You’re on a roll
Create a free account to save your FRM progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › FRM › Foundations of Risk Management
Free FRM Foundations of Risk Management Practice Questions & Answers
400 exam-style Foundations of Risk Management questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 121
Which of the following describes the primary difference between 'physical settlement' and 'cash settlement' of a derivative contract?
Select an option first.
Correct answer: B — Physical settlement requires delivery of the underlying asset; cash settlement requires only the payment of the net monetary difference between the contract price and the market price
Explanation: Physical settlement = actual delivery of the underlying (e.g., oil barrels, bonds). Cash settlement = net cash payment (price difference). Most derivatives are cash-settled for efficiency, though some (e.g., commodity futures used for actual delivery) are physically settled. A and C are incorrect; D is wrong.
Question 122
Which of the following is the best description of 'risk decomposition' in portfolio analysis?
Select an option first.
Correct answer: B — Attributing total portfolio risk to its underlying drivers — risk factors, asset classes, or individual positions — to understand what is causing the overall risk level
Explanation: Risk decomposition identifies the sources of total risk — which factors, positions, or strategies are driving portfolio VaR or volatility. This is essential for efficient risk management and hedging. A is administrative; C and D are oversimplified approaches.
Question 123
A risk manager concerned about 'model risk' would primarily focus on:
Select an option first.
Correct answer: B — Independently validating model assumptions, inputs, and outputs; ensuring models are used only in appropriate contexts; and stress-testing model sensitivity to key assumptions
Explanation: Addressing model risk requires: independent validation, ongoing monitoring, sensitivity analysis, and appropriate scope restrictions. A is technology preference; C swings too far in the opposite direction; D creates model staleness risk.
Question 124
Which of the following best explains why 'network effects' in financial systems can convert idiosyncratic shocks into systemic crises?
Select an option first.
Correct answer: B — Dense bilateral exposures, funding dependencies, and information contagion mean that a single firm's failure can cascade through multiple channels simultaneously, overwhelming the system's loss-absorbing capacity
Explanation: Financial network theory (Gai-Kapadia, Elliott-Golub-Jackson): dense interconnections create multiple amplification channels. Beyond bilateral credit losses, the channels include: funding market freezes, fire sale contagion, and information asymmetry (everyone assumes the worst about everyone else). The 2008 Lehman failure triggered all three simultaneously.
Question 125
Which of the following best describes 'second-order risk' (also called 'gamma risk' in a qualitative sense) in risk management?
Select an option first.
Correct answer: B — The risk arising from the non-linear sensitivity of exposures to risk factors — where the hedged position behaves differently from expected for large moves because first-order (delta) approximations break down
Explanation: Second-order/gamma risk: delta hedges are linear approximations. For large underlying moves, the actual P&L diverges from the delta estimate due to convexity (gamma). A portfolio that is delta-neutral can still have large losses if gamma (second derivative) is large and positions are not gamma-hedged.
Get the full FRM question bank — free
Drop your email and we'll send you fresh FRM practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 126
A firm's Chief Risk Officer argues that risk appetite must be revisited after a major acquisition. This is most justified because:
Select an option first.
Correct answer: B — A major acquisition changes the firm's risk profile, business mix, and capital position — requiring the board to reassess whether the existing appetite remains appropriate
Explanation: Risk appetite must be dynamic — it should reflect the firm's actual strategy, capital position, and risk profile. Material events (acquisitions, divestments, market shifts) require reassessment. A presupposes the direction; C and D are both incorrect governance statements.
Question 127
Which of the following best describes the 'cobra effect' in risk management?
Select an option first.
Correct answer: B — A situation where a well-intentioned risk control creates perverse incentives that make the underlying problem worse
Explanation: The cobra effect (named after a British colonial India story): a bounty on dead cobras incentivised breeding of cobras for the bounty. In risk management: a control that creates perverse incentives (e.g., risk-weighted asset optimisation that creates more hidden risk, or VaR limits that incentivise tail risk accumulation outside the measure).
Question 128
In the context of enterprise risk management, which of the following is the most significant challenge of quantifying strategic risk?
Select an option first.
Correct answer: B — Strategic risk involves qualitative factors — competitive dynamics, management capability, regulatory landscapes — that are extremely difficult to express as probability distributions or monetary loss estimates
Explanation: Unlike market risk (price data exists) or credit risk (default history), strategic risks involve judgment calls about the future that resist quantification. How do you put a probability on 'our CEO makes a catastrophic strategic error'? This is why strategic risk is managed qualitatively through governance rather than modelled quantitatively.
Question 129
A financial institution implements a 'risk budgeting' framework. This means it:
Select an option first.
Correct answer: B — Allocates the firm's total risk capacity across business units and strategies, ensuring total risk consumption does not exceed the firm's overall risk appetite
Explanation: Risk budgeting = capital allocation by risk consumption. Each business unit is given a share of the total risk budget (e.g., VaR allocation). This ensures the sum of business unit risks does not exceed firm-wide risk appetite and enables performance comparison via RAROC.
