You’re on a roll
Create a free account to save your FRM progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › FRM › Operational Risk and Resilience
Free FRM Operational Risk and Resilience Practice Questions & Answers
400 exam-style Operational Risk and Resilience questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 391
What is 'risk governance framework' for operational risk and what documents comprise it?
Select an option first.
Correct answer: B — The comprehensive documentation defining how operational risk is governed within the organisation — typically comprising: (1) Operational Risk Policy (high-level principles and responsibilities); (2) Operational Risk Appetite Statement; (3) RCSA Standards and Procedures; (4) Loss Data Capture Policy; (5) KRI Framework; (6) Scenario Analysis Guidelines; (7) Capital Modelling Standards; (8) Reporting Framework; (9) Roles and Responsibilities Matrix. Together these define the 'how' of operational risk management
Explanation: B is correct. Governance document hierarchy: policy (what must be achieved) → standards (how to achieve it) → procedures (step-by-step instructions) → guidelines (best practice). Policy: board-approved, annual review. Standards: CRO-approved, more detailed. Procedures: business-unit level, operational instructions. Alignment: all lower-level documents must be consistent with the policy and risk appetite statement. For regulatory examination: supervisors expect comprehensive, current documentation that reflects actual practice — not policies that are outdated or inconsistent with what actually happens. A: covers all OpRisk, not just IT. C: a single document is insufficient for the full framework. D: applies to all banks (proportionately).
Question 392
What is 'DORA Article 30' and what third-party contractual requirements does it mandate?
Select an option first.
Correct answer: B — DORA Article 30 mandates that contracts between financial entities and ICT third-party service providers include: (1) Clear description of services provided; (2) Data location (where data is stored and processed); (3) Audit rights (financial entity and competent authorities); (4) Business continuity obligations of the provider; (5) Incident notification requirements; (6) Exit strategy provisions (termination notice, data return/portability); (7) Performance standards and SLAs. These requirements ensure financial entities can exercise oversight and exit without disruption
Explanation: B is correct. DORA Article 30 key provisions: audit rights: critical — regulators must be able to access outsourced operations. This was previously unclear in many cloud contracts (providers resisted full audit access). Data location: financial entities must know where their data is (data sovereignty compliance). Exit provisions: DORA requires documented exit strategies and data portability — preventing vendor lock-in. Concentration: contract must address substitutability of the provider if they become unavailable. Implementation: all existing contracts needed to be reviewed and updated by January 2025. A: mandatory provisions. C: mandatory for all qualifying contracts. D: applies to all ICT third parties regardless of jurisdiction.
Question 393
What is 'ethical hacking' and how does it improve operational resilience?
Select an option first.
Correct answer: B — Authorised simulation of cyber attacks conducted by security professionals ('white hat hackers' or 'red teams') to identify vulnerabilities before malicious attackers do — includes: penetration testing (external and internal), red team exercises (simulated advanced persistent threat), and bug bounty programmes (crowdsourced vulnerability discovery). Provides: evidence-based assessment of security posture, prioritised list of vulnerabilities to remediate, and testing of detection and response capabilities
Explanation: B is correct. Ethical hacking types: External pen test: simulates an outside attacker with no prior knowledge. Internal pen test: simulates a malicious insider or compromised account. Red team exercise: sophisticated, multi-vector attack simulation over weeks — more realistic than a standard pen test. Bug bounty: third-party researchers report vulnerabilities for a reward — continuous crowdsourced testing. DORA TLPT: the most sophisticated form, using threat intelligence to design targeted attacks. All require: formal written authorisation, agreed scope and rules of engagement, and proper handling of findings. A: performed by authorised external professionals. C and D: illegal without authorisation.
Question 394
What is 'supply chain security' and how does it relate to the SolarWinds attack?
Select an option first.
Correct answer: B — Securing the processes, tools, and people involved in developing, delivering, and maintaining software and services — the SolarWinds attack (2020) compromised the build environment of SolarWinds' network monitoring software: malicious code was inserted into a legitimate software update. When 18,000+ organisations installed the update, they installed a backdoor. Defences: software bill of materials (SBOM), code signing verification, isolated build environments, third-party security assessments, and monitoring for anomalous behaviour by trusted software
Explanation: B is correct. SolarWinds lessons: (1) Software updates are a trusted attack vector — defenders often whitelist updates. (2) Build environment security is as important as production security. (3) Detection is extremely difficult — the malicious code was in the trusted binary. (4) Blast radius: one compromised vendor → 18,000 organisations affected. Financial sector response: review all IT vendors, verify code signing certificates, implement anomaly detection for trusted software behaviour, and require vendors to produce SBOMs (inventory of software components). A and C: software supply chain, not physical. D: applies to all organisations using third-party software.
Question 395
What is 'control failure root cause' analysis and what categories are typically used?
Select an option first.
Correct answer: B — Systematic identification of the underlying cause of a control failure — not just the immediate cause but the root cause. Common root cause categories: (1) Design failure (the control was never adequate for the risk); (2) Resource failure (insufficient staff, time, or tools to operate the control); (3) Knowledge failure (staff didn't understand how to operate the control); (4) Culture failure (employees deliberately bypassed the control); (5) System failure (technology supporting the control failed). Each category drives different remediation
Explanation: B is correct. Root cause categories with actions: Design: redesign the control. Resource: increase staffing, tools, or time allocation. Knowledge: provide training and clearer procedures. Culture: address incentives, accountability, and 'tone from the top.' System: upgrade technology, improve maintenance, improve testing. Multi-cause: most major failures involve multiple root causes. Prevention: addressing only the immediate cause without the root cause leads to repeated failures. A is blame attribution. C: root cause analysis should be proportionate to the severity. D: resource issues are one of multiple root causes.
