You’re on a roll
Create a free account to save your CTP progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › CTP › Financial, Regulatory and Operational Risk
Free CTP Financial, Regulatory and Operational Risk Practice Questions & Answers
150 exam-style Financial, Regulatory and Operational Risk questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 121
Which type of risk is generally most appropriate to transfer to a commercial insurer rather than to self-insure?
Select an option first.
Correct answer: A — Low-frequency, high-severity, catastrophic losses that could threaten solvency
Explanation: Insurance is most valuable for rare but severe events whose cost could impair or bankrupt the firm, because transferring that tail risk protects solvency. Predictable, high-frequency, low-severity losses are often more economically retained (self-insured) since insuring them mostly buys back one's own expected costs plus insurer overhead.
Question 122
A firm is deciding whether to raise its self-insured retention. All else equal, increasing the retention will most likely:
Select an option first.
Correct answer: D — Reduce premiums but increase the firm's exposure to retained losses and cash-flow volatility
Explanation: A higher self-insured retention means the firm absorbs more loss before coverage responds, which lowers premiums but increases the volatility and potential size of losses it must fund itself. Treasury must ensure adequate liquidity and reserves to support the greater retained exposure.
Question 123
A fidelity bond (commercial crime insurance) primarily protects an organization against losses from:
Select an option first.
Correct answer: A — Dishonest or fraudulent acts by employees, such as embezzlement or theft
Explanation: A fidelity bond, part of commercial crime coverage, indemnifies the organization against losses caused by employee dishonesty, including embezzlement and theft. It complements internal controls like segregation of duties as a financial backstop against insider fraud.
Question 124
Positive pay is a bank service designed primarily to detect:
Select an option first.
Correct answer: B — Altered, forged, or counterfeit checks presented against the account
Explanation: Positive pay matches checks presented for payment against a company-supplied issue file of check numbers, amounts, and payees, flagging exceptions for review. It is a core control against altered, forged, or counterfeit check fraud and is unrelated to FX or card interchange.
Question 125
Business email compromise (BEC) fraud most commonly succeeds by:
Select an option first.
Correct answer: D — Impersonating an executive or vendor to induce an employee to send a fraudulent payment or change payment instructions
Explanation: BEC relies on social engineering: fraudsters pose as a trusted executive or supplier and use urgent, plausible emails to trick employees into wiring funds or updating banking details. The attack targets human trust and process gaps rather than technical encryption weaknesses.
Get the full CTP question bank — free
Drop your email and we'll send you fresh CTP practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 126
A control requiring two separate individuals to approve a payment before it is released is known as:
Select an option first.
Correct answer: B — Dual control (dual authorization)
Explanation: Dual control requires two authorized individuals to act on a transaction, ensuring no single person can release a payment alone. This reduces the risk of both error and fraud and is a foundational payment control distinct from reconciliation or account structures.
Question 127
Which service allows a company to block all ACH debits to an account except those from pre-authorized originators?
Select an option first.
Correct answer: D — ACH positive pay / ACH debit filter (block)
Explanation: ACH debit filters or blocks let a company specify which originators (by company ID and often dollar limit) are permitted to debit an account, rejecting all others or routing them to exception review. This directly defends against unauthorized ACH debit fraud.
Question 128
Reverse positive pay differs from standard positive pay in that:
Select an option first.
Correct answer: A — The bank pays all checks and the company must review presented items and instruct the bank to return unwanted ones
Explanation: In reverse positive pay the burden shifts to the company: the bank presents the list of items and the company must identify and return unauthorized checks, with unreviewed items typically paid by default. This is generally weaker than standard positive pay, where mismatches default to non-payment pending review.
Question 129
Operational risk in a treasury context is best defined as the risk of loss resulting from:
Select an option first.
Correct answer: B — Inadequate or failed internal processes, people, systems, or external events
Explanation: Operational risk stems from failures in processes, people, and systems or from external events such as disasters and fraud, as distinguished from market or credit risk. This definition, consistent with Basel guidance, underpins controls, redundancy, and business continuity planning.
Question 130
A Business Continuity Plan (BCP) is primarily intended to:
Select an option first.
Correct answer: D — Ensure the organization can maintain or quickly resume critical functions after a disruptive event
Explanation: A BCP focuses on sustaining or rapidly restoring critical business functions following disruptions such as natural disasters, cyberattacks, or outages. It addresses continuity of operations rather than yield optimization or pricing decisions.