Question 130
Why is 'risk velocity' an important consideration in risk management?
Select an option first.
Correct answer: B — It captures how quickly a risk can materialise into a loss — risks with high velocity require faster response and may be more dangerous than slow-building risks of equivalent severity
Explanation: Risk velocity is the speed of loss realisation. A cyberattack (very high velocity — immediate impact) differs fundamentally from climate risk (low velocity — decades to materialise). High-velocity risks require pre-prepared crisis protocols; low-velocity risks allow strategic adaptation.
Question 131
Which of the following best describes how 'information asymmetry' between risk takers and risk managers can lead to losses at financial institutions?
Select an option first.
Correct answer: B — Risk takers (traders, relationship managers) have superior information about their specific exposures and strategies, which they may exploit to take on risks that are hidden from or misunderstood by risk managers and senior management
Explanation: Internal information asymmetry is a core governance challenge: skilled traders understand complex positions far better than risk managers. This creates opportunities to hide risk (Kerviel at SocGen, Leeson at Barings). Mitigants include independent valuation, P&L attribution analysis, and robust position reporting.
Question 132
Which of the following is the primary reason why 'scenario planning' adds value over purely statistical risk models?
Select an option first.
Correct answer: B — Scenario planning can capture unprecedented or structural shifts that have no historical precedent in the data used to calibrate statistical models
Explanation: Statistical models extrapolate from history; scenario planning can explore futures that have never happened (first pandemic in modern financial system, negative interest rates, climate-related stranded assets). This makes it essential for truly novel risk types.
Question 133
A risk manager identifies a 'near miss' — an operational risk event that nearly caused a large loss but was caught before it materialised. Best practice requires that near misses are:
Select an option first.
Correct answer: B — Recorded, investigated for root causes, and used to strengthen controls — near misses are valuable leading indicators of potential future losses
Explanation: Near misses are 'free lessons' — they reveal control weaknesses without the pain of an actual loss. Best practice requires capturing them in the operational risk incident database, investigating root causes, and implementing improvements. A, C, and D all reduce learning from near misses.
Question 134
Which of the following best explains why the concept of 'risk culture' is difficult to measure and assess?
Select an option first.
Correct answer: B — Risk culture is embedded in behaviours, norms, and implicit incentives that are difficult to observe directly — it must be inferred from observable proxies such as escalation rates, near-miss reporting, and audit findings
Explanation: Unlike capital ratios (measurable) or policy compliance (auditable), risk culture is about how people actually behave under pressure — which is not directly observable. Regulators increasingly look at whistleblowing rates, audit findings, tone at the top, and staff turnover as proxies.
Question 135
Which of the following best describes 'residual risk' after controls have been implemented?
Select an option first.
Correct answer: B — The risk remaining after management has applied all reasonable controls and mitigation measures
Explanation: Residual risk is the net risk that remains after controls, hedges, and other mitigants have been applied. It is distinct from inherent risk (gross, before controls) and represents the actual risk the firm carries. A is inherent risk; C is transferred risk; D is the worst-case loss.
Question 136
A bank discovers that its internal fraud detection model was generating incorrect alerts due to a coding error, which led to several fraud cases going undetected. This is primarily an example of:
Select an option first.
Correct answer: C — Operational risk (model/technology and process failure)
Explanation: A coding error in a fraud detection system is an operational risk event — a failure in technology/systems leading to financial losses from undetected fraud. The fraud itself is a conduct/operational event; the model failure that allowed it is operational. A and B are different risk types; D is a secondary consequence.
Question 137
Which of the following is the correct order of a typical risk management process?
Select an option first.
Correct answer: B — Identify → Measure → Manage → Monitor
Explanation: The standard risk management cycle: (1) Identify risks, (2) Measure/assess their magnitude, (3) Manage/mitigate, (4) Monitor on an ongoing basis and loop back. This sequence ensures each step informs the next.
Question 138
Which of the following best illustrates 'interconnection risk' between a bank and its major corporate clients?
Select an option first.
Correct answer: B — A bank's exposure to a large conglomerate is so significant that the conglomerate's financial distress would directly threaten the bank's capital adequacy
Explanation: Interconnection risk arises when a financial institution's fortunes are so closely tied to a single counterparty or sector that the latter's distress creates systemic spillover. A is diversification (not interconnection); C is normal service provision; D is prudent liquidity management.
Question 139
Which risk management framework principle states that risk management should be embedded in all business decision-making, not treated as a separate compliance exercise?
Select an option first.
Correct answer: B — The principle of integrated risk management
Explanation: Integrated risk management means risk considerations are embedded in strategy, product design, pricing, and daily operations — not bolted on as an afterthought. A is one possible strategy; C and D are not best-practice principles.
Question 140
Why is 'risk appetite' described as a living document rather than a static policy?
Select an option first.
