You’re on a roll
Create a free account to save your FRM progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › FRM › Operational Risk and Resilience
Free FRM Operational Risk and Resilience Practice Questions & Answers
400 exam-style Operational Risk and Resilience questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 61
What is 'variance' of the aggregate loss distribution and how is it calculated?
Select an option first.
Correct answer: B — For a compound Poisson: Var[S] = λ × E[X²] = λ × (Var[X] + (E[X])²). This combines the frequency and severity variances into the aggregate variance. For other compound distributions: Var[S] = E[N] × Var[X] + Var[N] × (E[X])². Note: the aggregate variance grows with both frequency variability AND severity variability
Explanation: B is correct. Compound Poisson variance: since Poisson has Var[N] = λ = E[N], the formula simplifies to Var[S] = λ × E[X²]. For non-Poisson frequency (Negative Binomial, Var[N] > E[N]), the additional variance from Var[N] term is significant. Key insight: even if individual losses are small and relatively uniform, high frequency (large λ) creates substantial aggregate variance. Standard deviation = √Var[S] = σ_portfolio. A is wrong (they don't simply add). C: Var[S] uses the product in a specific way. D: closed-form solutions exist for the variance.
Question 62
What are 'benchmark losses' in operational risk and how are they used?
Select an option first.
Correct answer: B — Pre-defined reference loss amounts for specific operational risk scenarios — used to: calibrate internal loss data, validate scenario analysis outputs (by checking against industry benchmarks), and test the reasonableness of capital estimates. If a bank's capital for 'major rogue trading' is far below industry benchmarks for similar events, the model may be understating risk
Explanation: B is correct. Benchmark losses: used in the validation process for scenario analysis. If the bank's expert panel estimates a $50M 'worst case' for a major cyber attack, but industry benchmarks (ORX data, public loss events) suggest similar events have cost $500M+, the scenario may be anchored too low. Benchmarking prevents underestimation through availability bias (estimating based only on events the expert remembers). A is a loss floor. C is industry data. D is a regulatory disclosure.
Question 63
What is the 'frequency-severity independence assumption' in LDA and when does it fail?
Select an option first.
Correct answer: B — In the LDA compound model, frequency (number of events) and severity (size of each event) are assumed to be statistically independent — this assumption fails when: large events are harder to detect and therefore less frequently reported, economic downturns simultaneously increase both frequency (more fraud) and severity (larger individual losses), or systemic events affect both dimensions together
Explanation: B is correct. Frequency-severity independence: standard LDA assumes N and X are independent. Violations: (1) Detection bias — small losses are harder to detect than large ones, so reported frequency depends on severity (near-miss problem). (2) Economic cycle — during downturns, fraud frequency AND severity may both increase (more perpetrators, larger attempted frauds). (3) Model implication: if positive correlation exists, the true aggregate variance is higher than the standard formula suggests: Var[S] would include a positive covariance term. A: independence is an assumption, not always reality. C: not true. D: it is the standard LDA assumption.
Question 64
What is a 'risk cell' in operational risk capital modelling?
Select an option first.
Correct answer: B — The intersection of one business line and one event type — the most granular unit in the LDA framework. A bank with 8 business lines and 7 event types has a maximum of 56 risk cells. Each cell has its own frequency and severity distribution fitted to the loss data for that specific combination. Capital is calculated for each cell and then aggregated (with appropriate correlation assumptions) to produce the total OpRisk capital
Explanation: B is correct. Risk cells: the granularity of the LDA. In practice: not all 56 cells have enough data to fit distributions separately. Common approaches: (1) Aggregate cells with sparse data (combine similar cells); (2) Use external data to supplement internal data for sparse cells; (3) Apply a single distribution across multiple related cells. The aggregation of cell capitals: independent assumption gives σ_total = √(Σ σᵢ²); correlated assumption gives σ_total closer to Σ σᵢ. A is not a risk cell. C is a loss event. D is a spreadsheet concept.
Question 65
What is 'parameter estimation uncertainty' in operational risk and how is it addressed in reporting?
Select an option first.