Question 131
In disaster recovery planning, the Recovery Time Objective (RTO) represents:
Select an option first.
Correct answer: D — The targeted duration within which a business process must be restored after a disruption
Explanation: RTO is the maximum tolerable time to restore a process or system after an outage. It is distinct from the Recovery Point Objective (RPO), which measures acceptable data loss; together they drive backup and redundancy design.
Question 132
The Recovery Point Objective (RPO) primarily addresses:
Select an option first.
Correct answer: C — How much data loss, measured as a time interval, is acceptable
Explanation: RPO defines the maximum acceptable data loss expressed as a point in time to which data must be recoverable, effectively dictating backup frequency. A one-hour RPO, for example, requires backups at least hourly so no more than an hour of data is lost.
Question 133
Cross-training treasury staff on critical processes primarily mitigates which risk?
Select an option first.
Correct answer: D — Key-person (single point of failure) operational risk
Explanation: Cross-training ensures that if a key employee is unavailable, others can perform essential treasury functions, reducing dependence on any single individual. This addresses key-person operational risk rather than market-related exposures.
Question 134
A business impact analysis (BIA) is used in continuity planning primarily to:
Select an option first.
Correct answer: D — Identify critical processes and the financial and operational impact of their disruption over time
Explanation: A BIA identifies which processes are critical, how quickly they must be recovered, and the escalating impact of downtime, thereby informing RTOs, RPOs, and resource priorities. It is the analytical foundation on which the continuity and recovery strategy is built.
Question 135
Interchange is best described as:
Select an option first.
Correct answer: D — A fee set by the card networks and paid by the merchant's acquirer to the card-issuing bank on each transaction
Explanation: Interchange is the fee, established by the card networks, that the acquiring (merchant) bank pays to the card-issuing bank for each card transaction, and it is passed on to the merchant as part of its processing costs. It is the largest component of a merchant's cost of card acceptance.
Question 136
PCI DSS (Payment Card Industry Data Security Standard) primarily aims to:
Select an option first.
Correct answer: C — Protect cardholder data through security requirements for entities that store, process, or transmit it
Explanation: PCI DSS is a set of security standards designed to protect cardholder data across all organizations that store, process, or transmit it. Compliance reduces the risk of data breaches and the associated fines and reputational harm, but it does not set pricing or guarantee profits.
Question 137
A chargeback occurs when:
Select an option first.
Correct answer: B — A cardholder disputes a transaction and the amount is reversed back from the merchant
Explanation: A chargeback is a forced reversal of a card transaction initiated when a cardholder disputes it, returning the funds from the merchant to the cardholder pending resolution. Excessive chargebacks can trigger penalties and higher processing costs for the merchant.
Question 138
A purchasing card (p-card) program is primarily used to:
Select an option first.
Correct answer: C — Streamline and control low-value, high-volume purchases while capturing spend data
Explanation: P-card programs efficiently handle numerous small-dollar purchases, reducing purchase-order and invoice processing while providing controls such as merchant category and spending limits plus detailed reporting. They improve procurement efficiency rather than manage market risk.
Question 139
The Basel III Liquidity Coverage Ratio (LCR) requires banks to hold enough high-quality liquid assets (HQLA) to cover net cash outflows over what stress horizon?
Select an option first.
Correct answer: D — 30 days
Explanation: The LCR requires banks to maintain HQLA sufficient to survive a 30-calendar-day severe liquidity stress scenario. It is calculated as HQLA divided by total net cash outflows over 30 days and must be at least 100%.
Question 140
Know Your Customer (KYC) requirements are primarily intended to:
Select an option first.
Correct answer: C — Verify customer identities and understand their activities to prevent money laundering and illicit finance
Explanation: KYC obligates financial institutions to verify identity, assess risk, and monitor activity to detect and deter money laundering, terrorist financing, and other illicit use. It is a foundational element of AML compliance programs.
Question 141
OFAC (Office of Foreign Assets Control) compliance requires U.S. persons and companies to:
Select an option first.
Correct answer: D — Screen transactions and counterparties against sanctions lists and block or reject prohibited dealings
Explanation: OFAC administers U.S. economic sanctions, requiring firms to screen counterparties and transactions against lists such as the SDN list and to block or reject prohibited transactions. Violations can result in significant civil and criminal penalties, including strict-liability fines.