Correct answer: B — Because the firm's risk profile, strategy, market environment, and capital position change over time, the risk appetite must be revisited and updated regularly to remain relevant
Explanation: Risk appetite must evolve with the firm — a major acquisition, a regulatory change, a market crisis, or a shift in strategy can all alter what level and type of risk is appropriate. Static appetite statements become disconnected from reality.
Question 141
A firm's risk manager uses scenario analysis to estimate losses from a hypothetical severe recession. This is an example of:
Select an option first.
Correct answer: C — Forward-looking stress testing using a plausible adverse scenario
Explanation: Scenario analysis evaluates portfolio behaviour under hypothetical (not necessarily historical) conditions. A severe recession scenario is forward-looking stress testing. A (back-testing) uses historical actuals; B is statistical history; D is a specific VaR methodology.
Question 142
The primary distinction between 'risk avoidance' and 'risk mitigation' is:
Select an option first.
Correct answer: A — Risk avoidance eliminates an activity entirely; risk mitigation reduces the risk of an activity without abandoning it
Explanation: Risk avoidance = decision not to engage in an activity (e.g., not entering a market). Risk mitigation = engaging but implementing controls to reduce probability or severity (e.g., diversifying suppliers). Neither is universally preferable — the choice depends on the risk-return tradeoff.
Question 143
Which of the following is an example of 'basis risk' in an interest rate hedge?
Select an option first.
Correct answer: B — A firm hedges a SOFR-linked loan using Eurodollar futures, but SOFR and the futures rate do not move perfectly in lockstep
Explanation: Basis risk in interest rate hedging: the reference rates of the hedged item (SOFR) and the hedging instrument (Eurodollar futures) are correlated but not identical — so the hedge is imperfect. A is the motivation for an interest rate swap; C is unhedged FX risk; D is horizon mismatch.
Question 144
A bank's model for estimating operational risk capital uses only internal loss data from the past five years. Which of the following is the most significant limitation of this approach?
Select an option first.
Correct answer: B — Five years of data may not capture rare, high-severity events and may be biased by the firm's specific business mix and control environment, understating true tail risk
Explanation: For operational risk, the most dangerous losses (high severity, low frequency) may not appear in a five-year window. Banks supplement internal data with external loss databases and scenario analysis precisely for this reason. A is incorrect; C and D are wrong.
Question 145
Which of the following describes how 'geopolitical risk' can interact with financial risk?
Select an option first.
Correct answer: B — Geopolitical tensions (e.g., sanctions, trade wars, conflict) can trigger sudden asset price moves, disrupt supply chains, freeze credit markets, and create sovereign default risk — interacting with market, credit, and liquidity risk simultaneously
Explanation: Geopolitical risk cascades through multiple channels: commodity prices (supply disruption), currency moves, credit spreads on sovereign debt, corporate revenues in affected regions, and broader risk-off sentiment. A denies market reality; C and D are too narrow.
Question 146
Which of the following statements about 'expected loss' and 'unexpected loss' is most accurate from a bank capital perspective?
Select an option first.
Correct answer: B — Banks hold capital against unexpected losses; expected losses should be covered by loan pricing (interest margins) and provisioning
Explanation: Correct capital theory: expected losses are predictable and should be priced into lending margins and covered by provisions. Capital is held for unexpected losses — the statistically adverse deviations around the expected loss. A reverses the logic; C and D are incorrect.
Question 147
Why is 'sensitivity analysis' used alongside VaR in risk management?
Select an option first.
Correct answer: B — Sensitivity analysis shows how portfolio value or risk measures change in response to changes in individual risk factors, complementing the aggregate probabilistic view provided by VaR
Explanation: Sensitivity analysis (DV01, delta, CS01) decomposes risk by factor — showing which rates, prices, or spreads drive P&L the most. VaR gives a single aggregate number; sensitivity analysis explains its components. Together they are more informative than either alone.
Question 148
A risk manager discovers that a trader has been hiding losses by booking fictitious trades. This is an example of:
Select an option first.
Correct answer: B — Operational risk from internal fraud and breakdown of control procedures
Explanation: Internal fraud (booking fictitious trades to hide losses) is a classic operational risk event — specifically under the Basel category of 'Internal Fraud'. The breakdown of reconciliation and position reporting controls enabled it. A, C, and D are different risk categories.
Question 149
Value-at-Risk (VaR) at a 95% confidence level over one day means:
Select an option first.
Correct answer: B — The firm will not lose more than this amount on 95% of trading days, or will exceed this loss on 5% of days
Explanation: VaR is a probabilistic threshold: at 95% confidence, losses exceed VaR only 5% of the time (about 12-13 trading days per year). A misunderstands probability; C describes expected loss; D confuses VaR with worst-case loss.
Question 150
Expected Shortfall (ES), also called Conditional VaR (CVaR), measures:
Select an option first.
Correct answer: B — The average loss given that the loss exceeds the VaR threshold
Explanation: ES answers: 'Given that we are in the tail (loss > VaR), what is the average loss?' This makes ES a more complete risk measure than VaR because it characterises the severity, not just the probability, of tail losses.
More free FRM topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.