Correct answer: B — The imprecision in estimated distribution parameters (e.g., the GPD shape parameter ξ) due to limited data — this creates a range of plausible capital estimates rather than a single precise number. Addressed through: reporting confidence intervals for capital, sensitivity analysis (capital vs parameter), Bayesian credibility weighting (combining internal data with prior information), bootstrapping (resampling-based uncertainty quantification)
Explanation: B is correct. Addressing parameter uncertainty: standard approach: point estimate of parameters → single capital number. Better practice: (1) Bootstrap confidence intervals: resample loss data 1,000 times → distribution of capital estimates → report 10th-90th percentile range. (2) Bayesian: posterior distribution of parameters → posterior predictive distribution of capital. (3) Sensitivity: tabulate capital for a grid of plausible parameter values. This prevents the illusion of precision in OpRisk capital estimates. A is software selection. C: large banks with more data still have parameter uncertainty. D: external data adds its own uncertainty (scaling).
Get the full FRM question bank — free
Drop your email and we'll send you fresh FRM practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 66
What is 'insurance-linked loss adjustment' in operational risk and how does it affect gross vs net loss?
Select an option first.
Correct answer: B — The adjustment to the reported gross loss amount for any insurance recovery received — the net loss = gross loss minus insurance recovery. In the loss database: (1) Record gross loss (full financial impact before recovery); (2) Record recovery separately (insurance payout amount, date received); (3) Net loss = Gross − Recovery. Capital models typically use gross losses (reflecting full potential impact regardless of recovery) while business performance uses net losses
Explanation: B is correct. Gross vs net in loss database: recording separately: gross loss captures the true economic impact if insurance were unavailable (important for capital — what if the insurer defaults?). Recoveries provide information on: insurance effectiveness, time-to-recovery, and types of events where insurance is useful. Basel IV SA: capital is based on gross loss data (the ILM uses gross losses). ICAAP may use net losses if insurance is reliable. A is claims filing. C is actuarial pricing. D: no regulatory gross-up requirement.
Question 67
What is the 'goodness-of-fit' testing challenge in operational risk distribution fitting?
Select an option first.
Correct answer: B — The challenge of verifying that a chosen statistical distribution adequately represents the observed loss data — particularly difficult for operational risk because: (1) Small sample sizes reduce statistical power; (2) Standard tests (K-S, A-D) focus on the body, not the tail; (3) The tail is most important for capital but has fewest data points; (4) Extreme observations ('elephants') can dominate test statistics
Explanation: B is correct. GoF challenges: Kolmogorov-Smirnov: uses maximum absolute difference between empirical and theoretical CDF — sensitive to body, not tail. Anderson-Darling: weights the tail more heavily — preferred for OpRisk. QQ-plot: visually inspect tail fit (are the largest empirical quantiles close to the theoretical quantiles?). Model selection uncertainty: even if the lognormal fits 'better' than Pareto by one metric, the tail fit may still be poor. Practitioners often report multiple metrics and use judgment. A: GoF tests assess the fit, not just capital accuracy. C is wrong. D: it significantly affects capital quality.
Question 68
What is the 'threshold selection' problem in Peaks-over-Threshold EVT and what techniques help?
Select an option first.
Correct answer: B — Choosing the optimal threshold u above which the GPD is fitted — too low: includes non-extreme data where GPD approximation is poor; too high: too few exceedances for stable parameter estimation. Techniques: (1) Mean residual life plot (MRL): the expected excess above a threshold should be linear in u if GPD applies — linearity indicates appropriate threshold range; (2) Stability plots: check if GPD shape parameter ξ and scale σ are stable across a range of thresholds; (3) Rules of thumb (e.g., 10-20% of data as exceedances)
Explanation: B is correct. Threshold selection: MRL plot: plot E[X − u | X > u] against u. If the data follows GPD above u, this should be approximately linear. Where linearity begins indicates the appropriate threshold. Stability plot: plot ξ and modified σ against u — stable region indicates valid threshold. Rule of thumb: at least 30-50 exceedances needed for stable GPD estimation, at least 100 preferred. A: the median would include too much body data. C: the 95th percentile is one common choice but not fixed. D: EVT applies to all sectors including banking.
Question 69
What is 'Credibility Theory' and how is it applied to operational risk?
Select an option first.
Correct answer: B — An actuarial technique for combining limited internal loss data with external or industry data — the credibility-weighted estimate = Z × Internal Estimate + (1-Z) × External Estimate, where Z is the 'credibility weight' (0 to 1) reflecting the reliability of the internal data (higher Z for more internal data). This addresses sparse internal data for tail modelling
Explanation: B is correct. Credibility weighting in OpRisk: when a bank has only 3 years of internal data for a specific risk cell, Z is low (say 0.3) — the estimate leans heavily on external data (industry average). With 10 years of rich internal data, Z approaches 1 — internal data dominates. The Bühlmann credibility formula: Z = n / (n + k), where n = internal observations and k = variance ratio (intra-class/inter-class). Allows gradual transition from external to internal data as the internal database matures. A is not credibility theory. C: credit rating concept. D is a different weighting approach.
