You’re on a roll
Create a free account to save your FRM progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › FRM › Operational Risk and Resilience
Free FRM Operational Risk and Resilience Practice Questions & Answers
400 exam-style Operational Risk and Resilience questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 121
What is 'ILM calculation' step by step under Basel IV?
Select an option first.
Correct answer: B — Step 1: Calculate the Loss Component (LC) = 15 × average annual operational losses over 10 years (using gross losses above the capture threshold). Step 2: Calculate the Business Indicator Component (BIC) using the three BI sub-components. Step 3: ILM = ln(exp(1) − 1 + (LC/BIC)^0.8). Step 4: Capital = BIC × ILM. Note: for banks with LC/BIC ratio = 1 (average losses), ILM ≈ 1. For LC/BIC > 1 (above-average losses), ILM > 1. Minimum ILM = 1 (floor applied — no capital reduction for good loss history)
Explanation: B is correct. ILM formula mechanics: LC = 15 × E[Annual Losses] — the 15x multiplier converts the average loss into a capital-equivalent. The formula ILM = ln(e-1 + (LC/BIC)^0.8) ensures: (1) When LC = BIC: ILM ≈ 1 (neutral — losses match industry average). (2) When LC > BIC: ILM > 1 (high losses → more capital). (3) When LC < BIC: ILM < 1, but the floor of 1 applies (good loss history doesn't reduce capital). (4) The 0.8 power provides sub-linear scaling (doubling losses doesn't double capital). A: ILM minimum is 1. C: the formula is ln-transformed. D: 10-year rolling average.
Question 122
What is the concept of 'risk transfer effectiveness' in operational risk insurance?
Select an option first.
Correct answer: B — The degree to which an insurance programme actually reduces the net financial impact of operational risk events — factors reducing effectiveness: (1) Coverage gaps (exclusions for specific event types); (2) Policy limits (loss exceeds the insured amount); (3) Deductibles (the bank bears the first loss); (4) Insurer default risk (the insurer may not pay); (5) Basis risk (the policy definition doesn't match the actual loss); (6) Claim disputes (insurer contests the claim)
Explanation: B is correct. Insurance effectiveness: a $100M loss covered by a $50M policy with a $5M deductible: effective transfer = $45M (policy limit minus deductible). If the insurer disputes the claim: effective transfer = $0 during litigation. Coverage gaps: cyber insurance may exclude nation-state attacks — if the attack is attributed to a state actor, the bank bears the full loss. Under AMA, Basel allowed up to 20% capital reduction for recognised insurance — effectiveness criteria were strict to prevent illusory transfer. Under Basel IV SA: insurance doesn't reduce capital directly but remains a risk management tool. A: partial transfer at best. C: effectiveness varies by event. D: remains important regardless of capital approach.
Question 123
What are 'risk indicators' vs 'loss indicators' in operational risk monitoring?
Select an option first.
Correct answer: B — Risk indicators (KRIs): forward-looking metrics predicting potential future losses — e.g., error rates, staff turnover, exception volumes, system availability. Loss indicators: backward-looking metrics measuring actual losses that have occurred — e.g., total annual losses, frequency of events above threshold, average loss per event. Both are needed: risk indicators provide early warning; loss indicators confirm whether risk materialised
Explanation: B is correct. Risk vs loss indicators: forward-looking (KRIs) — allow proactive management before losses occur. Example: rising transaction error rate (KRI) → management improves training before losses spike. Backward-looking (loss indicators) — confirm risk management effectiveness (or failure). Example: after implementing a new control, do loss events in that category decline? Both together: a bank with good KRIs but rising losses has a control effectiveness problem (KRIs not catching the risks that actually materialise). A bank with poor KRIs but no losses is potentially lucky. A: different purposes and timing. C and D: both are valuable for different reasons.
Question 124
What is 'operational risk stress capital' vs 'base case capital'?
Select an option first.
