You’re on a roll
Create a free account to save your FRM progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › FRM › Operational Risk and Resilience
Free FRM Operational Risk and Resilience Practice Questions & Answers
400 exam-style Operational Risk and Resilience questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 181
What is the 'accountability regime' in UK banking regulation (SMCR) and how does it relate to operational risk governance?
Select an option first.
Correct answer: B — The Senior Managers and Certification Regime (SMCR): a regulatory framework that clearly assigns individual accountability for specific decisions and areas of a bank to named Senior Managers — if things go wrong in their area, the Senior Manager may face personal regulatory action. Drives: clear accountability for operational risk management, stronger risk culture (personal liability concentrates minds), and better escalation practices
Explanation: B is correct. SMCR (UK, effective 2016 for banks, extended to all FCA firms 2019): Senior Managers: each has a Statement of Responsibilities (what they're accountable for). If a controlled function goes wrong, the Senior Manager must demonstrate they took reasonable steps to prevent it. Certification regime: firms must annually certify that employees in key roles are 'fit and proper.' Conduct rules: behaviour standards applying to all employees. Impact on OpRisk: explicit accountability for risk management. Similar regimes: BEAR (Australia), IBF (Singapore). A is a penalty system. C: SMCR is a regulatory requirement, not voluntary.
Question 182
What is 'operational risk appetite metrics' and how are they cascaded through an organisation?
Select an option first.
Correct answer: B — Quantitative and qualitative measures expressing acceptable levels of operational risk — cascaded: board sets top-level appetite → divisional heads set divisional limits aligned with board appetite → business unit managers set unit-level KRI thresholds and control standards → front-line staff understand behavioural expectations. Cascading ensures alignment between strategic tolerance and day-to-day risk management
Explanation: B is correct. OpRisk appetite cascade: top-level: 'Annual operational losses will not exceed 5% of revenue.' Divisional: 'Technology-related losses will not exceed 2% of divisional revenue.' BU-level: 'Transaction error rate will remain below 0.01%.' Individual KRI thresholds: 'System availability must exceed 99.95%.' Cascading ensures the strategic appetite (set by the board) is translated into operational boundaries that individuals can understand and act upon. A is a loss event count. C is a single metric (insufficient for cascade). D: risk appetite is set internally.
Question 183
What is 'tail risk management' for operational risk and what strategies are used?
Select an option first.
Correct answer: B — Specific strategies targeting the extreme tail of the operational loss distribution — strategies: (1) Insurance (transfer specific tail risks to insurers); (2) Capital (hold sufficient capital at 99.9th percentile); (3) Scenario-based risk assessment (identify and plan for specific tail scenarios); (4) Operational resilience (ensure critical services survive tail events); (5) Limit management (prevent any single event from exceeding a catastrophic threshold through position limits, authorisation limits)
Explanation: B is correct. Tail risk strategies: the tail events (rogue trading, major cyber attack, large regulatory fine) are unlikely but potentially existential. Managing them requires different approaches than managing expected losses — scenario analysis (what would we do if...?), insurance (transfer specific tail events), pre-defined response protocols (incident response plans), and capital buffers (absorb losses that do occur). Limiting single-event exposure: individual authorisation limits prevent any one employee or transaction from causing a catastrophic loss. A ignores the tail. C is inappropriate modelling. D is not a standard banking practice.
Question 184
What is 'emerging risk identification' in operational risk management and what techniques are used?
Select an option first.
Correct answer: B — The proactive identification of novel or growing risks that are not yet reflected in historical loss data — techniques: environmental scanning (regulatory, technology, social, and competitive horizon scanning), threat intelligence (cyber threats emerging in the industry), change risk assessment (risks from planned business or technology changes), industry loss data review (what new types of losses are occurring at peers), and expert workshops
Explanation: B is correct. Emerging risk identification: examples of recent emerging risks — (1) Generative AI risk (2023+): models producing incorrect output, IP issues, regulatory uncertainty; (2) Quantum computing threat to encryption (future): current encryption standards vulnerable to quantum attacks; (3) CBDC risk (future): central bank digital currencies disrupting banking model. Techniques: cross-functional emerging risk committee, regulatory watching briefs, industry group participation (e.g., ISDA, BBA). A is a risk reporting step. C: relevant at all sizes. D is a review of past events.
