Free FRM Operational Risk and Resilience Practice Questions & Answers

Explanation: B is correct. Embedding the ORMF: the ultimate measure of ORMF quality is whether it changes behaviour in the business — not whether the policies exist. Indicators of good embedding: (1) Business managers attend RCSA workshops and contribute meaningfully. (2) Risk concerns are raised spontaneously (not just in response to loss events). (3) Risk appetite is referenced in business decisions. (4) KRI deterioration triggers management action without prompting from the risk function. This requires: training, senior management support, and demonstrating that the ORMF adds value (not just generates paperwork). A is policy distribution. C: applicable to all banks. D is technology deployment.

Explanation: B is correct. Inherent vs residual: Inherent risk: 'If we had no controls for this process, how likely and severe would operational losses be?' Residual risk: 'Given our current controls, how likely and severe are operational losses?' The gap (inherent − residual) represents the control effectiveness. If controls are weak (low effectiveness), residual risk approaches inherent risk. Control adequacy: if residual risk > appetite → control gap identified → action plan required. Tracking: monitor residual risk trend — deteriorating residual risk signals declining control effectiveness. A: they differ by control effectiveness. C: inherent risk can include any risk source. D: the reduction depends on specific control effectiveness, not a fixed percentage.

Explanation: B is correct. System redundancy types: RAID storage (disk redundancy — data replicated across multiple disks). Failover clustering (if server fails, another takes over automatically). Geographically separated data centres (protects against site-level failures — fire, flood, power outage). Network redundancy: if ISP A fails, traffic automatically routes through ISP B. Relevance to resilience: for critical systems with short RTOs (minutes), redundancy is the only way to achieve the required recovery time. Hot standby is the maximum redundancy implementation. A is staffing. C: requires active-passive at minimum; not two identical live systems. D is software licensing.

Explanation: B is correct. Information classification: in banking — customer PII (strictly confidential), trading strategies (confidential), annual reports (public). Controls applied by classification: Strictly Confidential: encrypted at rest and in transit, need-to-know access, no cloud storage without approval. Confidential: standard encryption, role-based access, secure transfer. Public: no special handling needed. Regulatory requirements: GDPR requires 'appropriate security' proportionate to the sensitivity of personal data — classification is the foundation for implementing this. A is financial product categorisation. C is regulatory categorisation. D is loss event prioritisation.

Explanation: B is correct. Kill chain for defence: each stage offers defensive opportunities. Reconnaissance: limit public information about systems, monitor for external scanning. Delivery: email filtering, secure web gateway. Exploitation: patch vulnerabilities promptly. Installation: endpoint detection and response (EDR) tools. Command & Control: block suspicious outbound connections, DNS filtering. Actions on Objectives: data loss prevention, user behaviour analytics. The kill chain concept: breaking the chain at any stage prevents the attack from succeeding. A is insurance. C is incident response. D is BCP.

Explanation: B is correct. MTTD and MTTR importance: the longer the dwell time (MTTD), the more an attacker can steal, damage, or prepare for a destructive action. Every hour of downtime (MTTR) has a direct financial cost. Improving MTTD: invest in SIEM, endpoint detection and response (EDR), 24/7 security operations centre (SOC). Improving MTTR: well-rehearsed incident response plan, automated containment capabilities, pre-negotiated incident response retainer with specialist firms. Both metrics should be tracked on the cyber risk dashboard and reported to the board. A is loan processing. C: DORA requires resilience testing, not specific MTTD/MTTR targets. D: defined and used internally.

Explanation: B is correct. AML programme requirements: often called the 'five pillars' (some jurisdictions use four, some five): (1) Policies, procedures, and internal controls; (2) Designated compliance officer; (3) Employee training; (4) Independent testing; (5) CDD/KYC. Operational risk dimension: AML failures = major OpRisk events. HSBC 2012: $1.9B fine for AML failures. BNP Paribas 2014: $8.9B fine for sanctions violations. Programme quality is assessed by regulators in SREP and AML-specific examinations. Operational resilience: AML systems must be resilient (continuous transaction monitoring can't have extended downtime). A is customer acquisition. C: major OpRisk and regulatory consequence. D is insurance.