Correct answer: B — Base case capital: the regulatory or economic capital estimate under normal assumptions (standard confidence level, average loss environment). Stress capital: the capital estimate under an adverse scenario — higher loss frequency, larger loss severity, or specific extreme events materialising. The difference = the capital buffer needed for stress conditions. ICAAP: banks must demonstrate they have sufficient capital to survive stress OpRisk scenarios, not just base case
Explanation: B is correct. Stress vs base case: base case (Pillar 1 SA): BIC × ILM = standardised regulatory minimum. Economic capital stress: what if the bank experiences a 1-in-200-year combination of high-frequency and high-severity events? The stress capital may exceed Pillar 1. ICAAP: the gap between Pillar 1 and stress capital informs the Pillar 2 buffer. For DFAST/EBA stress tests: banks model OpRisk losses under macro stress scenarios (recession → more fraud, more litigation, more regulatory scrutiny). A: the ratio varies. C: both use different model inputs. D: stress capital applies to all risk types.
Question 125
What is 'risk interdependency' in operational risk capital modelling?
Select an option first.
Correct answer: B — The recognition that risks in different cells or categories may not be fully independent — for example, weak access controls (people/technology risk) creates exposure to both internal fraud and cyber attack risk simultaneously. Capturing interdependencies: (1) Correlation matrices (linear dependence); (2) Copulas (including non-linear tail dependence); (3) Causal models (explicitly modelling shared risk drivers). Ignoring interdependencies leads to either over- or under-stating total capital
Explanation: B is correct. Interdependency effects: positive correlation between risk cells (common in OpRisk): risks tend to materialise together (cyber attack simultaneously causes technology failure and external fraud). Negative correlation: rare in OpRisk (hard to see how a fire would prevent fraud). Under correlation assumptions: capital increases above the square-root-of-sum-of-squares (independence). Practical approach: estimate correlation from historical co-occurrence of losses in different cells, supplement with expert judgment. Tail dependence: standard correlation underestimates joint tail events — copulas address this. A: not perfect correlation. C: not zero correlation. D: applies to all risk types.
Get the full FRM question bank — free
Drop your email and we'll send you fresh FRM practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 126
What is 'maximum likelihood estimation' (MLE) and how is it used to fit distributions to operational loss data?
Select an option first.
Correct answer: B — A statistical method that finds the parameter values that make the observed data most likely — maximises the likelihood function L(θ|data) = Π f(xᵢ|θ) with respect to the parameters θ. For a lognormal distribution: MLE yields estimates of μ and σ that best fit the observed losses. For truncated data: modified MLE conditions the likelihood on the loss exceeding the capture threshold
Explanation: B is correct. MLE for OpRisk: example — fitting Pareto to 50 losses above threshold u: L(α, xₘ | data) = Πᵢ (α/xₘ) × (xₘ/xᵢ)^(α+1). Maximising L (or equivalently its log) with respect to α gives the MLE estimate of the shape parameter. Truncation correction: conditional MLE — the likelihood is divided by P(X > u | θ) to account for the fact that only exceedances are observed. Software: scipy.stats (Python), fitdistrplus (R), or specialised actuarial packages. Standard errors: the inverse Fisher information matrix gives standard errors for the parameter estimates. A: MLE is not the mean. C: median estimation (method of moments). D: MLE is a statistical technique, not a regulatory formula.
Question 127
What is 'the Poisson assumption test' and how is it applied to operational loss data?
Select an option first.