Question 185
What is 'cyber resilience' and how does it differ from cybersecurity?
Select an option first.
Correct answer: B — Cybersecurity focuses on preventing cyberattacks from succeeding. Cyber resilience accepts that attacks will sometimes succeed and focuses on the ability to continue operating and recover rapidly despite successful attacks — combining cybersecurity (prevention), incident response (response), business continuity (recovery), and learning (improvement). The NIST Cybersecurity Framework and DORA embed this broader resilience view
Explanation: B is correct. Prevention vs resilience: assume breach. Cybersecurity: firewalls, antivirus, encryption, MFA — prevent attacks. Cyber resilience: even if an attacker gets in (and they will eventually), the organisation can detect quickly, contain rapidly, and recover operations within defined timelines. Impact tolerances for cyber events (DORA): defines maximum acceptable downtime for each critical service following a cyber incident. A: resilience is broader than security. C: they are distinct. D: applies to all IT systems.
Get the full FRM question bank — free
Drop your email and we'll send you fresh FRM practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 186
What is 'regtech' and how is it applied to operational risk management?
Select an option first.
Correct answer: B — The application of technology to help financial institutions comply with regulatory requirements more efficiently — applications in operational risk: automated regulatory reporting (COREP, FINREP, DORA incident reporting), AI-powered transaction monitoring for AML (reducing false positives), machine learning for RCSA support (identifying patterns in loss data), natural language processing (regulatory change tracking), and automated control testing
Explanation: B is correct. Regtech applications in OpRisk: (1) Automated regulatory reporting: XBRL-tagged COREP/FINREP submissions. (2) AI-powered AML: ML models outperform rule-based systems in detecting complex layering patterns with lower false positive rates. (3) RegChange management: NLP tools scan regulatory publications and identify relevant changes for assessment. (4) Risk aggregation: automated data pipelines for BCBS 239 compliance. Benefits: lower compliance costs, faster regulatory response, higher quality data. A is the opposite of regulatory compliance. C: used by both regulators (suptech) and institutions (regtech). D: voluntary adoption, not mandatory.
Question 187
What is 'digital operational resilience' regulation in the EU and what does it require?
Select an option first.
Correct answer: B — DORA (Digital Operational Resilience Act, Regulation 2022/2554, effective January 2025) requires EU financial entities to: (1) Implement ICT risk management frameworks; (2) Report major ICT incidents to competent authorities; (3) Conduct digital operational resilience testing (including TLPT); (4) Manage ICT third-party risk; and (5) Share information about cyber threats with other financial institutions. Applies to banks, investment firms, insurance companies, CCPs, and critical ICT third-party providers
Explanation: B is correct. DORA details: applicable to ~22,000 financial entities in the EU. ICT risk management framework: must address all phases — identification, protection, detection, response, recovery. Incident reporting: initial notification within 4 hours of major incident classification, intermediate report within 72 hours, final report within 1 month. TLPT: threat-led penetration testing every 3 years for significant entities. Critical ICTSP oversight: the ESAs (EBA, ESMA, EIOPA) oversee the most critical ICT third-party providers (e.g., major cloud providers). A defines digital transformation. C: not voluntary. D: applies broadly.
Question 188
What is 'operational risk in investment management' and what makes it distinct from banking operational risk?
Select an option first.