Question 70
What is 'temporal aggregation' of operational losses and why does it matter?
Select an option first.
Correct answer: B — The question of whether to model annual aggregate losses directly or to model individual loss events and then aggregate over a year — in LDA, individual events are modelled (compound model). Annual aggregation: the aggregate distribution is derived by convolving the frequency and severity distributions. For capital purposes: the one-year horizon is standard — one-year aggregate VaR at 99.9th percentile
Explanation: B is correct. Temporal aggregation in LDA: the fundamental LDA framework produces the annual aggregate loss distribution (one year = standard regulatory capital horizon). Alternative horizons: some ICAAP stress tests use multi-year horizons. The aggregate loss over multiple years isn't simply: capital × years (due to diversification across time and the possibility of rare events). Multi-year capital: run the compound model for multiple years, accounting for autocorrelation (are losses in different years independent?). A is simple summation. C is a reporting requirement. D is present value adjustment.
Question 71
What is a 'stress scenario' for operational risk capital and how is it different from the 99.9th percentile LDA capital?
Select an option first.
Correct answer: B — A specific, severe but plausible operational risk event (e.g., 'the bank suffers a major cyber attack costing €500M') used in capital planning and ICAAP — different from LDA capital (99.9th percentile of the full loss distribution): LDA is a statistical distribution averaging over all types of events; a stress scenario is a specific named event. Stress scenarios test: can the bank survive this specific event? LDA tests: can the bank survive the statistical worst-case?
Explanation: B is correct. Stress vs LDA capital: LDA: statistical 99.9th percentile aggregate annual loss. Stress scenario: explicit named event with estimated gross loss. Uses of stress: (1) ICAAP capital buffer: if a specific scenario exceeds LDA capital, additional Pillar 2 capital may be warranted. (2) Resilience planning: what specific actions would be taken if this event occurred? (3) Governance: board and senior management understand specific plausible extreme events. Regulators often require specific stress scenarios (e.g., 'assume a major cyber incident affecting your top 3 systems'). A: they differ significantly. C: not always — LDA may capture things not in scenarios. D: used for all risk types.
Question 72
What is the 'minimum data requirement' for internal loss data under Basel IV?
Select an option first.
Correct answer: B — Under Basel IV SA, banks must use at least 10 years of internal loss data for the Internal Loss Multiplier (ILM) calculation (for banks with BI > €1B). For banks in their first year of applying the SA with insufficient data: a transitional provision allows a minimum of 5 years initially, scaling to 10 years over time. The data must be comprehensive and meet quality standards for inclusion
Explanation: B is correct. Basel IV data requirements: 10-year historical window for large banks (BI > €1B) applying the full ILM adjustment. Rationale: 10 years captures at least one business cycle, improving data representativeness for tail estimation. Transitional: banks new to the SA may start with 5 years and build to 10 years. Data quality: losses must be verifiable, consistently classified, and comprehensive (all qualifying events captured above the threshold). Under BIA/SA (Basel II): minimum 3 years (hence option A). C: Basel sets the minimum; banks may exceed it. D: minimum is regulatory, not bank-determined.
Question 73
What is 'value chain analysis' in identifying operational risks?
Select an option first.
Correct answer: B — A systematic review of the sequence of activities that create value in a business — each step in the value chain is assessed for operational risks. For a bank's payment processing value chain: customer initiates → authentication → account validation → payment routing → settlement → reconciliation → customer notification. Each step may fail: authentication (fraud), routing (error), settlement (counterparty failure), reconciliation (exception)
Explanation: B is correct. Value chain analysis for OpRisk: maps the full production process and identifies where operational failures can occur at each step. Advantages: ensures comprehensive coverage (no process steps overlooked), links risks to specific processes (easier to assign controls), and provides input for BCP (which steps are critical?). Different from RCSA: RCSA is a risk self-assessment; value chain analysis is a structured process mapping exercise that provides input to RCSA. A is business analysis. C and D are different valuation techniques.
