The risk governance framework is a comprehensive, written approach with policies and procedures enabling financial institutions to implement the framework across the entire financial institution. What is the definition of a policy according to Risk Management?

A policy is a foundational document within a risk governance framework. It is a high-level statement that articulates the institution's intent and principles regarding a specific risk area. It defines the scope, sets boundaries, and aligns with the institution's overall risk appetite statement. Policies provide the "why" and "what" for the risk management program, serving as the basis from which more detailed procedures and controls are developed.

A. This describes procedures or standards, which are the detailed instructions for implementing a policy, not the definition of the policy itself.
C. This describes the responsibilities of a policy owner. Furthermore, a key responsibility is ensuring the policy is updated to reflect changes in regulations, not that it remains unchanged.
D. This option is incorrect because options A and C are flawed descriptions of a policy.

1. ACAMS. (2024). CAMS-RM Study Guide. Chapter 2: Governance. This section defines the hierarchy of governance documents, distinguishing between high-level policies, more detailed standards, and specific operational procedures.

2. The Committee of Sponsoring Organizations of the Treadway Commission (COSO). (2017). Enterprise Risk Management—Integrating with Strategy and Performance. This framework discusses the importance of establishing policies as part of the governance and culture component to communicate the organization's standards.