair procedures to assess evidence and protect those accused from unjust treatment.

9. Ethical Decision-Making

Ethical decisions are often difficult because they involve competing obligations. A useful process is not a mechanical answer but a disciplined way to expose assumptions.

The ethical decision sequence

1. Clarify the facts. What is known, unknown and potentially misleading?
2. Identify stakeholders. Who may gain, lose or be exposed to harm?
3. Identify duties and rules. What laws, policies, professional obligations and fiduciary duties apply?
4. Consider alternatives. Is there a safer way to achieve the legitimate objective?
5. Test consequences. What are the short- and long-term effects?
6. Test fairness. Would similarly situated people be treated consistently?
7. Test publicity. Would the decision remain defensible if disclosed to customers, regulators or the media?
8. Escalate and document. Record the reasoning, dissenting views and approval.
9. Review outcomes. Did the decision produce unexpected harm?

Three ethical perspectives are especially useful. A duty-based approach asks whether an action respects rules and rights. A consequence-based approach asks whether it produces acceptable outcomes and minimises harm. A virtue-based approach asks what a responsible professional or institution would do and what the action reveals about character. In financial services, these perspectives should normally be used together rather than treated as mutually exclusive.

10. Developing a Control-Conscious Culture

A control-conscious culture integrates control thinking into ordinary work rather than treating controls as a compliance obstacle. Development requires consistency between formal systems and informal signals.

Leadership and role modelling

Senior leaders should discuss controls when business performance is strong, not only after an incident. They should explain why controls protect customers and the institution, acknowledge uncertainty and admit mistakes. Visible consequences for misconduct are important, but so are visible rewards for responsible escalation.

Training and competence

Training should be role-specific and scenario-based. A payments analyst needs practice identifying unusual transaction patterns; a software engineer needs secure-development and access-control awareness; a claims manager needs training on vulnerable customers and fair treatment. Completion percentages are weak evidence of effectiveness unless supported by assessment, observation and incident outcomes.

Psychological safety

Psychological safety means that people can raise concerns, ask questions and admit mistakes without unreasonable humiliation or retaliation. It does not mean immunity from accountability. A psychologically safe institution distinguishes honest error, reckless conduct and deliberate misconduct, responding proportionately to each.

Learning from incidents

After an incident, management should examine root causes rather than focus only on the individual who executed the final act. Root causes may include unrealistic targets, excessive privileges, poor segregation of duties, weak vendor oversight, inadequate training or ignored warnings. Near misses should be analysed because they reveal control weaknesses before larger harm occurs.

Measurement

Culture can be assessed through multiple sources:

• employee surveys and interviews;
• speak-up volume and case themes;
• retaliation allegations;
• repeat control failures;
• audit findings and overdue actions;
• customer complaints and remediation;
• turnover in high-risk teams; and
• observed management behaviour.

Interpretation requires caution. A rise in whistleblowing may indicate worsening misconduct, improved trust, or both. A fall in reports may indicate improvement—or fear. Metrics must therefore be triangulated with qualitative evidence.

11. Applied Case: The Accelerated Digital Onboarding Programme

The following is a fictional illustrative case.

Background

Harbourline Bank launches a digital account-opening platform. Senior management sets an ambitious target to double new accounts in twelve months. The product team introduces automated identity verification, while compliance approves a risk-based process with enhanced review for selected applicants.

Problem

After six months, the bank experiences an increase in mule-account activity and customer complaints. Analysts notice that the system’s exception queue is growing, but operations managers discourage escalation because unresolved cases reduce productivity statistics. A compliance manager recommends pausing a high-risk marketing campaign, but the recommendation is rejected because the campaign is commercially important. An employee submits an anonymous report alleging that managers are manipulating the queue-age metric.

Analysis

The case involves several governance weaknesses:

• Board and management accountability: growth targets were not balanced with control capacity.
• First line: operations owned onboarding but treated control exceptions as performance problems.
• Second line: compliance identified risk but lacked effective escalation power.
• Information quality: a favourable productivity metric concealed the growing backlog.
• Conduct risk: customers and the financial system were exposed to misuse of accounts.
• Whistleblowing: the anonymous report indicated both a functioning channel and a potentially unsafe management environment.
• Remuneration: managers were rewarded for throughput without adequate risk adjustment.

Approach and solution

The bank should first preserve evidence, protect the reporter and appoint an independent investigation. It should then suspend or limit the campaign until risk capacity is reassessed. The board risk committee should receive a transparent report showing queue age, exception quality, mule-account indicators, complaints and unresolved recommendations.