Correct answer: B — Verifying that the frequency of operational loss events is consistent with the Poisson distribution assumption — tests: (1) Dispersion test: compare sample variance to sample mean (for Poisson, they should be equal). If variance >> mean (overdispersion), Negative Binomial may be more appropriate. (2) Chi-square goodness of fit: compare observed vs expected event counts under Poisson. (3) Plot of inter-arrival times: should follow exponential distribution if Poisson holds
Explanation: B is correct. Testing Poisson: data: annual loss event counts over 10 years — say [8, 12, 5, 15, 7, 11, 9, 14, 6, 13]. Mean = 10, variance = 11.2. Dispersion statistic = variance/mean = 1.12. For Poisson (exact): this ratio should be 1. Value of 1.12 is slightly > 1 but may not be statistically significant with only 10 observations. Chi-square test: with 10 years of data and small sample, formal tests have low power — borderline overdispersion is common. Decision: if variance/mean > 1.5, consider Negative Binomial. A: testing is required. C: testing is appropriate at the level of each risk cell. D: test all risk cells.
Question 128
What is 'loss data maturity' and how does it evolve over time?
Select an option first.
Correct answer: B — The degree to which a bank's internal loss database has developed into a reliable, comprehensive, and statistically useful resource — maturity stages: (1) Early stage (0-3 years): incomplete data, high truncation, limited usefulness for LDA. (2) Developing (3-7 years): sufficient for body estimation, sparse tail. (3) Mature (8+ years): adequate for LDA with external data supplement. (4) Advanced: rich enough for standalone LDA with credible tail estimates. Capital models should reflect data maturity in their complexity and external data reliance
Explanation: B is correct. Maturity evolution: early-stage banks should: use simpler models (BIA/SA), rely heavily on external data, use conservative scenario estimates for the tail, and invest in data capture quality. As data matures: increase model sophistication gradually, reduce external data reliance, validate against expanding internal history. Regulatory expectation: model complexity should match data availability — a bank with 2 years of data using a full LDA is over-fitting. A: maturity reflects database quality and quantity. C: loss trends and maturity are independent concepts. D: maturity is relevant for any LDA-based capital model.
Question 129
What is 'outlier treatment' in operational risk severity modelling?
Select an option first.
Correct answer: B — The approach to handling extreme loss observations that may disproportionately influence distribution parameter estimates — options: (1) Include all observations (purist approach — extreme events should be in the data); (2) Winsorisation (replace values above a threshold with the threshold value — reduces influence of extremes); (3) Separate modelling (model extreme tail separately using EVT, body separately). The choice affects both parameter estimates and capital
Explanation: B is correct. Outlier treatment: including all observations: preserves information but allows a single $5B loss to completely dominate parameter estimates. Winsorisation: artificially caps large losses — can understate capital if the extreme event could recur. Separate modelling (spliced distribution): best practice — allows the body distribution to be fitted well, while EVT handles the tail independently. External validation: compare outlier treatment results against scenario analysis and external loss benchmarks to ensure the tail isn't being artificially suppressed. A is arbitrary threshold. C: large events contain important information. D: $1M is not universally the outlier threshold.
Question 130
What is 'economic loss' vs 'accounting loss' in operational risk data?
Select an option first.
Correct answer: B — Economic loss: the full economic impact of an operational event including: direct financial costs, indirect costs (remediation, extra staff), opportunity costs (business foregone), and long-term revenue impacts. Accounting loss: the amount recognised in the financial statements according to accounting standards (IFRS/GAAP) — typically only direct quantifiable costs, recorded in the period they are recognised (which may be later than the economic impact). The LDA should ideally use economic losses, but in practice uses accounting/financial losses due to measurability
Explanation: B is correct. Economic vs accounting loss: a conduct mis-selling event: economic loss = PV of all future remediation costs + revenue loss from customer attrition + management distraction + regulatory costs. Accounting loss: only the provisions recognised in the financial accounts (may be spread over years as litigation progresses). LDA practical choice: uses accounting losses (measurable, reconcilable to P&L) despite their limitations. Economic loss rationale: for ICAAP scenarios, economic loss provides a more complete picture of the true cost of an event. Multiplier analysis bridges the gap: multiply accounting loss estimates by a factor reflecting total economic impact. A: they can diverge significantly. C: accounting losses may exceed economic losses if provisions overstate. D: economic loss matters for capital planning.
Question 131
What is the 'Business Indicator Component' (BIC) bucket structure under Basel IV?
