You’re on a roll
Create a free account to save your FRM progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › FRM › Operational Risk and Resilience
Free FRM Operational Risk and Resilience Practice Questions & Answers
400 exam-style Operational Risk and Resilience questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 271
What is 'recovery planning' vs 'resolution planning' and who is responsible for each?
Select an option first.
Correct answer: B — Recovery planning: prepared by the bank's management — identifies actions management can take to restore financial viability if the bank experiences severe stress (capital raise, asset sales, business restructuring, dividend cancellation). Resolution planning: prepared by the resolution authority (FDIC, SRB) — describes how the bank would be wound down in an orderly manner if recovery is impossible. Both inform operational risk management: what operational capabilities must be maintained during recovery/resolution?
Explanation: B is correct. Recovery vs resolution: Recovery (bank's responsibility): actions within management's power to restore the bank. Tests: is the bank operationally capable of executing recovery options under stress? Resolution (regulator's responsibility): relies on TLAC/MREL instruments being available. Tests: can critical operations continue during resolution? The operational risk dimension: both plans require: critical business services to remain operational (resilience), key contracts to remain in force (third-party risk), and data and systems to function (technology resilience). A reverses responsibilities. C: different but related planning activities. D: significant operational risk dimensions.
Question 272
What is 'the role of the Chief Risk Officer' (CRO) in operational risk governance?
Select an option first.
Correct answer: B — The CRO is the senior executive responsible for overseeing the firm's entire risk management framework, including operational risk — specific responsibilities: (1) Championing the ORMF and risk culture; (2) Overseeing OpRisk capital modelling and ICAAP; (3) Leading the OpRisk function (second line); (4) Providing independent challenge to business units on risk-taking; (5) Reporting to the board on the OpRisk profile; (6) Ensuring regulatory compliance of the OpRisk framework; (7) Setting risk appetite in conjunction with the board
Explanation: B is correct. CRO OpRisk role: independence: the CRO should have direct access to the board and be independent of P&L pressure. Challenge: the CRO must be willing to challenge business decisions that introduce excessive OpRisk — even when commercially attractive. Accountability (SMCR): the CRO holds a Senior Manager Function (SMF4) and is personally accountable for the risk management framework. Remuneration: the CRO should not be primarily incentivised by P&L metrics — misalignment creates independence issues. CRO committee: typically chairs the OpRisk Committee and sits on the board's Risk Committee. A: business units manage day-to-day. C: the CRO manages the second line. D: external audit is the 4th line.
Question 273
What is 'prudential regulation' vs 'conduct regulation' for operational risk?
Select an option first.
Correct answer: B — Prudential regulation focuses on financial soundness: ensuring banks have sufficient capital, liquidity, and risk management capabilities to avoid failure. Conduct regulation focuses on behaviour: ensuring banks treat customers fairly and markets function properly. For operational risk: (1) Prudential regulators (PRA, ECB) assess OpRisk capital adequacy, governance quality, and resilience; (2) Conduct regulators (FCA, CFPB) focus on conduct risk events (mis-selling, market abuse, unfair terms), AML compliance, and consumer protection. In the UK: dual regulation by PRA and FCA creates complex compliance
Explanation: B is correct. Prudential vs conduct for OpRisk: conduct risk events generate: regulatory fines (conduct regulator), capital requirements (prudential regulator), and reputation risk. Both regulators may investigate the same OpRisk event from different angles — PRA: does this reveal a governance failure requiring capital? FCA: were customers harmed and are remediation obligations being met? Dual-regulated firms (UK banks): must satisfy both PRA (safety and soundness) and FCA (consumer protection, market integrity). A and C: different focuses and powers. D: both are critical; they address different dimensions of OpRisk.
Question 274
What is 'loss multiplier' in risk scenario analysis and how is it used?
Select an option first.