Question 74
What is 'regulatory arbitrage' risk in operational risk capital and how does Basel IV address it?
Select an option first.
Correct answer: B — The risk that banks manipulate their capital models (under AMA) to produce artificially low capital estimates — some banks used overly optimistic correlation assumptions, cherry-picked scenario estimates, or over-credited insurance to reduce capital below what was economically justified. Basel IV addresses this by: replacing internal models with a standardised approach (no more AMA), applying the output floor (ILM minimum = 1), and using actual loss data rather than model discretion
Explanation: B is correct. Regulatory arbitrage in AMA: specific tactics used: (1) Overstating diversification (assuming near-zero correlations between risk cells); (2) Understating scenario estimates (anchoring too low); (3) Overstating insurance benefit (claiming 20% reduction without adequate insurer due diligence). Basel IV response: standardised approach (all banks use the same formula). Output floor for ICAAP models: ILM minimum of 1 prevents capital reduction below the BIC. These changes reduce inter-bank comparability issues. A is regulatory rule change risk. C is jurisdictional risk. D is calibration concern.
Question 75
What is the 'Panjer class' of distributions and why are they useful for aggregate loss calculations?
Select an option first.
Correct answer: B — A family of frequency distributions (Poisson, Binomial, Negative Binomial) that satisfy the recursive relationship P(N=k) = (a + b/k) × P(N=k-1) — this property enables the efficient Panjer recursion algorithm for computing aggregate loss distributions. The three distributions differ in their parameter (a, b) values: Poisson (a=0), Binomial (a0)
Explanation: B is correct. Panjer (a,b,0) class: the recursive property P(k) = (a + b/k) P(k-1) enables the aggregate distribution to be computed through a simple recursion (combined with a discretised severity distribution) rather than requiring full Monte Carlo simulation. This is computationally efficient for risk cells with moderate loss counts. Practical importance: the Panjer recursion is built into many actuarial and OpRisk software packages. A: Panjer distributions are frequency distributions. C: Panjer relates to frequency, not severity. D: copulas model dependence, not frequency.
Question 76
What is the 'loss given event' (LGE) concept in operational risk?
Select an option first.
Correct answer: B — The financial impact when a specific operational risk event occurs — encompassing: direct costs (financial loss, write-offs), indirect costs (legal fees, regulatory fines, remediation costs), and revenue impact (lost business). LGE is the operational risk equivalent of LGD (Loss Given Default) in credit risk. It can vary significantly across events of the same type, necessitating a severity distribution rather than a single fixed estimate
Explanation: B is correct. LGE concept: analogous to loss given default. Each event has a range of possible outcomes. Example: a payment processing error might be corrected immediately (LGE = $0) or might escalate to a regulatory fine (LGE = $10M). The severity distribution models this variability. High variability in LGE → higher variance of the aggregate loss distribution → higher capital. Reducing LGE: better incident response (catch errors faster), insurance (transfer large LGE events), better controls (prevent escalation). A is average historical loss. C is regulatory capital. D is insurance recovery (part of the recovery concept).
Question 77
What is 'reputational loss' in the context of operational risk capital modelling and why is it excluded?
Select an option first.
Correct answer: B — Reputational losses (customer attrition, revenue loss from brand damage) are explicitly excluded from the Basel definition of operational risk and therefore from operational risk capital calculations — this is because: (1) Reputational losses are extremely difficult to quantify objectively; (2) They are secondary consequences of operational events, not operational events themselves; (3) Modelling reputational impact requires assumptions about customer behaviour and market reactions
Explanation: B is correct. Exclusion of reputational losses: Basel's narrow definition of OpRisk (processes, people, systems, external events) excludes strategic and reputational consequences. However: banks are required to assess reputational risk in their ICAAP (Pillar 2) even if it's not included in Pillar 1 capital. The BI may indirectly capture some reputational effects (lower fee income after a major event reduces BI and thus capital), but the relationship is indirect. A: reputational events don't generate a separate LDA risk cell. C: assessed qualitatively in ICAAP but not modelled in a separate quantitative formula. D: BI captures revenue, which may be affected, but this is indirect.
Question 78
What is the difference between 'discovery date' and 'accounting date' in operational loss recording?
Select an option first.