Select an option first.
Correct answer: B — The BI is divided into three size buckets with increasing multipliers: Bucket 1 (BI ≤ €1B): BIC = 12% × BI. Bucket 2 (€1B < BI ≤ €30B): BIC = €120M + 15% × (BI − €1B). Bucket 3 (BI > €30B): BIC = €4,470M + 18% × (BI − €30B). Larger banks face higher marginal multipliers reflecting that very large banks have disproportionately large operational losses relative to their size
Explanation: B is correct. Bucket structure rationale: empirical evidence from the BCBS DCE showed that larger banks have disproportionately larger losses relative to BI — the BIC's progressive structure reflects this. Example: Bank A (BI = €500M): BIC = 0.12 × 500 = €60M. Bank B (BI = €5B): BIC = €120M + 0.15 × (5,000 − 1,000) = €120M + €600M = €720M. The ILM then adjusts for actual loss history. A: three buckets with different rates. C: the old BIA used 15%; Basel IV uses 12-18% progressively. D: applies to all banks regardless of business model.
Question 132
What is 'loss categorisation' challenge for ambiguous events and what is the primary classification rule?
Select an option first.
Correct answer: B — When an operational loss event has characteristics of multiple Basel event categories, banks should apply the primary classification rule: classify the event under the category that best represents the primary driver or cause of the loss — not just the immediate trigger. Documented rationale must be maintained. Example: a system failure that enables an external fraud is classified as External Fraud (the fraud is the primary driver and loss source) with a secondary note on the enabling system failure
Explanation: B is correct. Primary classification examples: rogue trader: classified as Internal Fraud (deliberate concealment by employee) — the back-office control failures that enabled it are secondary. IT vendor breach causing data loss: classify as External Fraud (third party action causing loss) rather than Technology/System Failure (the technology failure was the vector, not the primary driver). Regulatory fine for mis-selling: Clients/Products/Business Practices (the business practice was the primary cause). Consistency: all business units should apply the primary classification rule consistently — monitored by the second line. A: unwarranted default. C: not feasible for every scenario. D: technology may be secondary to the primary driver.
Question 133
What is 'diversification benefit' in operational risk capital and how is it quantified?
Select an option first.
Correct answer: B — The reduction in total operational risk capital relative to the sum of standalone capital estimates for individual risk cells — arises because different risk cells are not perfectly correlated. Quantified as: Diversification Benefit = Σ Capital_i − Total Portfolio Capital. Under independence: benefit = Σ Capital_i − √(Σ Capital_i²). Under partial correlation: benefit is intermediate. Typical industry estimates: 15-30% diversification benefit when aggregating across business lines and event types using empirical correlations
Explanation: B is correct. Diversification quantification: example — three risk cells with standalone capitals: $100M, $150M, $200M. Sum = $450M. Under independence (ρ=0): portfolio capital = √(100²+150²+200²) = √67,500 ≈ $260M. Diversification benefit = $450M − $260M = $190M (42%). With ρ=0.5 correlation: intermediate result ≈ $350M → benefit = $100M (22%). Regulatory treatment: under Basel IV SA, no explicit diversification is allowed in the formula (BIC × ILM sums the BI). In ICAAP economic capital: diversification benefit is recognised with appropriate correlation assumptions. A: diversification exists for non-perfectly-correlated risks. C: capital is a single portfolio calculation. D: ICAAP allows diversification recognition.
Question 134
What is 'integrated risk management' (IRM) and why is it superior to siloed risk management?
Select an option first.
Correct answer: B — An enterprise-wide approach that manages all risk types (operational, market, credit, liquidity) within a single coherent framework — superior to siloed management because: it captures correlations between risk types, prevents risk transfer within the organisation, provides a holistic view of the risk-return profile, and supports better resource allocation and capital efficiency
Explanation: B is correct. IRM benefits: correlation capture — a cyber attack may simultaneously cause operational losses AND market losses (system failure affecting pricing) AND reputation losses. Siloed management misses these interactions. Common risk language — all risks assessed consistently. Aggregation — total firm risk picture. Resource allocation — identify where additional risk investment is most valuable. Limitation: measuring diverse risk types on a single scale (e.g., VaR for both market and operational risk) is challenging. A is too narrow. C is portfolio aggregation, not IRM. D is a physical arrangement.