Explanation: B is correct. Correspondent banking DD (FATF Recommendation 13, BCBS guidance): prohibitions: no correspondent accounts for shell banks (banks with no physical presence and no affiliation to a regulated group). Passing through: the correspondent bank facilitating transactions for the respondent's customers takes on AML risk for those customers, even though it hasn't directly KYC'd them. Nested correspondent banking: a respondent bank may itself have correspondent relationships — the original bank may be facilitating transactions for customers several steps removed. This opacity is a major AML risk. A is standard CDD. C: applies to any correspondent relationship. D: often cross-border but can be domestic.

Explanation: B is correct. Record retention in OpRisk: retention periods: AML records (FATF): at least 5 years after the business relationship ends. Financial records (most jurisdictions): 5-7 years. Communications (MiFID II, Dodd-Frank): 5-7 years for trade-related communications. GDPR: retain only as long as necessary for the specified purpose. Risk: inadequate retention exposes the bank to: regulatory sanctions (can't provide records on request), legal liability (can't defend against claims without records), and capital model weakness (loss data older than the retention period is unavailable). A is narrow. C: legally required for most record types. D: mandatory under multiple regulations.

Explanation: B is correct. AML vs OpRisk assessment: relationship: AML risk is a subset of operational risk (under Clients/Products/Business Practices or Compliance risk categories). But the AML risk assessment is a standalone regulatory requirement (FATF, EU AML Directives) with its own methodology, documentation, and regulatory review. AML risk assessment output: risk rating for each customer segment, product, and geography → drive the intensity of CDD and monitoring. RCSA: covers AML risk as one component alongside technology, process, people, and other risks. Regulators: AML supervisors (FCA, FinCEN) assess AML risk assessment quality separately from OpRisk supervisors (PRA). A: different focuses and methodologies. B has the right answer. C: AML is a subset but uses specialised methodology. D: multiple other risk assessments are required.

Explanation: B is correct. Resilience mapping (FCA/PRA PS21/3): for each IBS, banks must map: IT systems (which systems process this service?), data flows (what data is used?), people (which teams and roles are critical?), processes (which operational processes support the service?), third parties (which vendors are critical to the service?). From this map: identify single points of failure (one system supports 5 IBS — if it fails, all 5 are disrupted). Third-party dependencies: if a critical vendor fails, which IBS are affected? This mapping supports BCP (what's the minimum to maintain this service?) and IT investment decisions. A is geographic. C is IT documentation. D is physical asset management.

Explanation: B is correct. Resilience scenario testing: scenarios designed for resilience testing: (1) Simultaneous failure of primary and secondary data centres; (2) Critical third-party vendor unavailable for 72 hours; (3) Major cyber attack affecting core banking; (4) Pandemic with 60% staff unavailability. Test type escalation: tabletop → simulation (partial system activation) → live (actual failover). Results: does the service stay within the defined impact tolerance (e.g., payments restored within 4 hours)? If not: identify the bottleneck and invest in improvement. A is IT performance testing. C is security testing. D is market risk stress testing.

Explanation: B is correct. RMIS capabilities: large banks: integrated platforms (MetricStream, Archer, Galvanize). Smaller banks: spreadsheet-based or simpler tools. Key features: (1) Loss database: standardised entry form, approval workflow, auto-notification of key staff. (2) RCSA: guided questionnaire, risk rating calculation, control assessment. (3) KRI: automated data feeds where possible, threshold monitoring, escalation automation. (4) Reporting: standard reports to management committees, ad hoc reporting capability. (5) Capital: integration with LDA model inputs and outputs. BCBS 239: RMIS is a key component of risk data aggregation capability. A is communication. C is regulatory reporting software.

Explanation: B is correct. Detection time as KRI: examples — cyber intrusion dwell time: industry average ~200 days (attacker has access for 200 days before detection). Target: reduce to hours or days through SIEM, threat hunting, and anomaly detection. Trade reconciliation detection: how quickly are reconciliation breaks detected and investigated (KRI: average age of open reconciliation items). Fraud detection: time from first fraudulent transaction to account freeze. Improving detection: automated monitoring (vs manual sampling), machine learning anomaly detection, and active threat hunting all reduce detection time. A is reporting timeliness. C is RCSA update speed. D is risk identification timing.

Explanation: B is correct. Regulatory notification: different thresholds for notification: DORA major ICT incident classification criteria include: impact on availability, integrity, or confidentiality of ICT systems and data. PRA/FCA material incident: likely to affect the firm's ability to provide services, causes customer harm, or has regulatory significance. After notification: regulators may require more information, impose remediation requirements, or conduct on-site inspections. Failing to notify: a compliance risk event in itself — regulators view delayed notification very seriously. A: not all losses require notification. C is periodic reporting. D: mandatory for qualifying events.