Correct answer: B — A factor applied to an estimated scenario loss to account for second-order effects, indirect losses, and uncertainty — e.g., a direct fraud loss of $50M might have a total economic impact multiplier of 3x when regulatory fines, litigation costs, remediation expenses, and revenue attrition are included. Multipliers should be based on: analysis of historical events at peer banks (what was the ratio of total to direct losses?), industry studies, and expert judgment
Explanation: B is correct. Loss multiplier analysis: PPI mis-selling example: banks initially estimated direct redress liability of £5B → total cost exceeded £50B (10x multiplier) when litigation, administration, regulatory oversight, and reputational effects were included. Rule of thumb: for major regulatory/conduct events, multipliers of 5-10x are not uncommon. For cyber events: direct theft of $10M may generate $50-100M in total costs (notification, legal, credit monitoring, regulatory, reputational). Using multipliers in ICAAP: scenario analysis should include both direct and total economic impact estimates. A is arbitrary conservatism. C: multipliers are event-specific. D: parameter uncertainty is addressed separately.
Question 275
What is 'risk culture assessment' at board level and what are the key indicators?
Select an option first.
Correct answer: B — An evaluation of whether the board itself demonstrates appropriate risk culture — indicators: (1) Board members ask probing risk questions in meetings (not just accepting management presentations); (2) Board risk committee minutes show genuine challenge and debate; (3) Sufficient time allocated to risk on the board agenda; (4) Non-executive directors have relevant risk expertise; (5) Board acts on CRO concerns even when commercially inconvenient; (6) Whistleblowing disclosures are taken seriously at board level
Explanation: B is correct. Board-level risk culture: supervisory assessment: regulators observe board meetings, review minutes, and interview board members to assess whether risk culture starts at the top. Red flags: boards that consistently approve risk appetite exceedances, dismiss CRO concerns, or spend minimal time on risk in meetings. SMCR dimension: board members hold Senior Manager Functions — they are personally accountable for fulfilling board governance responsibilities. PRA/FCA guidance: boards should demonstrate understanding of material risks, not just receive and nod at risk reports. A is HR activity. C: culture must be assessed at all levels. D: primary assessment should be conducted by supervisors and internal audit.
Get the full FRM question bank — free
Drop your email and we'll send you fresh FRM practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 276
What is the 'operational risk taxonomy evolution' and what has driven recent changes?
Select an option first.
Correct answer: B — The Basel event type taxonomy has remained largely unchanged since 2004, but banks have evolved their internal taxonomies to better capture emerging risk types: (1) Cyber risk (originally within 'System Failures' and 'External Fraud' — now often a standalone category); (2) Conduct risk (across multiple Basel categories — often treated separately); (3) Third-party risk (not a Basel category — but increasingly material); (4) Model risk (within 'Execution/Delivery' — now separately tracked at many banks). Driven by: regulatory scrutiny, major loss events, and new risk types
Explanation: B is correct. Internal taxonomy evolution: banks maintain internal taxonomies that are more granular than Basel Level 1 and 2 categories. Adding cyber as a stand-alone category: provides better data for cyber capital modelling, clearer KRI monitoring, and more targeted scenario analysis. This doesn't change Basel reporting categories — cyber losses are still classified into the appropriate Basel category (IT system failure, external fraud) for regulatory reporting. Internal analysis uses the more granular taxonomy. A: Basel Level 1 categories unchanged; internal taxonomies have evolved. C: no Basel mandate for cyber as a new Level 1 category. D: internal taxonomies are bank-specific.
Question 277
What is 'the precautionary principle' in operational risk and when is it applied?
Select an option first.