Question 135
What is 'COSO ERM' (Committee of Sponsoring Organisations Enterprise Risk Management) framework?
Select an option first.
Correct answer: B — A widely used, principles-based framework for enterprise risk management across all industries — structured around five components: governance and culture, strategy and objective setting, performance (risk identification, assessment, response), review and revision, and information/communication/reporting. Updated in 2017 to emphasise integration with strategy
Explanation: B is correct. COSO ERM 2017: components — (1) Governance and Culture: leadership, risk culture; (2) Strategy and Objectives: business context, risk appetite; (3) Performance: identify/assess/prioritise/respond to risk; (4) Review and Revision: evaluate changes; (5) Information/Communication/Reporting: technology, data, reporting. It is a voluntary framework for all types of organisations (not bank-specific). Basel frameworks apply to banks specifically. A: COSO applies broadly, not just banks. C: voluntary, not mandatory. D: Basel is bank-specific.
Question 136
What is the 'risk management framework' (RMF) at an organisational level and what components does it contain?
Select an option first.
Correct answer: B — The comprehensive set of policies, processes, systems, and people that identify, assess, monitor, and manage risks across an organisation — components typically include: risk governance structure, risk appetite statement, risk identification processes (RCSA), risk measurement and modelling, risk reporting and escalation, control framework, and risk culture
Explanation: B is correct. RMF: the organisational architecture for risk management. A robust framework includes: Governance — board/committee structure, mandates, reporting lines. Policy — risk appetite statement, operational risk policy. Processes — RCSA, KRI monitoring, loss event capture, scenario analysis. Systems — risk management information system (RMIS), loss database. People — roles and responsibilities across three lines. Culture — training, tone from the top. A is a loss register. C is a regulatory map. D is a system.
Question 137
What is the 'risk appetite statement' (RAS) for operational risk and what should it contain?
Select an option first.
Correct answer: B — A formal board-approved document that articulates the types and levels of operational risk the organisation is willing to accept — should contain: qualitative principles (e.g., 'we do not tolerate deliberate violations of law or regulation'), quantitative thresholds (e.g., maximum annual operational loss as % of revenue), zero-tolerance areas (internal fraud, regulatory breaches), and KRI thresholds linked to risk appetite levels
Explanation: B is correct. OpRisk RAS components: qualitative statements express values (zero tolerance for fraud, unethical conduct). Quantitative limits express acceptable loss levels. Zero-tolerance areas are typically: internal fraud, financial crime, deliberate regulatory breaches, and major health and safety violations. Risk indicators (amber/red) linked to appetite allow management to take action before limits are breached. The RAS connects strategy and risk management. A is a risk register. C is a regulatory return. D is a strategic objective.
Question 138
What is 'Pillar 2' of Basel and how does it apply to operational risk?
Select an option first.
Correct answer: B — A framework requiring banks to conduct their own capital adequacy assessment (ICAAP) covering all material risks — for operational risk specifically: banks must assess whether Pillar 1 capital adequately covers their operational risk profile, consider risks not captured in the standardised approach (e.g., unique operational risks from complex products), and supervisors (SREP) can impose Pillar 2 add-ons if Pillar 1 is considered insufficient
Explanation: B is correct. Pillar 2 for OpRisk: the ICAAP must include: assessment of all material operational risks, adequacy of the capital held relative to the operational risk profile, quality of the risk management framework, and stress scenarios for major operational loss events. Supervisors review the ICAAP and may set a Pillar 2 Requirement (P2R) for operational risk if: the bank operates in high-risk business lines, has a poor compliance record, or has inadequate operational risk management. A is Pillar 1. C is Pillar 3. D is too narrow.