Correct answer: B — Investment management faces unique operational risks including: trade processing errors (incorrect trade booking, settlement failures), pricing errors (NAV miscalculations for funds), custodian risk (assets held by a third-party custodian), mis-valuation (complex or illiquid asset valuation errors), distribution operational risk (retail fund distribution compliance), and regulatory breach risk (investment mandate breaches). The client-facing nature means errors directly affect investors
Explanation: B is correct. Investment management OpRisk: the investment manager acts as a fiduciary — errors directly harm clients' assets. NAV calculation errors: if a fund NAV is published incorrectly, investors buying or selling at the wrong price may suffer losses (the fund manager faces restitution claims). Mandate breaches: if a fixed income fund accidentally holds equities beyond the mandate limit, this is an OpRisk event with regulatory consequences. Trade processing: securities settlement failures create operational costs and regulatory fines (CSDR in EU imposes cash penalties for settlement failures). A and C are incorrect. D is market risk.
Question 189
What is 'settlement risk' as a type of operational risk and how is it managed?
Select an option first.
Correct answer: B — The risk that a counterparty to a financial transaction fails to deliver securities or cash at the agreed settlement date — specific settlement risk types: free delivery risk (delivering securities before receiving cash), replacement cost risk (cost of replacing a failed trade at current market prices), and liquidity risk from failed settlements. Managed through: central clearing (CCPs), delivery vs payment (DvP) settlement, and settlement netting
Explanation: B is correct. Settlement risk management: DvP (Delivery versus Payment): securities and cash move simultaneously — eliminates free delivery risk. Central clearing (CCPs): the CCP interposes as buyer to every seller, guaranteeing settlement even if a counterparty fails. Netting: bilateral or multilateral netting reduces the gross volume of settlements needed. CSDR (EU): cash penalties for settlement failures encourage timely settlement. Herstatt risk: a bank fails after receiving one currency leg of an FX transaction but before paying the other leg. A is pricing risk. C is market risk. D: relevant in all financial markets.
Question 190
What is 'artificial intelligence' (AI) risk in financial institutions and how is it governed?
Select an option first.
Correct answer: B — Risks arising from the deployment of AI in financial institutions: (1) Model risk (AI models may be biased, overfit, or fail in novel conditions); (2) Explainability risk (AI decisions cannot be explained — 'black box'); (3) Data risk (AI systems trained on poor quality or biased data); (4) Operational dependency risk (over-reliance on AI systems without adequate human oversight); (5) Regulatory risk (AI applications may breach existing regulations without clear guidance)
Explanation: B is correct. AI governance: financial institutions are developing AI governance frameworks covering: model risk management (extend SR 11-7 to AI/ML models), fairness and bias testing (ensure AI credit decisions are non-discriminatory), explainability (XAI — where regulatory decisions are involved, explanations must be available), data governance (training data quality), and human oversight (no fully automated decisions without human override capability). EU AI Act (2024): risk-based regulation of AI, with high-risk AI systems (credit scoring, employment decisions) requiring conformity assessment. A is efficiency risk. C and D are different AI risk concepts.
Question 191
What is 'GenAI risk' (generative AI risk) specifically and how is it managed in financial services?
Select an option first.
Correct answer: B — Risks specific to large language models (LLMs) and other generative AI systems: (1) Hallucination (generating plausible but incorrect outputs); (2) Intellectual property risk (training on copyrighted data, reproducing protected content); (3) Privacy risk (processing sensitive customer data through third-party AI services); (4) Prompt injection (attackers manipulating AI outputs through crafted inputs); (5) Regulatory uncertainty (limited specific guidance on GenAI use)
Explanation: B is correct. GenAI governance: financial institutions managing GenAI risk: (1) Use case inventory — catalogue all GenAI use cases with risk ratings; (2) Human review — for material outputs (customer advice, regulatory documents), require human review; (3) Data governance — prevent sensitive data from being shared with external LLM providers; (4) Testing — test for hallucination rates, bias, and prompt injection susceptibility; (5) Vendor due diligence — assess data handling and model governance of AI vendors. A is a data volume concept. C: chatbot is one use case. D: existing MRM frameworks need significant adaptation for GenAI.