Management should redesign incentives so that account growth is conditional on acceptable control outcomes. The first line should own the onboarding risk, while compliance should define standards, monitor outcomes and escalate independently. Internal audit should later test the revised framework without designing it. The bank should also conduct retrospective reviews of accounts opened under the affected process and remediate customer harm where necessary.

Outcome

In this illustrative case, the bank discovers that the system was not itself defective; the main weakness was the organisational response to exceptions. After the campaign is redesigned, the bank introduces a board-approved risk threshold, separates productivity reporting from case-quality reporting, and requires senior approval for unresolved high-risk backlogs. Staff survey results improve after retaliation protections are communicated and enforced.

Learning points

1. Technology cannot compensate for incentives that suppress escalation.
2. A metric may be accurate yet misleading if it excludes relevant risk information.
3. The three lines must preserve ownership, challenge and assurance.
4. Whistleblowing should trigger both case investigation and culture analysis.
5. Responsible growth requires alignment between commercial objectives and control capacity.

12. Contemporary Developments and Limitations

Digital banking, cloud services, artificial intelligence and third-party platforms are changing governance demands. Automated decision systems can scale both legitimate service and harmful outcomes. Governance should therefore address data quality, model validation, explainability, access rights, human oversight and vendor accountability. An institution remains responsible for risks that arise through outsourcing or technology procurement; delegation of activity is not delegation of accountability.

Artificial intelligence may assist transaction monitoring, anomaly detection and case prioritisation, but it can also create false positives, embed biased data, generate opaque decisions or be manipulated by criminals. Human review, documented model governance, performance monitoring and appropriate escalation remain necessary.

Governance frameworks also have limitations. Codes of ethics may become symbolic if leaders behave inconsistently. Culture surveys may suffer from response bias. The three-lines model may create bureaucracy or duplicated testing. Whistleblowing systems may be abused or produce inconclusive allegations. These limitations do not invalidate the frameworks; they demonstrate the need for judgment, evidence and continuous review.

Best-Practice Checklist

A financially responsible institution should be able to demonstrate that:

• risk ownership is assigned to named managers;
• the board receives clear, timely and decision-useful information;
• compliance and internal audit can challenge independently;
• commercial targets reflect control capacity and customer outcomes;
• conflicts are identified, managed and recorded;
• remuneration discourages misconduct and excessive risk-taking;
• whistleblowers are protected from retaliation;
• investigations are impartial and adequately documented;
• incidents and near misses produce measurable learning; and
• culture is assessed through several sources rather than one metric.

Chapter Summary

Governance, ethics and risk culture determine whether formal fraud, cyber and financial-crime controls operate effectively in practice. The board is responsible for oversight, risk appetite, resources and accountability, while senior management converts expectations into processes, incentives and behaviour. The three-lines model distinguishes operational ownership, second-line challenge and third-line independent assurance, but it does not permit management to transfer accountability to compliance or audit.

Compliance independence requires authority, resources, access and protection from commercial pressure. Conduct risk focuses on customer and market outcomes, including harm produced by processes that technically operate as designed. Conflicts of interest must be identified, assessed, controlled and documented. Remuneration should reward sustainable and ethical performance rather than short-term volume alone. Effective whistleblowing systems provide safe channels, impartial investigation and protection against retaliation.

A control-conscious culture is built through leadership example, psychological safety, relevant training, reliable information, proportionate consequences and learning from incidents. Technology and artificial intelligence can strengthen controls but cannot replace governance judgment. Ultimately, ethical risk management is demonstrated not by policies alone, but by what an institution does when commercial pressure, uncertainty and inconvenient information arise together.

Key Terms

Governance: The system by which an organisation is directed, controlled and held accountable.

Ethics: Principles concerning responsible, fair and defensible conduct.

Risk culture: Shared values, assumptions and behaviours concerning risk.

Accountability: The obligation to answer for decisions, actions and outcomes.

Responsibility: The assigned duty to perform an activity or task.

Three-lines model: A framework distinguishing operational ownership, specialist oversight and independent assurance.

First line: Business and operational functions that own risks and operate controls.

Second line: Risk and compliance functions that set standards, monitor and challenge.

Third line: Internal audit, which provides independent and objective assurance.

Compliance independence: The ability of compliance professionals to exercise judgment without inappropriate influence.

Conduct risk: The risk of unfair customer, market or stakeholder outcomes caused by organisational behaviour.

Conflict of interest: A situation in which interests may improperly influence judgment.

Remuneration risk: The risk that pay and incentives encourage excessive risk-taking or misconduct.

Whistleblowing: Reporting suspected wrongdoing or serious risk through an authorised channel.

Psychological safety: A climate in which people can raise concerns or admit mistakes without unreasonable retaliation.