Question 139
What is 'Pillar 3' disclosure in relation to operational risk and what information is disclosed?
Select an option first.
Correct answer: B — Public disclosure requirements under Basel III that require banks to disclose information enabling market participants to assess their operational risk profile — disclosures include: the approach used for capital calculation (BIA, SA, or AMA/new SA), qualitative description of the risk management framework, quantitative capital figures by approach, and information about material operational loss events
Explanation: B is correct. Pillar 3 OpRisk disclosures (EBA Implementing Technical Standards): qualitative — framework description, risk appetite, governance, processes. Quantitative — operational risk capital by approach, RWA for operational risk, and (under AMA) description of internal models. Material losses: large individual losses (above specified thresholds) disclosed by event type. These disclosures allow investors and counterparties to assess relative operational risk profiles across banks. A is financial reporting. C is internal reporting. D is regulatory reporting (not public).
Question 140
What is the 'ICAAP' (Internal Capital Adequacy Assessment Process) with respect to operational risk?
Select an option first.
Correct answer: B — A bank's own assessment of its capital adequacy covering all material risks — for operational risk: the bank assesses whether Pillar 1 capital (from the Basel SA) is sufficient, identifies any residual risks not captured (e.g., conduct risk pipeline, pending large litigations), considers the quality of the OpRisk management framework, and stress-tests operational losses under severe scenarios. Submitted to the supervisor as part of SREP
Explanation: B is correct. ICAAP (Pillar 2): the bank's own forward-looking capital adequacy assessment. OpRisk components: (1) Pillar 1 calculation (baseline); (2) Assessment of whether Pillar 1 is adequate given the bank's specific risk profile; (3) Stress scenarios (e.g., major cyber attack, large conduct fine — what additional capital would be needed?); (4) Quality of the ORMF (good framework = less additional capital needed). A is Pillar 1. C is loss reporting. D is the SREP.
Question 141
What is 'risk-based supervision' and how do regulators assess operational risk management quality?
Select an option first.
Correct answer: B — A regulatory approach that allocates supervisory intensity proportional to the risk a firm poses — for operational risk: supervisors assess: adequacy of the governance structure, quality of the ORMF (RCSA, KRIs, loss data, scenario analysis), capital model adequacy, compliance track record, culture and incentives. High-risk firms receive more intensive supervision (more frequent inspections, more data requests, Pillar 2 add-ons)
Explanation: B is correct. Risk-based supervision (RBS): supervisors prioritise resources based on: systemic importance, complexity, risk profile, and management quality. SREP assessment criteria for OpRisk: framework maturity, historical loss profile (heavy losses relative to peers), audit findings, compliance breaches, culture indicators. Outcome: SREP letter specifying P2R (binding) and P2G (guidance) operational risk capital add-ons. A: capital adequacy is assessed within RBS but is not the whole approach. C is ICAAP. D is a rules-based approach.
Question 142
What is 'regulatory capital for operational risk' under the Basel IV standardised approach and how is it calculated for a simple case?
Select an option first.
Correct answer: B — Capital is calculated using the Business Indicator Component (BIC) × Internal Loss Multiplier (ILM). For bucket 1 banks (BI < €1B): BIC = 0.12 × BI and ILM = 1, so capital = 12% × BI. For larger banks: higher BI buckets apply higher multipliers (up to 18%) and the ILM adjusts based on 10 years of actual loss history — making capital sensitive to the bank's own operational risk experience
Explanation: B is correct. Basel IV SA capital example: Bank with BI = €500M (Bucket 1): BIC = 0.12 × 500 = €60M. ILM = 1 (small bank, no loss adjustment). OpRisk capital = €60M. For a BI = €5B bank (Bucket 2): BIC = 0.15 × 5,000 = €750M. If the bank has higher-than-average losses: ILM > 1 → capital > €750M. The formula ensures that the Basel IV SA is both BI-sensitive and partially loss-sensitive for larger banks. A is the BIA. C is a loss reserve approach. D is AMA.