Question 192
What is 'cloud computing risk' and how do banks manage it in line with regulatory expectations?
Select an option first.
Correct answer: B — The operational, security, and resilience risks arising from using cloud infrastructure — key risks: (1) Concentration (dependence on a few providers); (2) Data sovereignty (data stored in jurisdictions subject to foreign laws); (3) Multi-tenancy (sharing infrastructure with other customers); (4) Exit risk (difficulty migrating away from a provider); (5) Compliance (regulatory access to data in the cloud). Managed: due diligence, contractual protections, multi-cloud strategy, and robust cloud governance framework
Explanation: B is correct. Cloud risk management (EBA Cloud Outsourcing Guidelines, PRA/FCA, DORA): due diligence — assess provider's security, resilience, compliance, and financial stability. Contractual protections: right of audit (bank and regulator), incident notification, data portability, and exit plan. Multi-cloud: reduce dependence on any single provider. Data classification: determine which data can and cannot go to the cloud (some regulatory data must remain on-premises in certain jurisdictions). Business continuity: ensure the bank can continue if the cloud provider is unavailable. A is a physical storage concept. C: relevant to all financial institutions using cloud. D: applies to incumbent banks too.
Question 193
What is 'digital identity' risk and how does it affect operational risk in banking?
Select an option first.
Correct answer: B — The risk that digital identity verification systems fail or are compromised — including: identity fraud (using synthetic or stolen identities to open accounts or take out loans), deepfake risk (AI-generated video/audio used to bypass biometric verification), account takeover (credentials compromised), and inadequate identity verification in digital onboarding (allowing money launderers to open accounts remotely)
Explanation: B is correct. Digital identity risks in banking: synthetic identity fraud (combining real and fabricated data) is growing rapidly. Deepfake risk: as biometric verification (facial recognition, voice authentication) becomes standard, AI-generated fakes can bypass these controls. Controls: liveness detection (is this a real person, not a recording?), document verification (are identity documents genuine?), device intelligence (is this a trusted device?), and behavioural biometrics (does the user behave consistently?). A is a specific type of identity fraud. C: applies to all financial institutions. D: requires business and compliance involvement.
Question 194
What is 'loss forecasting' in operational risk management?
Select an option first.
Correct answer: B — Using historical loss data, KRI trends, and risk assessments to forecast expected operational losses for planning and capital purposes — methods: rolling average of recent losses (for budgeting expected losses), regression analysis linking KRIs to loss frequency, and economic cycle modelling (operational losses tend to increase in downturns). Not the same as capital modelling — loss forecasting is for budget and performance management purposes
Explanation: B is correct. Loss forecasting vs capital modelling: capital modelling: tail risk at 99.9th percentile for regulatory capital. Loss forecasting: expected losses for budgeting — how much should we budget for operational losses next year? Methods: simple moving average, exponentially weighted moving average (EWMA) for recent trend capture, and regression on leading indicators (staff turnover KRI correlates with future HR incident losses). Budget planning: expected operational losses should be priced into business lines. A is impossibly precise prediction. C reverses the distinction. D is a regulatory forecast.
Question 195
What is the 'risk-free boundary' concept in operational risk — what risks cannot be eliminated?
Select an option first.
Correct answer: B — A theoretical concept recognising that a non-zero level of operational risk exists in any organisation that conducts business — even with perfect controls: human error rates are non-zero, systems fail with positive probability, and external events (natural disasters, pandemics) cannot be eliminated. The goal is not zero OpRisk but rather an appropriate level consistent with the risk appetite, where controls are cost-effective
Explanation: B is correct. Risk-free boundary: no institution can eliminate all operational risk without also eliminating all business activity. Marginal cost of control: at some point, the cost of further risk reduction exceeds the expected benefit — this defines the cost-optimal residual risk level. This does not apply to ethical violations (zero tolerance for fraud) or regulatory requirements (zero tolerance for AML breaches). The risk appetite defines the acceptable residual risk above the minimum achievable. A is perfection-seeking. C is a capital floor concept. D is a regulatory threshold.
