Free FRM Operational Risk and Resilience Practice Questions & Answers

Explanation: B is correct. Fourth-party risk: example — Bank A outsources customer data analytics to Vendor B. Vendor B uses cloud storage from Subcontractor C. If Subcontractor C has a data breach, Bank A's customer data may be exposed even though Bank A never contracted with Subcontractor C. Supply chain attacks (SolarWinds 2020: hackers compromised a software update server, affecting thousands of downstream organisations) illustrate this risk. Mitigation: require vendors to disclose and manage their own third-party risk. A is regulatory risk. C is competition risk. D is board/governance risk.

Explanation: B is correct. Change management risk: the majority of major IT incidents result from changes (updates, patches, configurations). Controls: Change Advisory Board (CAB) approves all changes. UAT (User Acceptance Testing) validates changes before deployment. Production deployment: strict procedures, monitoring post-deployment, ready roll-back plan. The Knight Capital failure: different software versions on different servers caused erroneous order routing that bought instead of sold — $440M in 45 minutes. A is organisational change management. C: risk applies to all changes. D: complexity increases change risk.

Explanation: B is correct. BIA: the foundation of BCP. Process: map all business processes → identify dependencies → assess impact of disruption over time (1 hour, 4 hours, 1 day, 1 week) → assign RTO and RPO for each process. Output: prioritised list of processes requiring continuity protection. A payment processing system may have RTO = 1 hour; a regulatory reporting system may have RTO = 24 hours. BIA informs recovery strategy selection (hot standby vs warm standby vs cold standby). A is loss impact analysis. C is P&L attribution. D is market risk analysis.

Explanation: B is correct. Tabletop exercise: low cost, easily repeated, good for: validating that the plan is coherent and complete, training new staff in BCP procedures, and testing communication protocols. Limitation: doesn't test whether systems actually work or whether people can execute under real stress. For critical systems: tabletop exercises should be supplemented with live testing (actually failing over to the backup system and running operations from there). A is a live simulation. C is a competitive element not typical of BCP. D is an automated DR test.

Explanation: B is correct. Financial services supply chain risk: more analogous to an industrial supply chain than often realised — a bank's operations depend on: Bloomberg/Refinitiv for market data (concentration risk), AWS/Azure for cloud computing (concentration risk), SWIFT for messaging (single point of failure for international payments), telecom providers for connectivity. Cyber attacks on supply chain members can cascade to the bank (SolarWinds-type attacks). DORA specifically addresses this. A is commodity/market risk. C is operational/credit risk combination. D: applies to all financial services.

Explanation: B is correct. OpRisk training: human failures are a major source of operational risk — errors, fraud, policy breaches. Training reduces unintentional errors (process training), increases fraud detection (fraud awareness), and improves incident reporting (culture training). Key training types: new hire (induction — all staff), role-specific (traders, payment staff, customer-facing), annual refresher (updated for new threats/regulations), scenario-based (cybersecurity phishing simulations), and management (accountability for risk outcomes). A is compliance training only. C is too narrow. D is too narrow.

Explanation: B is correct. Whistleblowing: protected in most jurisdictions (UK PIDA 1998, EU Whistleblower Directive, Dodd-Frank in US). Banks must have effective, confidential reporting channels — anonymous hotlines, independent ombudsman. Culture: employees must believe they will be protected from retaliation — if past whistleblowers were pushed out, the channel will be unused. Major scandals (Wells Fargo fake accounts, PPI mis-selling) were reported by internal staff but weren't acted upon early enough. A is regulatory reporting. C is confidentiality policy. D is hierarchy-based reporting.

Explanation: B is correct. Insurance programme management: key policy types for banks — Bankers Blanket Bond (BBB): covers internal fraud, employee dishonesty, forgery, computer fraud. Professional Indemnity (PI): covers negligence, errors and omissions in professional services. Directors and Officers (D&O): personal liability cover for directors. Cyber Insurance: data breach, ransomware, BI. Property and Business Interruption: physical damage and resulting revenue loss. Premium negotiation: loss history, control quality, and management credibility affect pricing. A is cost minimisation. C: broader than physical assets. D: insurance is a management choice, not a regulatory mandate.