Get the full FRM question bank — free
Drop your email and we'll send you fresh FRM practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 396
What is 'regulatory technical standards' (RTS) for operational risk and who produces them?
Select an option first.
Correct answer: B — Binding technical standards produced by the European Banking Authority (EBA) that supplement the EU Capital Requirements Regulation (CRR) with detailed operational requirements — for operational risk: RTS on the supervisory convergence for the application of the Standardised Approach, RTS on the operational risk loss data quality standards, and technical standards on ICT security under DORA. Once adopted by the European Commission, they are legally binding on all EU banks
Explanation: B is correct. EBA RTS process: EBA develops draft RTS after consultation → submits to European Commission → Commission adopts as EU Regulation (binding). For OpRisk: the RTS define the precise technical requirements for: the BI calculation (which income items qualify), the ILM calculation (data quality requirements), the COREP reporting format (standardised templates). All EU banks must comply. Equivalent UK process: PRA produces Supervisory Statements after Brexit (not identical to EBA RTS but similar function). A is internal standards. C is BCBS guidance (influential but not binding in same way). D: EBA produces EU-level standards.
Question 397
What is 'third-party exit strategy' and why is it required under DORA and EBA Guidelines?
Select an option first.
Correct answer: B — A documented plan for transitioning away from a critical third-party provider if: (1) The provider fails or becomes insolvent; (2) The service quality deteriorates below acceptable thresholds; (3) Security or compliance concerns emerge; (4) The contract is terminated. Required by DORA and EBA Outsourcing Guidelines because vendor concentration risk is only manageable if the bank can exit without undue operational disruption. Exit strategies include: transition to an alternative provider, insourcing the function, or acceptance of temporary service reduction
Explanation: B is correct. Exit strategy requirements: DORA Article 28 and EBA Outsourcing GL require: identification of alternative providers before signing; data portability requirements in contracts (data must be exportable in usable format); transition services provision (vendor must provide support during exit); testing: some regulators require banks to test exit capabilities (can you actually move to an alternative provider?). Practical challenges: cloud exit is technically complex (data migration, application reconfiguration). Cloud contracts: require specific exit provisions. Exit strategy testing: at least scenario planning for exit, ideally a live test of data portability. A is commercial management. C: exit strategies needed proactively. D: required from contract outset.
Question 398
What is 'control rationalization' and when is it beneficial?
Select an option first.
Correct answer: B — The process of reviewing and streamlining the control framework to eliminate redundant, ineffective, or over-engineered controls — beneficial when: (1) Multiple controls address the same risk without meaningful diversification; (2) Automated controls make manual ones redundant; (3) Control costs exceed the risk they mitigate; (4) Control complexity creates confusion and reduces compliance rates. Rationalisation frees resources for more effective risk reduction
Explanation: B is correct. Control rationalisation process: (1) Map all existing controls to the risks they address. (2) Assess each control's effectiveness and cost. (3) Identify redundancy (multiple controls addressing the same risk from the same angle). (4) Test whether removing redundant controls changes residual risk. (5) Redirect saved resources to address genuine control gaps. Risk: removing too many controls reduces defence-in-depth. Balance: maintain layered controls for the highest risks; rationalise over-controlled lower risks. Output: a leaner, more effective, and better-understood control framework. A removes detective controls (wrong). C removes preventive controls (wrong). D: ongoing process.
Question 399
What is 'risk and control environment monitoring' and what triggers a special review?
Select an option first.
Correct answer: B — Continuous tracking of the risk and control environment through: regular KRI review, RCSA updates, loss event analysis, audit findings, and control testing results — special reviews triggered by: major loss events, significant audit findings (high-risk issues), material business changes, regulatory findings during examinations, market-wide incidents affecting the industry, and internal whistleblower reports
Explanation: B is correct. Monitoring rhythm: continuous: automated KRI monitoring, real-time transaction monitoring. Weekly/monthly: CRO dashboard review, KRI exception reporting. Quarterly: OpRisk Committee review of risk profile, RCSA update. Annual: comprehensive RCSA refresh, ICAAP capital update. Special reviews: a major cyber incident at a peer bank should trigger: 'are we exposed to the same vulnerability?' A regulatory enforcement action against another bank for conduct risk: 'do we have the same practices?' A: financial market monitoring is a different function. C: internal monitoring is continuous. D: internal risk function leads monitoring.
Question 400
What is 'conduct surveillance' and how is it used in operational risk management?
Select an option first.
Correct answer: B — Automated monitoring of employee communications, trading patterns, and behaviours to detect potential conduct violations — examples: (1) Communications surveillance (monitoring emails, chat, and phone calls for regulatory compliance); (2) Trade surveillance (monitoring for market manipulation, front-running, wash trading); (3) Expense reporting analytics (detecting policy violations); (4) Access pattern monitoring (detecting unusual system access suggesting insider threat)
Explanation: B is correct. Conduct surveillance in OpRisk: communications surveillance: required by MiFID II (records of all relevant communications related to trading). Trade surveillance: required to detect market abuse (MAR in EU). AI-assisted: NLP tools now analyse communication patterns at scale — flagging potential issues for human review. Privacy balance: surveillance must comply with employment law and privacy regulations. Governance: surveillance output should feed into: the conduct risk framework, HR disciplinary processes, and regulatory reporting (SARs for financial crime suspicions). A is performance management. C: conduct surveillance detects issues regardless of who's involved. D: applies to all areas with conduct risk.
More free FRM topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.