Question 196
What is 'peer benchmarking' in operational risk and how does it support risk management decisions?
Select an option first.
Correct answer: B — Comparing an institution's operational risk profile, losses, and risk management practices against industry peers — using ORX data (anonymised industry loss benchmarks), regulatory comparison (Pillar 3 disclosures), supervisory benchmarking, and industry surveys. Supports decisions: is our loss rate elevated vs peers? (investigate root causes if so), is our RCSA coverage comprehensive? (compare against industry standard), are our capital charges in line? (validate model outputs)
Explanation: B is correct. Peer benchmarking applications: (1) Loss comparison: if the bank's fraud losses are 3x industry average (per BI unit), what controls are inadequate? (2) KRI benchmarking: what are industry-standard KRIs for specific risk categories? (3) Model benchmarking: is the capital estimate in line with peers of similar size and business mix? Limitations: comparability issues (banks are different), confidentiality (detailed benchmarks require data sharing), and survivorship bias (only well-performing firms share data). A is policy copying. C is an internal regulatory disclosure. D is competitive benchmarking.
Question 197
What is 'risk-adjusted performance measurement' for operational risk and how is it used?
Select an option first.
Correct answer: B — Incorporating the cost of operational risk (expected losses and capital cost) into performance measurement of business units — allowing management to assess whether the return on a business activity is sufficient after accounting for its operational risk cost. Business unit RAROC includes: allocated operational risk capital × hurdle rate as a charge against profits
Explanation: B is correct. OpRisk in RAROC: RAROC = (Revenue − EL − Costs − OpRisk Capital × hurdle rate) / (Economic Capital). If a business unit has high operational risk (e.g., complex structured products with significant processing risk), its RAROC is reduced by the OpRisk capital charge. This creates the right incentive: business units that take excessive operational risk see lower risk-adjusted returns. Without OpRisk in RAROC, managers have no financial incentive to reduce it. A is enterprise risk management. C is manager performance. D is regulatory RAROC.
Question 198
What is 'operational risk dashboard' and what should it contain?
Select an option first.
Correct answer: B — A real-time or near-real-time visual display tool aggregating key operational risk metrics for management oversight — should contain: KRI status (green/amber/red with trend), recent loss events (above a threshold), open risk items from RCSA, audit findings status, incident/breach summary, emerging risk flags, and capital utilisation vs appetite. Enables rapid identification of developing risk issues
Explanation: B is correct. OpRisk dashboard design: the dashboard should be: timely (available when needed — daily for trading firms, weekly for most), actionable (shows what requires management attention), transparent (drill-down capability to underlying data), forward-looking (KRIs are leading indicators), and concise (highlight material matters, not everything). Different dashboards for different audiences: daily summary for CRO, board-level quarterly overview. A is a physical control room display. C is a training report. D is regulatory reporting.
Question 199
What is 'geopolitical risk' as an operational risk concern for international banks?
Select an option first.
Correct answer: B — The risk of operational disruptions, financial losses, or regulatory requirements arising from political instability, interstate conflicts, sanctions regimes, and geopolitical fragmentation — impacts on operations: physical damage to offices/data centres, staff safety, network disruptions, sanctions compliance obligations (sudden new sanctions requiring immediate systems changes), and reputational risk from operating in conflict zones
Explanation: B is correct. Geopolitical OpRisk: Russia-Ukraine war (2022): banks with Russian operations faced: sanctions compliance obligations (immediate freezing of assets, systems changes), office closures, staff safety concerns, and reputational risk. GARP 2026 curriculum specifically includes geopolitical risk in Current Issues. Management: scenario planning for geopolitical events, emergency BCP for staff in conflict zones, pre-planned sanctions compliance playbooks, and regular horizon scanning. A is FX risk. C has some credit/market elements but the question specifies OpRisk. D: significant operational consequences.