Question 143
What is 'concentration risk' in operational risk capital modelling?
Select an option first.
Correct answer: B — The risk that the capital model underestimates risk because the loss distribution is dominated by a small number of very large, idiosyncratic loss events — rather than a large number of smaller, more predictable losses. Concentration is particularly severe in operational risk (vs credit/market risk) because OpRisk tail is driven by unique large events, not portfolio diversification
Explanation: B is correct. Concentration in OpRisk: unlike credit risk (diversified loan portfolio), a bank's operational risk might be dominated by 2-3 catastrophic scenarios. Standard LDA models may underestimate this if the loss history doesn't include any catastrophic events. Scenario analysis is critical to address tail concentration. Capital models should test: what if we have two simultaneous major OpRisk events? Copula models can capture tail dependence (joint extreme events). A is category concentration. C and D are wrong.
Question 144
What is 'reputational risk' in the context of operational risk and how is it different from a distinct risk category?
Select an option first.
Correct answer: B — Under the Basel definition, reputational risk is explicitly excluded from the definition of operational risk — it is treated as a separate risk category. However, major operational risk events (fraud, mis-selling, cyber breach, regulatory fine) often trigger secondary reputational consequences that may exceed the direct financial loss, creating a 'risk amplification' dynamic
Explanation: B is correct. Reputational risk and OpRisk: Basel excludes reputational risk from the OpRisk definition, but in practice they are closely linked. A $100M fine from mis-selling may generate $500M in customer attrition and business lost — the indirect reputational consequence dwarfs the direct fine. Banks manage reputational risk through: crisis communications plans, ethics programmes, corporate social responsibility, and rapid escalation of emerging issues. A: Basel specifically excludes it. C: it is excluded from the Basel OpRisk definition. D is too narrow.
Question 145
What is 'strategic risk' and how does it differ from operational risk?
Select an option first.
Correct answer: B — Strategic risk is the risk that a firm's business strategy or strategic decisions lead to poor financial outcomes — caused by: poor strategy, failure to respond to market changes, or poor execution of strategy. Explicitly excluded from the Basel definition of operational risk. Examples: a bank that fails to invest in digital banking loses market share (strategy risk); a bank that acquisitions poorly and destroys value (execution of strategy). Operational risk is execution failure within the current strategy
Explanation: B is correct. Strategic vs operational risk: strategic = choosing the wrong direction. Operational = executing the right direction poorly. Basel specifically excludes strategic risk from OpRisk definition because: it is harder to model, more qualitative, and driven by business judgment rather than process failures. Strategic risk is assessed in the ICAAP under Pillar 2. Strategic risk management involves: scenario planning, strategic reviews, board oversight of strategy. A conflates them. C: Basel explicitly excludes strategic risk. D: applies to all organisations.
Question 146
What is 'climate risk' as an operational risk concern for financial institutions?
Select an option first.
Correct answer: B — Climate risk creates operational risk exposures through: physical risk (direct — flooding, fire, extreme weather damaging data centres, offices, and infrastructure) and transition risk (indirect — regulatory changes requiring operational adaptations, stranded assets in outsourced operations, and climate-related regulatory fines). Also: third-party operational disruption (suppliers affected by climate events)
Explanation: B is correct. Climate risk and OpRisk: physical risk — a bank's data centre in a flood-prone area faces operational disruption from extreme weather events. Extreme heat events can disrupt operations and reduce staff productivity. Supply chain disruptions from climate events affect vendors. Transition risk — new environmental regulations (e.g., carbon pricing, TCFD reporting requirements) require operational changes and can result in compliance fines if not met. A: all banks face climate-related OpRisk. C: climate risk is also an immediate operational concern. D: climate risk is being integrated into OpRisk frameworks.
Question 147
What is 'technology risk' as a category within operational risk?