Explanation: B is correct. Crisis communication: pre-prepared communication plan is essential — defining: who speaks (spokesperson), approved messages for different scenarios, escalation thresholds (when to notify board, regulator, customers), and communication channels (email, press release, regulatory filing). Timing matters: proactive communication (admitting the problem early) is usually better than being forced to by media coverage. GDPR: data breach affecting customers must be notified within 72 hours. A is internal communication only. C is incomplete. D is reactive media management.

Explanation: B is correct. NIST CSF: widely adopted globally despite being US-originated. Five functions: (1) Identify: know your assets and risks. (2) Protect: implement safeguards. (3) Detect: identify cybersecurity events. (4) Respond: take action after a detected event. (5) Recover: restore capabilities and services. Financial institutions use it to: structure their cybersecurity programme, communicate risk posture to boards and regulators, benchmark against peers, and identify gaps. A: voluntary, not mandatory. C: global applicability. D: complements (doesn't replace) specific regulatory requirements.

Explanation: B is correct. Vulnerability management lifecycle: Scan → Identify vulnerabilities → Classify (CVSS score: Critical/High/Medium/Low) → Prioritise (focus on Critical and High first) → Remediate (patch, configuration change, compensating control) → Verify (rescan to confirm remediation) → Track (measure time to remediate by severity). Automation: vulnerability scanning tools (Qualys, Nessus, Tenable) run continuously. Patching SLA: Critical CVEs should be patched within 24-48 hours (attackers exploit known vulnerabilities within days of publication). A is a point-in-time assessment. C: continuous by nature. D: internal teams lead with optional external support.

Explanation: B is correct. Network segmentation: the principle of isolation. Example: production network ≠ development network ≠ HR system ≠ payment system ≠ internet-facing systems. Each segment boundary is a firewall/control point. In a ransomware attack: without segmentation, malware spreads across the entire network. With segmentation: spread is limited to the initially infected segment — other segments (and critical data backups) remain unaffected. Zero trust: takes segmentation to the extreme (each user and device is a micro-segment). A is organisational structure. C: a single firewall is insufficient. D: not a specific regulatory requirement.

Explanation: B is correct. Supply chain attacks: SolarWinds (2020): attackers compromised SolarWinds' Orion software update mechanism. When thousands of organisations (including US government agencies and banks) installed the update, they installed malicious code. The attack went undetected for 9+ months because the malicious code was embedded in a trusted signed software update. Defence: software composition analysis, code signing verification, vendor security assessments, anomaly detection that looks for unusual behaviour by trusted software. A is physical supply chain. C and D are other attack targets.

Explanation: B is correct. Insider threat controls: (1) Access control — least privilege, regular access reviews (remove unneeded access). (2) Monitoring — user behaviour analytics (UBA/UEBA): detect anomalous behaviour patterns (unusual data access volumes, after-hours activity). (3) Separation of duties — no single person controls end-to-end processes. (4) Data loss prevention (DLP) — detect sensitive data exfiltration attempts. (5) Culture — speak-up culture, exit interviews. (6) Background checks — flag prior incidents (necessary but not sufficient). A: insiders are internal. C: relevant regardless of turnover. D: background checks reduce but don't eliminate risk.

Explanation: B is correct. BPO operational risks: regulatory accountability: even if the process is outsourced, the bank remains fully responsible to regulators for compliance. Customer harm: if the outsourced call centre provides poor advice, the bank faces conduct risk consequences. Data breaches: the provider handling customer data creates data security risk. Concentration: many UK banks outsource to the same Indian BPO providers — a major failure at one provider would simultaneously affect multiple banks. EBA Outsourcing Guidelines: require risk assessment, due diligence, contractual protections, and ongoing monitoring for all material outsourcing. A is incorrect. C: regulatory compliance cannot be outsourced. D is M&A.