Question 200
What is 'crypto-asset operational risk' and what specific challenges does it present?
Select an option first.
Correct answer: B — Operational risks specific to dealing with crypto-assets: (1) Custody risk (private key management — losing private keys means losing assets permanently); (2) Smart contract risk (bugs in blockchain code can cause loss of funds); (3) Exchange/counterparty risk (crypto exchanges can fail — FTX 2022: $8B customer funds lost); (4) Wallet management (hot vs cold storage trade-offs); (5) Regulatory uncertainty (changing compliance requirements across jurisdictions)
Explanation: B is correct. Crypto OpRisk specifics: private key management — if private keys to a crypto wallet are lost or stolen, the assets are permanently inaccessible. Cold storage (hardware wallets, not connected to internet): more secure but less accessible. Hot wallets (online): higher risk of theft. Smart contract risk: the DAO hack (2016) exploited a smart contract bug to drain $60M in Ethereum. Exchange risk: FTX (2022) and Mt. Gox (2014) showed that centralised exchanges can fail catastrophically. Basel Committee: specific capital treatment for crypto-assets (1250% risk weight for unbacked crypto). A is a broader set of crypto risks. C is market risk. D: applies to crypto-dealing, not just investment portfolios.
Question 201
What is 'tokenisation' risk in operational risk and how does it interact with financial stability?
Select an option first.
Correct answer: B — The operational, legal, and systemic risks from converting rights to real-world assets (securities, real estate, commodities) into digital tokens on a blockchain — risks include: smart contract vulnerabilities, legal uncertainty (are tokenised assets legally enforceable?), market fragmentation (multiple incompatible blockchain platforms), liquidity risk (tokenised assets may be harder to sell quickly), and operational failures in digital infrastructure maintaining the tokens
Explanation: B is correct. Tokenisation risk (GARP 2026 Current Issues): tokenisation is expanding rapidly — tokenised money market funds, tokenised bonds, and real estate tokens. Operational risks: if the underlying infrastructure fails, access to tokenised assets may be disrupted. Interoperability: assets on different blockchains may not be easily tradable with each other. Legal risk: insolvency of a tokenisation platform — who are the legal owners of the tokenised assets? FSB and BIS are monitoring the growth of tokenisation for financial stability implications. A is authentication. C is DLT-based CBDC risk (related). D: tokenisation extends beyond CBDCs.
Question 202
What is 'model risk management' (MRM) in the context of Basel operational risk capital models?
Select an option first.
Correct answer: B — The governance framework ensuring that the bank's operational risk capital models (LDA models, scenario analysis models) are accurate, appropriately used, and regularly validated — key components: model inventory (all models documented), risk-tiering (material models reviewed more frequently), model development standards (documentation, testing), independent validation, approval process, and ongoing monitoring (backtesting, performance review, user reporting)
Explanation: B is correct. MRM for OpRisk: the Fed's SR 11-7 (2011) and EBA guidelines on internal models establish the framework. For OpRisk LDA: model documentation must include: purpose, inputs, methodology, assumptions, limitations, validation history. Independent validation: by a team separate from the model developers. Model risk rating: high materiality (determines large capital charge) → most intensive oversight. New Basel IV SA: less model risk (no internal models) but risks remain in ILM calculation and internal capital model (ICAAP). A is quantitative talent management. C: regulators do not prescribe specific models.
Question 203
What is 'operational risk in retail banking' and what are the most significant event types?
Select an option first.