Correct answer: B — Discovery date: the date when the operational loss was discovered or first recognised. Accounting date: the date when the loss was actually recorded in the bank's accounts. These can differ significantly: a rogue trader may have been concealing losses for months before discovery, or a regulatory fine may be imposed years after the underlying conduct. Both dates should be recorded in the loss database — which date to use for capital modelling is a design choice
Explanation: B is correct. Discovery vs accounting dates: for Basel capital, both dates are relevant in different ways. The loss amount on the accounting date reflects the final financial impact. The discovery date reflects when the control failed. For trend analysis: discovery date tracks when the event entered the bank's awareness (relevant for KRI and control assessment). For capital modelling: accounting date more relevant (actual financial loss). Timing differences matter: a $5M loss discovered in Year 1 but booked in Year 2 appears in different annual loss totals depending on which date is used. A: they can differ substantially. C: both are relevant. D: discovery date can be later (if concealment) or accounting date (if immediate recognition).
Question 79
What is 'aggregation across business lines' and what correlation is typically assumed?
Select an option first.
Correct answer: B — Combining operational risk capital estimates from different business lines to produce a firm-wide total — in practice, business lines are not perfectly correlated (a payment processing failure doesn't necessarily coincide with a trading fraud), so banks assume partial correlations between business lines, typically 0.25-0.75, to reduce total capital below the sum of individual capitals through diversification
Explanation: B is correct. Aggregation correlations: Under AMA, banks were allowed to assume correlations between business lines (with regulatory scrutiny). Typical approach: (1) Use a correlation matrix (all pairs); (2) Apply a copula to aggregate; (3) Report diversified capital (with correlations) and undiversified capital (perfect correlation = sum). Diversification benefit: if each of 8 business lines has $100M capital and average correlation = 0.5, total diversified capital ≈ $566M vs $800M undiversified. The correlation assumption significantly affects total capital. A is the undiversified sum. C: Basel IV SA doesn't specify aggregation — banks model it internally. D: a single confidence level (99.9%) is used throughout.
Question 80
What is 'the role of internal audit in operational risk data quality'?
Select an option first.
Correct answer: B — Internal audit (third line) independently reviews: completeness of the loss database (are qualifying events being captured?), accuracy of loss amounts and classifications, adequacy of the capture process (are all business units participating?), and appropriateness of recovery recording. Findings from internal audit reviews are fed back to improve the ORMF
Explanation: B is correct. IA role in OpRisk data quality: IA tests: (1) Whether all business units with qualifying losses are submitting data. (2) Whether loss amounts reconcile to accounting records. (3) Whether events are classified correctly (right event type and business line). (4) Whether recoveries are accurately recorded. (5) Whether near-misses are being captured. IA findings: if major gaps exist in data capture, the LDA model parameters are potentially biased — IA findings must be acted upon. A: the second line manages the database. C: capture thresholds are set by risk management policy. D: external data comes from ORX or public sources.
Question 81
What is 'model backtesting' vs 'model benchmarking' in operational risk?
Select an option first.
Correct answer: B — Backtesting: comparing model predictions against actual outcomes over time to assess predictive accuracy — for OpRisk LDA, test whether the predicted loss percentiles match empirical exceedance rates. Benchmarking: comparing the bank's capital estimate against an external reference point (industry average, regulatory benchmark, peer bank) to assess whether the estimate is reasonable relative to the industry
Explanation: B is correct. Backtesting vs benchmarking: backtesting is backward-looking (did our predictions match reality?). Benchmarking is relative (how does our estimate compare to peers?). For OpRisk: backtesting at the 99.9th percentile is almost impossible (not enough data). Benchmarking: compare OpRisk capital as % of gross income or RWA against peer banks from Pillar 3 disclosures. Both are model validation techniques. IA and model validators use both. A: same concept description error. C reverses time dimensions. D: benchmarking applies to all model types.
Question 82
What is 'Bayesian estimation' and how is it applied to operational risk parameter estimation?
Select an option first.
Correct answer: B — A statistical method that combines prior information (expert judgment, industry data) with observed data to produce a posterior distribution of parameters — Prior distribution (belief about parameter before seeing data) + Likelihood (probability of observing the data given the parameter) → Posterior distribution (updated belief). For OpRisk: prior based on industry data; likelihood based on internal losses; posterior used for capital calculation
Explanation: B is correct. Bayesian OpRisk: example — prior: industry shape parameter ξ ~ Normal(0.6, 0.1) based on ORX data. Likelihood: 20 internal losses above threshold. Posterior: updated distribution of ξ reflecting both prior knowledge and internal data. Advantages: naturally combines sparse internal data with external information; quantifies parameter uncertainty; prevents extreme estimates from sparse data. MCMC (Markov Chain Monte Carlo) methods are often used to compute the posterior. A is basic statistics. C is the BIA/SA. D is purely frequentist (ML) estimation.