Correct answer: B — When uncertainty about an operational risk is high and the potential consequences are severe, taking precautionary action to mitigate the risk even without complete evidence of harm — applied when: (1) A potential scenario could cause catastrophic or irreversible harm; (2) The probability is uncertain but non-trivial; (3) The cost of precaution is proportionate. Example: a bank may implement additional cyber controls before a known vulnerability is actively exploited, rather than waiting for evidence of attack
Explanation: B is correct. Precautionary principle in OpRisk: risk appetite application: for certain risk types (cyber, financial crime, operational resilience), 'zero tolerance' or near-zero tolerance reflects the precautionary principle — the consequences of these risks materialising are so severe that precautionary control investment is justified even at low probability. ICAAP: in the absence of reliable data for a new risk type, a precautionary capital buffer is appropriate. This is different from: risk aversion (refusing all risk) or over-conservatism (always using maximum estimates regardless of evidence). A: not a complete risk avoidance. C: maximum estimates aren't always appropriate. D: proportionate to the risk.
Question 278
What is 'control investment optimisation' and how is it approached in operational risk?
Select an option first.
Correct answer: B — Allocating the risk management budget to controls that deliver the greatest reduction in risk exposure per unit of cost — framework: (1) Identify the largest risk contributors (risk decomposition); (2) Estimate cost of potential controls; (3) Estimate risk reduction from each control; (4) Calculate cost-effectiveness (risk reduction / control cost); (5) Prioritise highest cost-effectiveness controls within budget. Not all risks require controls — some residual risk is acceptable within risk appetite
Explanation: B is correct. Control investment optimisation: the OpRisk function should help management answer: 'Where should we invest $10M in risk management to get the maximum risk reduction?' Tools: RCSA risk-ranking (invest in highest residual risk areas), KRI sensitivity analysis (which KRIs have the greatest impact on expected losses?), scenario analysis (which scenarios dominate capital?). Diminishing returns: the first £1M of investment in a high-risk area may reduce expected losses by £5M; the next £1M may reduce by £2M. Budget allocation: compare risk reduction rates across all potential control investments. A is not optimisation. C is arbitrary. D is minimum compliance.
Question 279
What is 'emerging technology risk assessment' and what process should financial institutions follow?
Select an option first.
Correct answer: B — A structured, ongoing evaluation of risks from new and evolving technologies before and during deployment — process: (1) Technology inventory (identify all new/evolving technologies in use or under consideration); (2) Risk identification (what new OpRisk categories does each technology create?); (3) Risk quantification (how material are these risks given current data?); (4) Control design (what controls address the identified risks?); (5) Residual risk assessment (is residual risk within appetite?); (6) Governance approval (appropriate authority for the technology's risk level); (7) Ongoing monitoring (reassess as technology and understanding evolve)
Explanation: B is correct. Emerging tech risk assessment: examples of what the process covers: AI deployment (model risk, explainability, fairness, data quality), cloud migration (concentration risk, data sovereignty, exit risk), API integration with third parties (third-party risk, data security, operational dependency), and distributed ledger technology (legal enforceability, key management, settlement finality). New product approval: emerging technology assessment is often triggered by new product development when technology is a critical component. Regulatory alignment: supervisors increasingly expect formal technology risk assessment processes — DORA explicitly requires ICT risk management for all covered entities. A: ongoing monitoring is required. C: proactive, not reactive to regulators. D: required regardless of regulatory prompting.
Question 280
What is the 'COSO ERM 2017 principle 8' (risk velocity) and how does it apply to operational risk?
Select an option first.
Correct answer: B — Principle 8 of COSO ERM (Assessing Severity of Risk) includes consideration of risk velocity — the speed at which a risk can impact the organisation. High velocity risks require different management than slow-moving ones: a cyber attack can cause losses in minutes; a conduct risk issue may develop over years before materialising. Operational resilience focuses on high-velocity risks (fast-moving threats that require rapid response capabilities). Risk appetite should differentiate by velocity
Explanation: B is correct. Risk velocity in OpRisk: high velocity (hours/days): cyber attacks, system failures, major fraud discoveries — require: real-time monitoring, pre-planned incident response, rapid escalation. Medium velocity (weeks/months): regulatory investigations, litigation — require: legal response planning, provision building, stakeholder communication. Low velocity (years): strategic business model risk, gradual conduct risk pipeline — require: trend monitoring, early indicator management. Management implications: faster velocity = less time for management response = importance of preventive controls and pre-planned responses. A: velocity applies to all risk types. C: velocity is relevant across all ERM risk categories.