Correct answer: B — Retail banking faces significant operational risks including: (1) Fraud risk (payment fraud, identity theft, account takeover — largest category by frequency); (2) Conduct risk (mis-selling, unfair treatment of customers); (3) Technology risk (core banking system outages affecting millions of customers); (4) Regulatory compliance risk (consumer protection, GDPR, AML compliance); (5) Third-party risk (outsourced customer service, payment processing). High frequency and high visibility to customers make retail OpRisk particularly important for reputation
Explanation: B is correct. Retail banking OpRisk: fraud (payment card fraud, online banking fraud, identity theft — very high frequency). Technology outages: a core banking outage affects millions of customers simultaneously — major reputational and regulatory consequence (TSB IT migration disaster 2018 affected 1.9M customers for weeks). Conduct: PPI mis-selling (UK) resulted in £50B+ in industry-wide redress. Consumer Duty (FCA 2023): requires banks to demonstrate good customer outcomes — new conduct compliance challenge. A: retail has very high-frequency fraud. C and D are too narrow.
Question 204
What is 'concentration of operational risk' and what management actions address it?
Select an option first.
Correct answer: B — Having an outsized proportion of total operational risk concentrated in a single: event type (e.g., 70% of total OpRisk capital from technology risk), business unit (e.g., 80% from investment banking), or scenario (e.g., single rogue trader scenario dominates capital). Actions: diversify controls investment (don't over-invest in one area while neglecting others), review scenarios for concentration (are multiple scenarios driven by the same underlying cause?), and balance the RCSA risk map to ensure coverage across risk categories
Explanation: B is correct. Concentration management: if one risk category dominates the capital model, the model should be reviewed: is the estimate realistic? Have all other categories been properly assessed? Control investment: if technology risk dominates, additional investment in IT resilience and cyber controls is justified. Scenario diversification: if multiple scenarios represent the same underlying failure (e.g., all fraud scenarios driven by weak controls), a control improvement addressing the root cause reduces all of them simultaneously. A is portfolio concentration. C is revenue concentration. D is a capital limit.
Question 205
What is 'Basel Committee on Banking Supervision' (BCBS) and how does it influence operational risk regulation?
Select an option first.
Correct answer: B — An international standard-setting body for bank regulation — comprising senior representatives from central banks and bank supervisors from 28 jurisdictions. Produces Basel standards (Basel I, II, III, IV) and supervisory guidance. For operational risk: produced the Basel II framework (introducing OpRisk capital), Basel IV (new SA replacing AMA), BCBS 239 (risk data aggregation), and the Principles for Operational Resilience and Principles for Sound Management of Operational Risk
Explanation: B is correct. BCBS: meets at the BIS (Bank for International Settlements) in Basel, Switzerland. Does NOT directly supervise banks — standards are adopted by national regulators. Key OpRisk outputs: Basel II (2004): introduced operational risk capital requirements for the first time. Basel IV (2023+): replaced AMA with new SA. Principles for Sound Management of Operational Risk (2011): the 10 principles that form the basis of international OpRisk supervisory expectations. BCBS 239: data aggregation and reporting standards. A: BCBS sets standards; NCAs supervise. C: voluntary membership body, not a trade association. D: BCBS guidance is not directly legally binding (it's adopted into national law).
Question 206
What are the 'Principles for Sound Management of Operational Risk' (BCBS 2011) and why are they important?
Select an option first.
Correct answer: B — 11 principles providing guidance on how banks should manage operational risk — covering: board oversight (Principle 1-3: governance), risk management environment (P4-8: culture, risk appetite, RCSA, KRIs, reporting, loss data), business continuity (P9), role of supervisors (P10), and public disclosure (P11). These principles form the basis for supervisors' assessment of a bank's ORMF quality (SREP)
Explanation: B is correct. BCBS sound management principles: Principle 1: board develops a risk culture. Principle 2: senior management implements the framework. Principle 3: board reviews risk framework. Principle 4: risk identification and assessment. Principle 5: monitor and report. Principle 6: control and mitigation. Principle 7: business continuity plans. Principle 8: disclosure (Pillar 3). These are the benchmark against which supervisors assess an OpRisk management framework during SREP and on-site inspections. A: they are guidelines for management, not capital rules. C: apply to the entire bank. D: supervisors actively use these to assess banks.
Question 207
What is 'second-order operational risk' and why does it matter?
Select an option first.