Explanation: B is correct. Cloud migration risk management: pre-migration: detailed risk assessment, security design review, testing plan, regulatory pre-clearance (if required). During migration: phased approach (migrate less critical systems first), parallel running, rollback plan, enhanced monitoring. Post-migration: update BCP/DR to reflect cloud-based infrastructure, review vendor concentration, test resilience against cloud provider failure, update access control for cloud management. Regulatory: EBA Cloud Guidelines and DORA apply to cloud usage — due diligence and contractual protections required. A is personal cloud use (different risk). C is financial risk. D is a procurement risk.

Explanation: B is correct. CMT activation: a major cyber attack, a significant regulatory investigation, a rogue trading scandal, or a major system failure would activate the CMT. CMT responsibilities: (1) Assess the situation and make key decisions (invoke BCP? shut down systems? notify regulator? issue press statement?). (2) Allocate resources to the response. (3) Ensure legal and regulatory obligations are met. (4) Manage external communications. (5) Monitor the recovery. Pre-defined CMT: practised in regular exercises (tabletop scenarios), so the team can function effectively under stress. A is risk management function. C is day-to-day management. D is the ORMF function.

Explanation: B is correct. Minimum viable operation (MVO): concept from operational resilience. For a payment service: MVO might be — 3 staff (vs normal 20), simplified payment processing system (backup), manual controls replacing automated checks. The MVO drives: staffing plans (who are the critical staff?), technology investment (what is the minimum viable IT stack?), cross-training (can 3 people cover the full service?). Regular testing: can the bank actually run the service with just the MVO resources? Testing often reveals: more staff are needed than assumed, the simplified system doesn't actually work, or manual workarounds don't meet regulatory requirements. A is budget. C is regulatory capital. D is service level agreements.

Explanation: B is correct. Control risk in OpRisk: a single control may have a 5% failure rate per transaction. Two independent controls for the same risk: combined failure rate = 5% × 5% = 0.25% (much lower). This justifies layering controls (defence in depth). Control risk assessment: in RCSA, each control is rated for effectiveness — a poorly operated control (e.g., reconciliation done but never reviewed) has high control risk regardless of its design quality. A is audit function risk (a separate concept). C is cost-benefit analysis. D is a meta-risk.

Explanation: B is correct. Cyber warfare examples: North Korean Lazarus Group attacked SWIFT-connected banks (2016 Bangladesh Bank heist: $81M stolen). Russian GRU-linked groups have targeted energy and financial infrastructure. Attribution: governments make attributions but proof is difficult in criminal proceedings. Insurance: Lloyd's of London began requiring explicit exclusion of state-backed cyber attacks from cyber policies (2023). Management: maintain awareness of geopolitical tensions (elevated threat from specific adversaries), maintain strong technical defences, and work with national cyber agencies (NCSC, CISA). A is incorrect. C: historical examples exist. D: banks must be self-reliant; governments provide intelligence but not direct defence.

Explanation: B is correct. Model-based monitoring in OpRisk: transaction monitoring: ML models flag transactions deviating from normal patterns. Statistical process control: establish control limits for KRIs; if a process produces items outside control limits (±3σ), alert is generated. NLP monitoring: scan news, regulatory publications, and social media for references to the bank (sentiment analysis, crisis detection) or for emerging threat intelligence. These models complement human monitoring — the volume of data is too large for human review alone. A is market risk monitoring. C is model performance monitoring. D is KRI monitoring (a subset).

Explanation: B is correct. Breach escalation framework: tiered response: amber = awareness and monitoring; red = action required. Example: OpRisk loss rate KRI: Green < 1.5% of revenue, Amber 1.5-2%, Red > 2%. Red breach: CRO notified immediately, board risk committee at next meeting, regulatory notification if material. Action plan: identify root causes, implement control improvements, set milestones for return to green. Culture: escalation must be rewarded (people who raise concerns should be recognised, not penalised). A is a shutdown response (too extreme). C: breaches should be escalated to humans. D: capital is planned in ICAAP, not auto-increased.