Question 281
What is 'accountability for the risk management framework' at board and management level?
Select an option first.
Correct answer: B — Board responsibility: approve and regularly review the operational risk management framework, set the risk appetite, ensure adequate resources are allocated to risk management, and provide effective oversight through the risk committee. Senior management (CRO): develop, implement, and maintain the ORMF within the board's approved framework. Business management (1st line): own and implement risk management within their areas. All three levels must demonstrate active engagement — not just pro-forma sign-off
Explanation: B is correct. Accountability structure for ORMF: board: approves the framework (annual review), receives major incident reports, oversees ICAAP OpRisk capital. CRO/OpRisk function: develops framework, maintains tools, challenges business, and manages capital. Business management: ensures their operations comply with the framework, owns residual risks, and escalates concerns. SMCR (UK): each level has named individuals with specific accountability. Board member accountability: a non-executive director on the risk committee is personally accountable for the board's risk oversight. A: compliance is part of 2nd line but not solely responsible. C: the CRO owns the second-line function. D: accountability has structure and specificity.
Question 282
What is 'forward-looking capital assessment' in the ICAAP for operational risk?
Select an option first.
Correct answer: B — An assessment of whether current and future capital will be sufficient given expected changes in: business mix, technology investment, regulatory environment, and risk profile — forward-looking elements: (1) Planned business growth (larger BI → higher BIC); (2) New product launches (new OpRisk categories); (3) Planned control improvements (expected reduction in ILM over time); (4) Pending regulatory investigations (additional Pillar 2 buffers needed?); (5) Macro stress scenarios (elevated OpRisk in downturns)
Explanation: B is correct. ICAAP forward-looking elements: 3-5 year capital projections: (Year 1): current capital. (Year 2): account for business growth (BI rises 10% → BIC rises). (Year 3): planned IT transformation reduces technology risk KRIs → ILM expected to decline. (Year 4): pending AML regulatory review settles → Pillar 2 buffer for OpRisk may reduce. Stress capital: under a severe economic downturn scenario → OpRisk losses rise → ILM increases → capital needs to be higher. Board approval: the capital plan (including OpRisk component) should be approved annually by the board. A is backward-looking. C: management input is essential. D: more comprehensive than a single calculation.
Question 283
What is 'risk committee effectiveness' and what indicators suggest a well-functioning risk committee?
Select an option first.
Correct answer: B — A board-level or senior management committee that provides meaningful oversight and challenge of risk management activities — indicators of effectiveness: (1) Members have genuine risk expertise (not just seniority); (2) Committee challenges management on assumptions (not just receives presentations); (3) Minutes reflect real debate, not just conclusions; (4) CRO has a direct reporting line to the committee (not filtered by CEO); (5) Committee receives independent views (e.g., directly from internal audit); (6) Sufficient meeting time for substantive discussion
Explanation: B is correct. Effectiveness indicators: meeting cadence and quality: monthly meetings with substantive agenda items vs quarterly meetings with pro-forma presentations. CRO independence: the CRO should be able to bring concerns to the committee without management filtering. Challenge culture: non-executive directors who ask hard questions about risk assumptions, not just nodding. Action tracking: committee decisions are tracked to completion — issues identified in one meeting are followed up in the next. Expertise: at least some members should have specific risk management backgrounds (not just finance or general business). A: a committee that always approves is a rubber stamp. C: frequency is secondary to quality. D: smaller, expert committees often function better.
Question 284
What is the 'sound management cycle' for operational risk according to BCBS and what are its five elements?
Select an option first.