Select an option first.
Correct answer: B — The risk of operational failures, disruptions, or security breaches arising from the failure, inadequacy, or malicious exploitation of technology systems — encompasses: system failures (downtime, crashes), cyber risk (attacks, data breaches), data integrity failures, technology change risk (failed implementations), and technology obsolescence
Explanation: B is correct. Technology risk: increasingly significant as financial institutions become more dependent on IT. Key sub-categories: system availability (the bank's core system goes down — customers can't access accounts); data integrity (corrupted or inaccurate data drives wrong decisions); cyber (attacks on IT systems); change risk (a badly executed IT upgrade causes system failures — Knight Capital 2012 lost $440M in 45 minutes from a software error). A is technology stock exposure. C: technology risk is within OpRisk. D: applies to all financial institutions.
Question 148
What is 'outsourcing risk' and how has it changed with cloud computing?
Select an option first.
Correct answer: B — The risk that services provided by third parties on behalf of the bank fail to meet required standards or experience disruptions — cloud computing amplifies outsourcing risk because: banks rely on a small number of hyperscale providers (AWS, Azure, GCP) for critical services, the technology complexity makes due diligence harder, data sovereignty concerns (data stored in foreign jurisdictions), and concentration risk (multiple banks on same infrastructure)
Explanation: B is correct. Cloud outsourcing risk: traditional outsourcing: single vendor, bilateral contract, relatively easy to monitor. Cloud: multi-tenant environment, rapid technology change, complex contractual terms, and massive concentration. Regulatory responses: EBA Cloud Outsourcing Guidelines, DORA (EU), PRA/FCA SS2/21 (UK) — all require: pre-contract due diligence, contractual protections (audit rights, exit provisions), ongoing monitoring, and concentration risk assessment. A is a procurement issue. C: even cloud call centres create risk. D: the bank remains accountable.
Question 149
What is 'financial crime risk' within operational risk and what are its main forms?
Select an option first.
Correct answer: B — Operational risk events arising from criminal exploitation of financial systems — main forms: money laundering (disguising criminal proceeds), terrorist financing, fraud (external and internal), bribery and corruption, market abuse (insider trading, market manipulation), cybercrime, tax evasion facilitation, and sanctions violations
Explanation: B is correct. Financial crime risk (FC): encompasses a wide range of criminal exploitation. AML: money laundering and terrorist financing prevention (FATF, EU AML Directives). Fraud: preventing both internal (employee) and external (customer/third party) fraud. Sanctions: OFAC (US), OFSI (UK), EU sanctions lists — transacting with sanctioned entities triggers massive fines. Bribery: FCPA (US), UK Bribery Act. Market abuse: MAR (EU Market Abuse Regulation). Banks invest heavily in FC risk management: transaction monitoring, KYC, sanctions screening, insider dealing controls. A is market manipulation (a subset). C is credit risk. D: all banks face FC risk regardless of jurisdiction.
Question 150
What is 'fraud risk management' and the key preventive and detective controls?
Select an option first.
Correct answer: B — A comprehensive approach to preventing, detecting, and responding to fraudulent acts — preventive controls: segregation of duties, authorisation limits, access controls, whistleblowing hotlines, fraud risk assessments. Detective controls: transaction monitoring systems (identify unusual patterns), reconciliations, internal audit, management accounts review, and data analytics (identify statistical anomalies). Responsive controls: incident response, law enforcement referral, recovery procedures
Explanation: B is correct. Fraud risk management framework: prevention (making fraud harder — SoD, access controls, background checks, culture of integrity). Detection (identifying fraud quickly — automated monitoring, analytics, anomaly detection). Response (minimise loss — freeze accounts, isolate systems, recover funds, report to authorities). Investigation (forensic accounting, digital forensics). Key metric: detection time — earlier detection = lower losses. A is the legal/recovery phase only. C is insurance (a mitigation, not management). D is communications.
More free FRM topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.