Correct answer: B — Operational risk events that cause secondary or amplified consequences beyond the direct financial loss — a cyber breach ($10M direct loss) may trigger: regulatory investigation ($100M fine), customer attrition ($500M revenue loss over 3 years), class action lawsuit ($200M settlement). The total second-order impact can be many times the initial event cost. Risk management that only measures direct losses understates total exposure
Explanation: B is correct. Second-order effects: operational risk events trigger cascades. Fraud event: direct loss (stolen funds) + reputational loss (customer trust) + regulatory fine + legal costs + remediation costs + management distraction costs. Capital planning must consider potential second-order impacts for major scenarios — especially regulatory fines and reputational losses that follow from conduct risk events. Stress testing: major scenario should include both direct and indirect estimated consequences. A is a category ranking. C is a governance concept. D is temporal compounding.
Question 208
What is 'risk oversight' by the board of directors and what does it involve for operational risk?
Select an option first.
Correct answer: B — The board's responsibility to ensure that adequate risk management frameworks are in place and functioning — for operational risk: approving the risk appetite statement, receiving and challenging regular OpRisk reports, overseeing significant incidents and their remediation, approving the ICAAP (including OpRisk capital assessment), reviewing audit committee reports on OpRisk-related internal audit findings, and ensuring that management has the skills and resources to manage OpRisk effectively
Explanation: B is correct. Board OpRisk oversight: the board doesn't manage risk — management does. The board oversees whether management is managing risk adequately. Risk committee: the board-level risk committee (if separate from the full board) focuses specifically on risk oversight. Typical agenda: CRO report (risk profile, major incidents, capital position), specific deep dives (cyber risk, third-party risk), and consideration of emerging risks. Non-executive directors: should have sufficient risk expertise to challenge management effectively. A: the board approves frameworks and appetites, not individual decisions. C and D are management functions.
Question 209
What is 'inter-risk correlation' between operational risk and other risk types and why does it matter?
Select an option first.
Correct answer: B — Operational risk can be positively correlated with credit risk (e.g., economic downturn → increased mortgage fraud, increased payment errors), market risk (e.g., market crash → operational stress from high transaction volumes), and liquidity risk (e.g., operational failure → bank run). Recognising inter-risk correlations in the ICAAP produces a more accurate total capital assessment than assuming independence
Explanation: B is correct. Inter-risk correlations: credit crises → more defaults → more collections OpRisk events. Market stress → higher trading volumes → more settlement risk. Cyber incident → customer panic → funding pressure. ICAAP aggregation: most banks assume some diversification between risk types (partial correlation < 1) which reduces total ICAAP capital below the sum of individual risk capitals. Stress scenarios: integrated stress tests consider simultaneous adverse moves across risk types (multi-risk scenarios). A: correlations exist and can be significant. C: perfect correlation assumption is very conservative. D: Basel III Pillar 1 treats risk types separately, but ICAAP should consider correlation.
Question 210
What is 'operational risk management reporting' and what should an OpRisk report to senior management contain?
Select an option first.
Correct answer: B — A structured, periodic report providing senior management with the information needed to oversee the firm's operational risk profile — should contain: executive summary (key risk messages), OpRisk profile vs appetite (KRI dashboard, top risks, residual risk trend), loss events summary (significant events, root causes, remediation), control environment update (RCSA changes, audit findings, control testing results), capital position (regulatory and economic capital vs appetite), emerging risks, and management actions required
Explanation: B is correct. OpRisk management reporting: design principles — (1) Materiality: report what matters, not everything. (2) Timeliness: weekly for CRO, monthly for board. (3) Actionability: what decisions are needed? (4) Trend: where is risk moving? (5) Forward-looking: KRIs and emerging risks. (6) Concise: 2-5 pages for senior management. Escalation: events above a threshold should trigger immediate reporting outside the normal cycle. A is an event log. C is a model validation report. D is a regulatory report.
More free FRM topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.