Correct answer: B — The BCBS 2011 'Principles for Sound Management of Operational Risk' implicitly describe a five-element management cycle: (1) Identification (recognise all material OpRisk exposures); (2) Assessment (measure likelihood and impact — RCSA, scenarios, LDA); (3) Monitoring and reporting (KRIs, loss data, management information); (4) Control and mitigation (preventive and detective controls, insurance, risk avoidance); (5) Review and improvement (lessons learned, framework updates). This cycle is continuous — each element feeds the next
Explanation: B is correct. Sound management cycle: identification and assessment → measurement (LDA, scenarios) → monitoring (KRIs, loss tracking) → control (framework implementation) → review (continuous improvement). BCBS principle linkage: P4 = identification and assessment. P5 = monitoring and reporting. P6 = control and mitigation. P7 = BCP (a control). P8 = disclosure (reporting). The cycle is embedded in the ORMF and repeated continuously. Supervisors assess whether each element is functioning — a weak monitoring element (poor KRIs) undermines the entire cycle. A and C: the cycle is continuous and management-led, not regulatory. D is a capital calculation formula.
Question 285
What is 'non-financial risk' (NFR) taxonomy as used by major banks and how does it differ from Basel event types?
Select an option first.
Correct answer: B — NFR taxonomy used by major banks (e.g., UBS, Deutsche Bank) groups all non-financial risks into categories such as: Operational Risk (processes, systems, people, external events), Compliance Risk, Conduct Risk, Financial Crime Risk, Model Risk, Reputational Risk, Strategic Risk, and Information Security Risk. This is broader than the Basel event type taxonomy (which focuses on loss classification for capital) — NFR taxonomy organises the management of all non-financial risks, not just those generating quantifiable capital losses
Explanation: B is correct. NFR vs Basel taxonomy: Basel event types: classify losses for capital calculation. NFR taxonomy: organises the full risk management framework for all non-financial risks. NFR is used for: RCSA (identifying risks in all NFR categories), risk appetite (setting limits across all NFR categories), reporting (board reports covering all NFR categories), and governance (committee structures mapping to NFR categories). Relationship: most NFR events will eventually map to one of the 7 Basel event categories for Pillar 1 capital reporting. The broader NFR framework ensures that risks like reputational risk and strategic risk (excluded from Basel OpRisk capital) are still actively managed. A: much broader. C and D: NFR applies to all types of financial institutions.
Question 286
What is 'risk culture measurement' and what quantitative proxies are used?
Select an option first.
Correct answer: B — While risk culture is inherently qualitative, quantitative proxies provide measurable indicators: (1) Near-miss reporting rate (high rate suggests open reporting culture); (2) Time to escalate risk concerns; (3) Control testing failure rates; (4) Staff turnover in risk and compliance roles; (5) Training completion rates; (6) Conduct breach rates; (7) Number of whistleblower reports per 1,000 employees; (8) Average age of unresolved audit findings. These metrics, trended over time, indicate whether risk culture is improving or deteriorating
Explanation: B is correct. Culture measurement proxies: near-miss rate: if near-miss reporting rates suddenly drop, it may indicate staff have become reluctant to report (culture deterioration), not that fewer near-misses occurred. Time to escalate: measured from event occurrence to senior management notification — faster = better culture. Control failure rates: rising failure rates suggest culture of non-compliance. Training completion: proxy for engagement with risk framework. These metrics are imperfect proxies but provide a data foundation for culture discussions. Combining quantitative metrics with qualitative observation (supervisory observation, staff interviews) provides the most complete picture. A: proxies are available. C: complex models not required. D: used internally for management and externally for supervision.
Question 287
What is 'operational risk appetite calibration' and how is it set at the right level?
Select an option first.
Correct answer: B — Finding the level that balances risk management effectiveness with operational and commercial viability — too strict: creates an unmanageable number of breaches (appetite exhaustion, management desensitisation), excessive compliance costs, and limits useful business activity. Too loose: risks become unmanaged within the appetite boundaries. Calibration approach: (1) Start with historical loss data (what loss level has been experienced?); (2) Benchmark against industry (are peers accepting similar levels?); (3) Assess financial impact (what level is tolerable given capital?); (4) Test against strategy (is the appetite consistent with business plans?); (5) Board validation (is the board comfortable?)