Question 142
Under the Sarbanes-Oxley Act (SOX), Section 404 primarily requires:
Select an option first.
Correct answer: B — Management to assess and report on the effectiveness of internal control over financial reporting
Explanation: SOX Section 404 requires management (and, for many companies, the external auditor) to assess and report on the effectiveness of internal control over financial reporting. This drives documentation and testing of controls, including many within treasury operations.
Question 143
A company experiences 12 fraudulent check attempts in a year totaling $480,000. Its positive pay system catches 11 of them worth $455,000, but one check for $25,000 clears because the issue file was uploaded late. What is the fraud loss avoidance rate by dollar value?
Select an option first.
Correct answer: D — About 94.8%
Explanation: Avoidance by value = amount stopped / total attempted = $455,000 / $480,000 = 0.9479, or about 94.8%. The single $25,000 item that cleared represents roughly 5.2% of the attempted fraud value, illustrating how a late issue-file upload defeats the control.
Question 144
A merchant processes $250,000 in card sales across 5,000 transactions. Its cost is 1.8% of volume plus $0.10 per transaction. What is the total processing cost?
Select an option first.
Correct answer: D — $5,000
Explanation: Percentage cost = 1.8% x $250,000 = $4,500; per-transaction cost = 5,000 x $0.10 = $500; total = $4,500 + $500 = $5,000. Blended card costs combine an ad valorem rate and a fixed per-item fee.
Question 145
A merchant pays $6,300 in total card fees on $350,000 of card sales. What is its effective (blended) discount rate?
Select an option first.
Correct answer: B — 1.8%
Explanation: Effective rate = total fees / total sales = $6,300 / $350,000 = 0.018 = 1.8%. The effective discount rate expresses all processing costs as a single percentage of card volume for easy comparison.
Question 146
A merchant has 40 chargebacks in a month on 8,000 transactions. If card networks flag merchants exceeding a 1% chargeback ratio, is this merchant over the threshold, and what is the ratio?
Select an option first.
Correct answer: A — 0.5%, under the threshold
Explanation: Chargeback ratio = chargebacks / transactions = 40 / 8,000 = 0.005 = 0.5%, which is below the 1% threshold. Monitoring this ratio helps merchants avoid network monitoring programs and penalties.
Question 147
A bank holds $180 million in high-quality liquid assets and projects $150 million in net cash outflows over a 30-day stress period. What is its Liquidity Coverage Ratio?
Select an option first.
Correct answer: B — 120%
Explanation: LCR = HQLA / net cash outflows = $180M / $150M = 1.20 = 120%. This exceeds the 100% regulatory minimum, indicating the bank holds a surplus of liquid assets relative to modeled stressed outflows.
Question 148
A bank reports available stable funding (ASF) of $800 million and required stable funding (RSF) of $640 million. What is its Net Stable Funding Ratio (NSFR), and does it meet the 100% minimum?
Select an option first.
Correct answer: D — 125%, meets the minimum
Explanation: NSFR = ASF / RSF = $800M / $640M = 1.25 = 125%, comfortably above the 100% minimum. The NSFR promotes funding stability over a one-year horizon, complementing the 30-day LCR.
Question 149
A bank holds $95 million in high-quality liquid assets against $100 million of net cash outflows over the 30-day stress period. What is its Liquidity Coverage Ratio, and does it satisfy the Basel III minimum?
Select an option first.
Correct answer: A — 95%, below the 100% minimum
Explanation: LCR = HQLA / net cash outflows = $95M / $100M = 0.95 = 95%. Because this is below the 100% regulatory minimum, the bank holds insufficient liquid assets for the modeled 30-day stress and would need to raise HQLA or reduce outflows.
Question 150
A vendor emails a request to update its bank account for future ACH payments. Following best-practice controls, the payables team should:
Select an option first.
Correct answer: A — Verify the change by calling the vendor at a known, previously verified phone number using out-of-band confirmation
Explanation: Bank-change requests are a hallmark of BEC and vendor impersonation fraud, so the change must be verified out-of-band using contact details already on file, not those supplied in the request. Replying to the same email confirms nothing because the fraudster controls that inbox.
More free CTP topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.