Question 83
What is the 'benchmark approach' for setting scenario parameters in operational risk?
Select an option first.
Correct answer: B — Using public loss data and industry loss benchmarks to calibrate internal scenario estimates — if an expert panel estimates a '1-in-100-year cyber attack costs $30M' but ORX data shows comparable events at industry peers cost $200M-$500M, the internal estimate should be revised upward. Benchmarks: ORX reports, public loss databases (IBM OpRisk, ORX News), Pillar 3 disclosures from comparable banks
Explanation: B is correct. Benchmark calibration: expert panels suffer from anchoring (anchoring on internal experience), availability bias (underestimating events they haven't personally experienced), and overconfidence (narrow confidence intervals). Benchmarking against external data corrects for these biases. Procedure: (1) Run expert workshop for initial estimates; (2) Present industry benchmarks for the same risk type; (3) Facilitate discussion and revision where significant gaps exist; (4) Document rationale for any remaining differences. A is a specific technique within calibration. C: not regulatory-prescribed. D: benchmarks supplement (don't replace) workshops.
Question 84
What is 'risk diversification' in the context of operational risk and does it work in the same way as for market risk?
Select an option first.
Correct answer: B — Operational risk diversification is more limited than market risk diversification because: (1) Operational loss events (especially in the tail) are driven by systemic failures that affect multiple risk types simultaneously; (2) Historical correlations between OpRisk cells understate tail correlations (extreme events are more correlated than normal events); (3) Unlike market risk, OpRisk doesn't have natural offsetting positions — you can't go long one operational risk to hedge another
Explanation: B is correct. OpRisk diversification limitations: market risk: long/short positions provide natural offsets; correlation diversification is well-supported by portfolio theory. OpRisk: no natural offsets — each event type is a unidirectional loss. Diversification exists (different business lines and event types don't all fail simultaneously), but tail correlations are higher than normal correlations (in a crisis: fraud, system failures, and external events may all spike simultaneously). This is why the independence assumption in aggregation is conservative (overestimates diversification) and why tail dependence modelling is important. A: different mechanisms. C: some diversification exists. D: market risk diversification is more theoretically grounded.
Question 85
What is 'risk concentration' in a single event type and why does it create model instability?
Select an option first.
Correct answer: B — When the operational risk capital of a single cell or event type dominates the total — for example, if technology risk scenarios alone account for 80% of total OpRisk capital, small changes in technology scenario assumptions drive large swings in total capital. This creates model instability: the capital estimate is not robust to modest parameter changes in the dominant risk
Explanation: B is correct. Concentration and model instability: LDA capital is heavily influenced by the tail of the dominant risk cell. If one scenario contributes 80% of capital, a 20% revision to that scenario's parameters changes total capital by 16% — significant. Mitigation: ensure the RCSA and scenario process covers all material risks, not just the most visible ones. Validate that the dominant risk really is the largest and not just the best-modelled. A: concentration increases, not reduces, the risk. C: instability affects all modelling approaches including the ILM sensitivity in Basel IV SA.
Question 86
What is a 'loss event form' (LEF) and what information does it capture?
Select an option first.
Correct answer: B — The internal document used to capture details of each operational loss event for the loss database — typical fields: event date, discovery date, business line, event type (Basel category), gross loss amount, recovery amount, net loss, root cause, control failure, remediation action, and approvals. Standardised format ensures consistent data quality across business units and enables meaningful aggregation
Explanation: B is correct. Loss event form design: key fields ensure the loss data is useful for: capital modelling (amounts, categories), root cause analysis (why did this happen?), control improvement (what control failed?), and trend analysis (is this event type increasing?). Quality controls: completeness checks (all required fields), approval workflows (manager must approve submission), reconciliation to accounting (loss amount ties to a ledger entry), and periodic audits (IA samples LEFs against source documents). A is regulatory reporting. C is accounting. D is insurance administration.
Question 87
What is 'expected shortfall at 99.9%' vs 'VaR at 99.9%' for operational risk capital?
Select an option first.