Explanation: B is correct. Calibration guidance: practical benchmarks — if the bank has historically experienced 1-2% of revenue in OpRisk losses, setting appetite at 0.5% will result in constant breaches; 3% may be more realistic if the historical level reflects an acceptable control environment. Industry benchmarks: ORX data shows industry loss rates by bank size and business mix. Capital-linking: the appetite should be consistent with Pillar 1 capital — if you're willing to accept 99.9th percentile losses, the appetite should be set well below that. Board test: if the board would be genuinely comfortable with the maximum loss at the appetite boundary, it is set appropriately. A: zero risk appetite would stop all banking activity. C: a historical percentile is one input. D: reviewed annually.
Question 288
What is the 'three lines of defence' model in operational risk governance?
Select an option first.
Correct answer: B — A governance framework where: (1st line) business units own and manage risks day-to-day; (2nd line) risk management and compliance functions provide oversight, challenge, and policy setting; (3rd line) internal audit provides independent assurance over the effectiveness of the 1st and 2nd lines — each line has distinct responsibilities
Explanation: B is correct. Three lines: 1st line: front-line managers are responsible for identifying, managing, and reporting their operational risks. 2nd line: the CRO/Operational Risk function sets the framework, develops tools (RCSA, KRIs), challenges 1st line assessments, and provides oversight. 3rd line: Internal Audit independently reviews whether the first two lines are effective. External audit is sometimes called the '4th line.' A is an audit team structure. C is IT security (defence-in-depth). D is regulatory oversight.
Question 289
What is the role of the 'second line' operational risk function?
Select an option first.
Correct answer: B — To develop and maintain the operational risk management framework — including: setting policies and standards, providing RCSA facilitation, maintaining the loss database, developing KRI frameworks, conducting scenario analysis, calculating or overseeing capital modelling, reporting to senior management and the board, and challenging first-line risk assessments
Explanation: B is correct. Second line (CRO/OpRisk): the centre of operational risk expertise. Responsibilities: framework design, policy setting, tools development, capital modelling oversight, reporting, and CHALLENGE — the 2nd line must be willing to push back on 1st line assessments that appear too optimistic. Independence from P&L: the 2nd line should not have commercial incentives that conflict with objective risk assessment. A is 1st line. C is 3rd line (internal audit). D is 1st line operational execution.
Question 290
What is 'segregation of duties' (SoD) and why is it fundamental to operational risk control?
Select an option first.
Correct answer: B — Ensuring no single individual has end-to-end control over a transaction or process — by separating the functions of authorisation, recording, custody, and reconciliation. This prevents a single person from committing and concealing fraud or error
Explanation: B is correct. SoD: classic example — the person who raises a purchase order should not also receive the goods, process the invoice, or authorise the payment. Each step is performed by different people. Failure of SoD enabled rogue traders (Nick Leeson managed his own back-office settlement accounts). SoD is harder in small banks with limited staff — compensating controls (frequent management review, independent reconciliation) are needed. A is governance separation. C is independence of risk function. D is an authorisation control.
Question 291
What is a 'control' in operational risk management and what are the two broad types?
Select an option first.
Correct answer: B — A mechanism designed to prevent, detect, or reduce operational risk events and their impact — preventive controls (designed to stop risk events from occurring, e.g., dual authorisation, access controls) and detective controls (designed to identify risk events after they occur, e.g., reconciliations, exception reports, audit trails)
Explanation: B is correct. Control types: Preventive: block the event before it happens — passwords and access controls (prevent unauthorised access), four-eyes principle (prevent single-person fraud), system input validations (prevent data entry errors). Detective: identify when something has gone wrong — bank reconciliations, exception reports, audit logs, management accounts review. A third type is corrective controls (fix issues after detection). A defines a perfect control (impossible). C is a policy, not a control. D is a regulatory constraint.
