Question

These guidelines require that national banks establish a management level risk governance framework consisting of "three lines of defense" comprised of front line business units, independent risk management, and internal audit. The Chief Risk Officer and the Chief Audit Officer must have sufficient stature and must have "unrestricted access to the board, or a committee thereof, with respect to their risk assessments, findings and recommendations." 79 Fed. Reg. at 54,529. What does the three lines of defense rubric tell us about the role of the General Counsel? Is it necessary to state that the General Counsel should have sufficient stature and unrestricted access to the board, or is that baked into the ethics standards already?

Answer 1

The three lines of defense in risk management do not explicitly mention the General Counsel, but their role implies involvement in the first two lines as legal risk advisors. Although ethics standards might imply their need for stature and board access, a formal statement establishing this may strengthen corporate governance.

Step-by-step explanation:

The three lines of defense model in risk management explicitly delineates the roles and responsibilities of various functions within an organization to ensure effective risk management and control. The first line consists of front line business units responsible for managing risks. The second line is independent risk management, which oversees and provides guidance on the first line’s risk management practices. The third line is internal audit, which provides independent assurance that risk management processes are functioning properly.

The General Counsel's role, while not explicitly defined within the three lines of defense rubric, entails advising the organization on legal risks and representing the company in legal proceedings. Considering the General Counsel's involvement in legal risk management, one might infer that their role straddles the first two lines of defense. Ethics standards may implicitly require that they possess sufficient stature and have unrestricted access to the board of directors to effectively advise on and mitigate legal risks. However, these guidelines do not explicitly state this as a requirement for the General Counsel, as they do for the Chief Risk Officer and Chief Audit Officer. Therefore, while ethics standards may imply it, formally stating the necessity for the General Counsel to have stature and access could enhance governance and risk management practices.