问题如下：
The Basel Committee provides 11 fundamental principles for operational risk management. Brandon Roy is an employee of a commercial bank. In addition to the basic salary, the bank also has performance bonuses, which are based on the profits you create for the bank. Roy wants to get more bonuses, so he takes the risk by taking a bigger risk and ignores the written risk appetite and tolerance statements. The bank is very satisfied with Roy's performance, so the bank acquiesced in his risky investment behavior in order to increase revenue. In the following basic principles of risk management, which pair is the most likely to be violated by the commercial bank?
选项：
A. Principle 3 --- The board should approve and periodically review the Framework. Principle 11 --- Banks should make disclosures that are clear enough that outside stakeholders can assess the bank's approach to operational risk management..
B. Principle 1 --- The maintenance of a strong risk management culture led by the bank's board of directors and senior managers. Principle 7 --- Systems should require an approval process that assesses the potential operational risks.
C. Principle 2 --- The operational risk framework (referred to as the 'Framework' in this topic) must be developed and fully integrated into the overall risk management processes of the bank Principle 4 --- The board must identify the types and levels of operational risks the bank is willing to assume as well as approve risk appetite and risk tolerance statements.
D. Principle 5 --- Senior management must develop a well-defined governance structure within the bank. Principle 6 --- Senior management must understand the risks, and the incentives related to those risks, inherent in the bank's business lines and processes.
解释：
D is correct.
考点：fundamental principles of operational risk management
解析：最符合本题情景的原则是原则5和原则6。
原则5的内容是管理层要制定一个定义完整的管理体系，并且要保证该管理体系在公司的每一个部门、每一条业务线上都被执行。原则6的内容是管理层必须深刻理解风险，以及理解风险所带来的风险溢价。
在本题的情境中，罗伊为了获得更高的奖金，而故意承担更多风险来为公司创造更多利润。银行因为利润增多而默许了罗伊承担更多风险进行投资的行为。我们可以看到，银行非但没有因为罗伊故意承担更多风险而惩罚他，反而还默许了罗伊的行为，这说明银行没有遵守它设立的管理制度，这违背了原则5。其次，银行管理层只注意到了更高的利润，而没有注意到更高的风险，这违背了原则6。
B为什么不对呢？就是因为system授权不健全才导致Roy可以去做更高risk的事吧？如果更高risk的事有系统或授权控制，就不会导致这样了吧