Question 292
What is 'control effectiveness' and how is it assessed in an RCSA?
Select an option first.
Correct answer: B — The degree to which a control actually reduces risk to the desired level — assessed in RCSA using criteria such as: design effectiveness (is the control logically designed to address the identified risk?) and operating effectiveness (is the control consistently applied in practice?). Controls may be well-designed but poorly executed, or vice versa
Explanation: B is correct. Control effectiveness: Design effectiveness — does the control, if working as intended, address the risk? Operating effectiveness — is it actually working consistently? A control rated highly on design but poorly on operation (e.g., a reconciliation that is performed but never reviewed) provides false assurance. Control testing: walkthroughs, sample testing of control performance, and review of exceptions. A: controls rarely prevent 100% of events. C is response time. D is cost-benefit analysis.
Question 293
What is 'business continuity planning' (BCP) and what does it address?
Select an option first.
Correct answer: B — A set of procedures and plans that enable an organisation to continue its critical operations during and after a disruptive event — such as a pandemic, fire, flood, IT system failure, or terrorist attack. BCP covers: risk assessment, business impact analysis, recovery strategies, communication plans, testing and exercises, and maintenance
Explanation: B is correct. BCP: addresses the continuity of critical processes when normal operations are disrupted. Business Impact Analysis (BIA): identifies critical processes, their recovery time objectives (RTOs), and recovery point objectives (RPOs). Recovery strategies: alternative work locations, manual workarounds, third-party backup. BCP is different from disaster recovery (IT focus) — BCP is broader, covering people, processes, and premises. A is facilities planning. C is a restructuring plan. D is a financial recovery plan.
Question 294
What is a 'Recovery Time Objective' (RTO) and a 'Recovery Point Objective' (RPO) in business continuity?
Select an option first.
Correct answer: B — RTO: the maximum acceptable time to restore a business process or system after a disruption before the impact becomes unacceptable. RPO: the maximum acceptable amount of data loss (measured in time) — how far back in time the last recoverable backup must be. Example: RTO = 4 hours (system must be back in 4 hours); RPO = 15 minutes (can lose at most 15 minutes of data)
Explanation: B is correct. RTO vs RPO: RTO drives recovery capability investment — a 1-hour RTO requires a hot standby; a 48-hour RTO can be met with a cold standby. RPO drives backup frequency — a 15-minute RPO requires replication every 15 minutes; a 24-hour RPO allows nightly backups. Together they define the resilience architecture. A has the definitions confused. C: they are BCP metrics, not capital. D: both apply to IT and business processes.
Question 295
What is 'disaster recovery' (DR) and how does it relate to BCP?
Select an option first.
Correct answer: B — The technology-focused subset of business continuity that covers recovery of IT infrastructure, data, and systems after a failure — BCP is broader (people, processes, premises, communications); DR is specifically about IT recovery. A comprehensive resilience programme requires both
Explanation: B is correct. DR vs BCP: DR is the IT sub-component of BCP. DR plans include: primary and secondary data centres, system failover procedures, data backup and restoration, network recovery. BCP also covers: staff communication trees, alternative work sites for people, manual process workarounds if systems are unavailable. Both require regular testing (DR: failover tests; BCP: tabletop exercises and live exercises). A is a financial recovery plan. C is a legal/litigation plan. D: DR is part of BCP.
Question 296
What is 'operational resilience' as a regulatory concept and how does it differ from BCP?
Select an option first.
Correct answer: B — Operational resilience is a broader regulatory concept requiring organisations to maintain the delivery of critical business services within defined impact tolerances during severe but plausible disruptions — BCP is a component tool. Resilience focuses on outcomes (what services must be maintained) rather than processes (how to recover), and requires ongoing testing against worst-case scenarios
Explanation: B is correct. Operational resilience (FCA/PRA PS21/3, ECB): five stages — Identify important business services (IBS), set impact tolerances (maximum acceptable disruption), map the people/process/technology dependencies of each IBS, test ability to remain within tolerance under severe scenarios, make investments to close gaps. Key difference from BCP: resilience is outcome-focused and test-driven against the worst case; BCP is process-focused and recovery-oriented. A conflates them. C is too narrow. D: it is mandatory for large financial institutions.