Explanation: B is correct. Dual control applications: (1) Payment authorisation: transactions above €X require two senior staff signatures. (2) Cash vault: two custodians with separate keys required to open. (3) Safe deposit: bank key + customer key both required. (4) IT deployment: two engineers required for production code changes (four-eyes principle). (5) Wire transfers: maker-checker process. Rogue trader prevention: Nick Leeson bypassed dual control by controlling both the trading and settlement (back-office) functions. A is systems control. C is reporting. D is IT backup.

Explanation: B is correct. Reconciliation controls: position reconciliation: the risk system shows 1,000 long AAPL options; the accounting system shows 1,200. The 200 'break' requires investigation — possible causes: booking error, system lag, fraud. Settlement reconciliation: expected cash payments vs actual bank statement. Frequency: critical reconciliations (payment systems) run daily or intraday; others weekly. Unreconciled items (aged breaks): a KRI — high aged breaks indicate systematic problems. Rogue trading detection: if position reconciliation had been robust at Barings, Leeson's hidden positions would have been detected. A is financial reporting. C is dispute resolution. D is capital validation.

Explanation: B is correct. Key person dependency management: (1) Succession planning — identify successors and develop them. (2) Knowledge capture — document critical knowledge; don't allow single-person knowledge. (3) Cross-training — ensure backup coverage for critical roles. (4) Process manuals — critical processes documented for any qualified person to execute. (5) Business continuity: who performs the function if the key person is unavailable today? OpRisk RCSA: key person dependency should be identified as a risk in affected business lines. A is CRO succession (one example). C: it has direct OpRisk consequences (process failure if person unavailable). D: it is an operational risk.

Explanation: B is correct. Control framework hierarchy: Policy: 'All customer transactions must be authorised by an appropriate person.' Standard: 'Transactions above €1M require Level 3 or above authorisation.' Procedure: 'For transactions above €1M: (1) Complete form XX; (2) Obtain Level 3 signature; (3) Submit to treasury...' Control: dual authorisation (preventive) and transaction audit log (detective). Monitoring: monthly sample testing of 20 transactions to verify compliance. This layered structure provides: clarity (everyone knows what's required), consistency (same standards across the organisation), and accountability (who is responsible for each control). A is too narrow. C is too broad. D: banks design their own frameworks within regulatory expectations.

Explanation: B is correct. Hot/warm/cold standby: hot standby (active-active): both systems running simultaneously, instant failover — used for critical payment systems, real-time trading. Warm standby (active-passive): secondary system running but not processing — activated in hours — used for core banking. Cold standby: DR site with hardware available but needs configuration — 24-72 hours — used for less critical systems. Cost vs RTO tradeoff: hot standby = highest cost (running two full systems) but minimal downtime. BCP/DR design: select standby type based on each system's RTO from the BIA. A is hardware type. C is power systems. D is regulatory classification.

Explanation: B is correct. Physical security as OpRisk control: data centre physical security: biometric access, mantraps, CCTV, server cabinet locks. A cyber attacker with physical access to a server can bypass all software security controls. Office physical security: secure document disposal (shredding), clean desk policy, clean screen policy (lock screen when away). Tail risk: a physical breach of a data centre could give an attacker access to all production systems. Cloud computing reduces but doesn't eliminate physical security concerns — cloud data centres must be physically secure. A: applies to all bank locations. C: cloud data centres still require physical security. D: a data centre breach would be extremely serious.

Explanation: B is correct. Maker-checker: a fundamental two-person integrity control. Example in payments: maker inputs payee account, amount, date → checker independently verifies all details → system releases payment only after both authorisations. Prevents: accidental errors (a second pair of eyes catches mistakes) and deliberate fraud (requires two colluding individuals). Limitations: collusion risk (two people can collude to commit fraud); rubber-stamping risk (checker approves without genuine review). A: requires a different person. C: senior staff involved but not exclusively. D: system-enforced maker-checker is one implementation.