Correct answer: B — VaR at 99.9%: the loss level that is exceeded with 0.1% probability — a single quantile. Expected shortfall (CVaR) at 99.9%: the expected loss given that it exceeds the 99.9th percentile VaR — the average of the worst 0.1% of loss outcomes. For heavy-tailed OpRisk distributions, ES > VaR and provides more information about catastrophic tail losses. Some internal OpRisk models use ES rather than VaR for economic capital to better capture tail severity
Explanation: B is correct. ES vs VaR: VaR tells you the threshold; ES tells you the average loss beyond the threshold. For OpRisk: the distribution is very heavy-tailed — the difference between VaR and ES can be enormous. Example: VaR (99.9%) = $500M but the distribution has a long tail — the average loss given exceeding $500M might be $2B. ES captures this. Basel III market risk shifted to ES (97.5%) partly for this reason. For OpRisk Pillar 1: VaR (99.9%) is the regulatory standard. Some advanced ICAAP models use ES. A: ES > VaR for the same confidence level in distributions with non-trivial tails. C: VaR is used for the regulatory standard. D reverses the practice.
Question 88
What is 'frequency-severity compound distribution simulation' step by step?
Select an option first.
Correct answer: B — Step 1: Specify frequency distribution (e.g., Poisson with λ = 5). Step 2: Specify severity distribution (e.g., Lognormal with μ=10, σ=2). Step 3: For each simulation, draw N from Poisson(5). Step 4: For each of the N events drawn, draw X from Lognormal(10, 2). Step 5: Compute annual aggregate S = X₁ + X₂ + ... + X_N. Step 6: Repeat 1,000,000 times to build the full distribution of S. Step 7: Read the 99.9th percentile from the simulated distribution as capital
Explanation: B is correct. LDA simulation: this is the core of the Monte Carlo LDA algorithm. Each simulation represents one 'year' of operational experience. The distribution of 1,000,000 simulated annual losses is the estimated aggregate loss distribution. The 99.9th percentile = the 1,000th largest value out of 1,000,000 simulations (0.1% × 1,000,000 = 1,000). Variance: the 99.9th percentile from Monte Carlo has simulation error — more simulations reduce this error. A is market risk simulation. C is regulatory standardised calculation. D is a regulatory formula.
Question 89
What is 'risk event taxonomy' and how does it map to Basel event categories?
Select an option first.
Correct answer: B — A detailed classification system for operational loss events that maps to the seven Basel Level 1 event categories, with additional granularity at Level 2 (subcategories) and Level 3 (specific event types). Example: Level 1 = Internal Fraud; Level 2 = Unauthorised Activity; Level 3 = Rogue Trading, Mismarking Positions. Consistent taxonomy enables: accurate capital modelling (events in the right risk cell), trend analysis, peer benchmarking, and regulatory reporting
Explanation: B is correct. Risk event taxonomy: Basel Level 1 (7 categories) → Level 2 (subcategories within each) → Level 3 (specific event types). The taxonomy is the foundation of the loss database classification. Banks typically adopt the Basel taxonomy and add Level 3 detail specific to their business. Challenges: some events span multiple categories (a rogue trader using IT access to conceal trades = Internal Fraud + IT system abuse). Resolution: primary category rule — classify by the primary cause or impact. A: risk event taxonomy is specifically for OpRisk, not all risk types. C: Basel categories are the foundation.
Question 90
What is 'capital allocation' in operational risk and how does it relate to performance management?
Select an option first.
Correct answer: B — The process of assigning a portion of total operational risk economic capital to each business unit or legal entity — based on each unit's contribution to total capital. Used in performance management: business unit RAROC includes an OpRisk capital charge (capital allocated × hurdle rate). Units with high OpRisk capital (high losses, high-risk activities) bear a higher cost, reducing their risk-adjusted return and creating incentives to manage OpRisk better
Explanation: B is correct. OpRisk capital allocation: methods — proportional (each BU's share of total capital proportional to its standalone capital), marginal contribution (each BU's capital = total portfolio capital − capital without that BU), Shapley value (game-theoretic approach). For RAROC: BU profit − expected loss − operating costs − (allocated OpRisk EC × hurdle rate) = risk-adjusted profit. If a BU's RAROC < hurdle rate due to high OpRisk, management can: reduce OpRisk (improve controls, exit risky activities) or re-price the activity. A is regulatory capital use. B is the correct answer. C is arbitrary. D: all banks can use EC allocation.
More free FRM topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.