Speak-up culture: An environment that encourages concerns to be raised and acted upon.

Control-conscious culture: A culture that integrates risk and control considerations into everyday work.

Risk appetite: The level and type of risk an institution is willing to accept in pursuit of its objectives.

Malus and clawback: Mechanisms for reducing or recovering variable remuneration after misconduct or adverse outcomes.

Review Questions

Short Answer Questions

1. What is the difference between responsibility and accountability?
2. Identify the principal contributions of the three lines.
3. Why is legal compliance not always sufficient for ethical conduct?
4. List four characteristics of an effective whistleblowing system.
5. What is conduct risk?

Long Answer Questions

1. Explain how the board and senior management should oversee fraud, cyber risk and financial-crime risk.
2. Discuss the importance and practical safeguards of compliance independence.
3. Explain how remuneration can either strengthen or weaken risk culture.
4. Compare duty-based, consequence-based and virtue-based approaches to ethical decision-making.
5. Evaluate the role of psychological safety and incident learning in developing a speak-up culture.

Analytical / Application Questions

1. A bank rewards branch managers solely for loan growth. Several managers begin approving loans with incomplete customer information. Using the three-lines model and remuneration principles, analyse the governance failures and recommend corrective action.
2. An employee reports suspected manipulation of cyber-incident statistics but later claims that their manager has excluded them from meetings. Design an appropriate institutional response, including investigation, protection and board reporting.
3. An insurer’s automated claims model rejects claims at a higher rate for a particular customer group, although the model follows its approved procedure. Analyse the conduct, ethical and governance issues and propose a control framework for responding to the problem.

Multiple Choice Questions with Answers

Question 1

Which function primarily owns and operates day-to-day controls under the three-lines model?

A. The first line

B. The second line

C. The third line

D. The external regulator

Correct Answer: A. The first line

Question 2

What is the central purpose of the second line?

A. To approve every operational transaction

B. To provide risk expertise, monitoring and challenge

C. To replace business management accountability

D. To conduct only financial-statement audits

Correct Answer: B. To provide risk expertise, monitoring and challenge

Question 3

Which statement best describes compliance independence?

A. Compliance must never communicate with business units

B. Compliance may exercise professional judgment without inappropriate commercial pressure

C. Compliance must own every operational risk

D. Compliance is independent only when it reports to the chief executive

Correct Answer: B. Compliance may exercise professional judgment without inappropriate commercial pressure

Question 4

Which situation is most clearly a conflict of interest?

A. An employee completes required training

B. An auditor reviews evidence from an unrelated department

C. A procurement manager selects a supplier owned by a close relative

D. A compliance officer reports a control weakness

Correct Answer: C. A procurement manager selects a supplier owned by a close relative

Question 5

Why can a rise in whistleblowing reports be difficult to interpret?

A. It always proves misconduct has increased

B. It always proves the culture has improved

C. It may reflect increased trust, increased misconduct, or both

D. Whistleblowing reports cannot be used for governance analysis

Correct Answer: C. It may reflect increased trust, increased misconduct, or both

Question 6

Which remuneration design is most consistent with a sound risk culture?

A. Rewarding sales volume without regard to customer outcomes

B. Paying bonuses only for short-term revenue

C. Balancing financial performance with conduct and risk outcomes

D. Removing all variable remuneration from every role

Correct Answer: C. Balancing financial performance with conduct and risk outcomes

Question 7

A process follows its written procedure but consistently produces unfair customer outcomes. Which risk is most directly illustrated?

A. Conduct risk

B. Foreign-exchange risk

C. Liquidity risk

D. Settlement risk

Correct Answer: A. Conduct risk

Question 8

What is the principal independence safeguard for internal audit?

A. It designs and operates the controls it later reviews

B. It provides objective assurance without owning the controls under review

C. It reports only to the business unit being audited

D. It approves all customer transactions

Correct Answer: B. It provides objective assurance without owning the controls under review

Question 9

Which response is most appropriate after receiving a serious whistleblowing allegation?

A. Ignore it unless a financial loss has already occurred

B. Immediately disclose the reporter’s identity to the accused manager

C. Protect the reporter, preserve evidence and arrange an impartial assessment

D. Allow the manager named in the allegation to control the investigation

Correct Answer: C. Protect the reporter, preserve evidence and arrange an impartial assessment

Question 10

What does a control-conscious culture require?

A. Avoiding all business risk

B. Treating controls as the sole responsibility of compliance

C. Integrating risk and control considerations into ordinary decisions

D. Measuring culture only through training completion rates

Correct Answer: C. Integrating risk and control considerations into ordinary decisions