Explanation: B is correct. Testing frequency drivers: (1) Criticality of the business service (critical systems tested more often). (2) Regulatory requirements (DORA, FCA/PRA operational resilience rules require regular testing). (3) Time since last plan update (after major changes, retest). (4) Results of last test (if gaps were found, retest more frequently). (5) Industry threat environment (elevated cyber threats → increase testing frequency). Post-test: document results, create action plans for gaps, update plans. Regulators assess testing evidence during SREP. A: continuous testing cycle is required. C: changes trigger additional testing but regular schedule is maintained. D: frequency is risk-proportionate, not fixed.

Explanation: B is correct. Simulation vs tabletop comparison: tabletop: lower cost, faster, good for plan familiarisation and logic checking. Simulation: higher cost, more realistic, reveals actual gaps (the backup site may not work as expected; the backup system may need 6 hours to restore instead of the assumed 2). Both are valuable: tabletop for regular familiarisation; simulation for deeper validation of actual capability. Regulatory expectation: for critical business services, at least one live test (simulation or full exercise) per year for the most critical components. A: different modality and realism. C: tabletops remain valuable for regular training. D: applies to all disruption types.

Explanation: B is correct. Authentication vs authorisation: authentication: who are you? (verifying identity). Authorisation: what are you allowed to do? (access control). Both are required. Risk-based authentication: the level of authentication required scales with the risk of the action (reading an account balance = Level 1; authorising a £1M payment = Level 3). FIDO2/WebAuthn: modern standards enabling hardware security keys and biometrics for strong authentication. MFA best practices: something you know (PIN/password) + something you have (phone/token) + something you are (biometric). A is authorisation. C is encryption. D is audit logging.

Explanation: B is correct. GDPR breach notification (Article 33-34): 72-hour clock starts when the organisation becomes 'aware' — knowledge sufficient to conclude a breach has occurred. Not required to notify if: the breach is unlikely to result in risk to individuals (e.g., encrypted data stolen where the attacker can't decrypt it). High risk to individuals: also notify the individuals directly (e.g., breach involving passwords, financial data, medical data). Failure to notify: fines up to €10M or 2% global turnover (lower tier). Contents: nature, categories, numbers, consequences, measures. A: 72 hours, not 24, to the regulator. C: individual notification required for high-risk breaches. D: notify the DPA (not just FCA).

Explanation: B is correct. Minimum viable team (MVT): a payment processing team normally has 20 staff. Through BIA: 5 specific roles are truly critical (authoriser, checker, systems operator, manager, supervisor). Cross-training: each critical role has at least 2 backup staff. MVT = 5 people who can keep minimum viable payments running. BCP design: the bank must be able to assemble the MVT even if the primary site is unavailable (backup site, remote working, on-call arrangements). Testing the MVT: actually run operations with just these 5 people in a simulation exercise. A is skills-based. C is seniority-based. D is a regulatory staffing rule.

Explanation: B is correct. Insider trading OpRisk: it is both a conduct risk (treating market participants unfairly) and a fraud risk (employee gaining personal advantage). Prevention: information barriers (Chinese walls) between investment banking and research/trading divisions, personal account dealing restrictions and pre-clearance requirements, watch lists and restricted lists for securities where the bank has MNPI, and robust surveillance of employee trading. Regulatory consequences: FCA enforcement action, criminal prosecution, and significant reputational damage. A: perpetrated internally, not by customers. C: perpetrated by employees with MNPI. D: it has significant OpRisk dimensions.

Explanation: B is correct. Audit committee vs risk committee: audit committee: oversight of internal audit, financial reporting, and compliance (backward-looking — are controls working? Is reporting accurate?). Risk committee: oversight of risk appetite, risk management framework, and current risk profile (forward-looking — what risks are we taking?). For OpRisk: both committees receive relevant reports. Internal audit findings on OpRisk gaps → audit committee. Risk profile, KRI trends, capital → risk committee. Often co-ordinated through a combined risk and audit committee in smaller banks. A: manages governance, not risk operations. C: the risk committee has separate responsibilities. D: ICAAP is produced by management.

Explanation: B is correct. Design vs operation distinction: RCSA captures both: Design assessment: 'Does this control, if working as intended, adequately address the identified risk?' Operation assessment: 'Is the control being executed consistently and effectively in practice?' Common gap: a mandatory dual authorisation control (good design) where approvals are given by email without reviewing the transaction (poor operation). Testing: design tested through walkthroughs; operation tested through samples of actual execution records. A: well-designed controls can be poorly operated. C: both frequency and design matter. D: automated controls can also fail to operate as designed (system bugs, configuration errors).