Explanation: B is correct. Clean desk policy: part of a broader information security framework. Related controls: clean screen policy (lock computers when away), secure printing (collect printed documents immediately), secure disposal (shred confidential documents), visitor management (visitors escorted). Risk addressed: a visitor (client, vendor) can easily read documents left on a desk. An opportunistic thief can steal printed customer data or access cards. COVID-driven home working: extended the clean desk concept to home offices (secure printers, VPN, no sensitive documents visible in video calls). A is housekeeping. C is hybrid working policy. D is audit trail requirement.

Explanation: B is correct. Log management: types of logs — access logs (who logged into which system, when), security events (failed logins, privilege escalation), application logs (transaction events, errors), network logs (traffic patterns). SIEM: aggregates logs from all sources, applies correlation rules, and generates alerts for suspicious patterns. Forensics: without logs, investigating a cyber incident is nearly impossible. Retention: GDPR requires logs for as long as needed; PCI DSS requires 12 months minimum. Key challenge: log volume is enormous — automated tools (SIEM, machine learning) are needed to identify meaningful events. A is credit management. C is records management. D is the operational loss database.

Explanation: B is correct. Two-person rule: applied where unilateral access would create unacceptable risk. Examples: bank vault: two employees with separate keys. High-security server room: biometric + second person's badge. Private key management (cryptocurrency): requires M-of-N key shares from multiple custodians. Secret key ceremonies (root certificate authorities): two-person rule with multiple witnesses. This is more restrictive than maker-checker — it requires physical simultaneous presence of both people, not just sequential approval. A is the maker-checker principle. C is a broader management requirement. D is the maker-checker concept.

Explanation: B is correct. Authorisation limits: a key control for fraud prevention and error containment. Tiered structure: as transaction size increases, higher authority is required. Exceptions: a manager can approve an exception to their own limit but it must be escalated and documented. Controls over limits: the operational risk function and internal audit should regularly review whether limits are appropriate (not too high, exposing the bank; not too low, creating excessive bottlenecks). Rogue trading: if a trader's authorisation limit is $50M but they enter $5B in positions, there has been an authorisation control failure. A is a regulatory limit. C: automation of the limit is one implementation. D: limits are tiered by role.

Explanation: B is correct. Configuration management: IT systems have thousands of configuration settings — any of which can inadvertently expose vulnerabilities if changed incorrectly. Examples of configuration failures: leaving default passwords unchanged (a common entry point for attackers), misconfigured cloud storage exposing customer data (AWS S3 buckets set to public), open firewall ports not required for business. CMDB: provides the authoritative record of all IT assets and their configurations. Drift detection: automated tools compare current configuration to approved baseline — alerts on unauthorised changes. A and C are physical/project management. D: configuration management is a specific IT process.

Explanation: B is correct. Joiner-mover-leaver (JML): regulators and auditors assess JML processes routinely. Key failures: leavers (worst risk — ex-employees with active credentials can use them maliciously or credentials can be used by attackers who know the username). Movers: accumulation of access rights over time ('access creep') — someone who moved through 4 roles may have rights from all 4 roles, far exceeding least privilege. Orphaned accounts: accounts belonging to people who left but never disabled — a security risk. Automated JML processes reduce human error and delay. A is customer account management. C is an HR process. D: JML is a standard IT process, not specifically regulatory.

Explanation: B is correct. Control environment vs RCSA: RCSA is process-level (what are the risks in this process and how effective are the controls?). Control environment assessment is organisational level (is the overall control culture healthy? Are there systemic weaknesses?). Examples of control environment concerns: consistently poor RCSA scores across multiple business units (systemic culture issue), high audit finding rates (systemic process weakness), management override culture (people routinely bypass controls under pressure). A is a financial audit. C: RCSA is a subset of control environment assessment. D is supervisory inspection.

Explanation: B is correct. ITGCs as foundational: if ITGCs are weak, all data and process controls built on IT systems may be compromised. Example: weak access controls → any employee can modify the loss database, reconciliation system, or payment approval workflow → all detective and preventive controls potentially worthless. External auditors (SOC 1, SOC 2 reports): assess ITGC effectiveness as part of their reliance on IT-generated data. Regulators: assess ITGC quality as part of operational risk supervision. A is application-level controls. C is a misconception. D describes application controls (a different category).