Question 297
What is an 'important business service' (IBS) in operational resilience regulation?
Select an option first.
Correct answer: B — A service provided to end users (customers, counterparties, or the market) whose disruption would cause significant harm to customers, market integrity, or financial stability — examples: retail payment processing, custody and settlement, trade execution, core banking (deposits, lending). Banks must identify their IBS and ensure they can be maintained within impact tolerances even during severe disruptions
Explanation: B is correct. IBS (FCA/PRA): the concept shifts focus from internal processes to customer outcomes. A bank must ask: 'What services do our customers rely on that, if disrupted, would cause real harm?' Core banking (inability to access deposits), retail payments (inability to make payments), and custody (inability to access securities) are typical examples. Regulators expect IBS to be identified from the perspective of user impact, not internal convenience. A uses a revenue threshold (not the definition). C is regulatory registration. D is a strategic, not resilience, definition.
Question 298
What is an 'impact tolerance' in operational resilience and how is it set?
Select an option first.
Correct answer: B — The maximum tolerable disruption to an important business service before significant harm occurs — expressed in terms of duration (e.g., a retail payment service must be restored within 2 hours) and/or severity (e.g., no more than 0.1% of transactions can be affected). Impact tolerances are set considering: customer harm, market stability, and the firm's own risk appetite
Explanation: B is correct. Impact tolerances: set by the board and reviewed annually. They drive investment in resilience. If the current capability cannot meet the tolerance (e.g., a system takes 6 hours to recover but tolerance is 4 hours), the firm must invest in improvement. Tolerance setting considers: customer vulnerability (retail customers vs sophisticated counterparties), systemic importance (could disruption affect market functioning?), and regulatory expectations. A is a system limit. C is a capital buffer concept. D is an escalation threshold.
Question 299
What is 'third-party risk management' in operational risk and why has it become a regulatory priority?
Select an option first.
Correct answer: B — The identification, assessment, and management of risks arising from outsourcing and reliance on third-party vendors — regulatory priority because: concentration risk (many banks rely on the same cloud providers or software vendors), reduced direct control over operations, regulatory accountability remains with the firm even when operations are outsourced, and third-party failures can cause operational disruptions and data breaches
Explanation: B is correct. Third-party risk (EBA Guidelines on Outsourcing, DORA regulation in EU): banks remain responsible for outsourced activities even when performed by third parties. Key risks: operational risk (vendor failure causes service disruption), concentration risk (many banks using the same cloud provider — e.g., AWS, Microsoft Azure), data security (vendor has access to sensitive customer data), and regulatory access (regulator must be able to access outsourced operations). A is credit/counterparty risk. C is client management. D: applies critically to financial services.
Question 300
What is the 'DORA' (Digital Operational Resilience Act) and who does it apply to?
Select an option first.
Correct answer: B — An EU regulation (2025) establishing binding requirements for digital operational resilience for financial entities — covering: ICT risk management frameworks, incident reporting (major ICT incidents must be reported to regulators), digital operational resilience testing (including TLPT — threat-led penetration testing), ICT third-party risk management, and information sharing about cyber threats. Applies to banks, investment firms, insurers, CCPs, data repositories, and critical ICT third-party providers
Explanation: B is correct. DORA (Regulation 2022/2554, effective January 2025): applies to approximately 22,000 financial entities in the EU. Key pillars: (1) ICT risk management; (2) ICT incident management and reporting; (3) Digital resilience testing; (4) ICT third-party risk management (oversight of critical providers by ESAs); (5) Information and intelligence sharing. It consolidates and harmonises previously fragmented national requirements. A is a US concept. C: DORA is mandatory, not voluntary. D: no asset threshold applies.
More free FRM topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.