You’re on a roll
Create a free account to save your FRM progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › FRM › Operational Risk and Resilience
Free FRM Operational Risk and Resilience Practice Questions & Answers
400 exam-style Operational Risk and Resilience questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 211
What is the 'operational risk management cycle' and what are its stages?
Select an option first.
Correct answer: B — The continuous cycle of: (1) Identify risks (RCSA, new product reviews, process changes); (2) Assess and measure (LDA, scenario analysis, KRIs); (3) Monitor and report (dashboard, KRI tracking, loss event reporting); (4) Mitigate and control (control improvements, insurance, risk avoidance); (5) Review and update (feedback from incidents, regulatory changes, business changes). Not a one-time activity but a continuous management process
Explanation: B is correct. OpRisk management cycle: analogous to the Plan-Do-Check-Act (PDCA) quality management cycle. The cycle must be embedded in daily operations, not just annual capital exercises. Triggers for restarting the cycle: major loss event (re-assess the risk that failed), new product or service (identify new risks), regulatory change (reassess compliance risk), business growth or contraction (scale of risk changes). Each stage generates outputs that feed the next: RCSA → measurement → monitoring → action → review → updated RCSA. A is capital calculation only. C is regulatory reporting. D: the cycle is continuous, not annual.
Question 212
What is 'new product approval' (NPA) and why is operational risk assessment important in the process?
Select an option first.
Correct answer: B — A structured process for evaluating and approving new products, services, or significant business changes before launch — operational risk assessment in NPA: identifies the operational risks introduced by the new product (new processes, systems, staff training requirements), assesses whether existing controls are adequate or need enhancement, estimates the operational loss exposure from the new activity, and ensures capital is allocated before launch (not after losses occur)
Explanation: B is correct. NPA and OpRisk: examples of OpRisk considerations in NPA: (1) New structured product: requires new booking procedures (system risk), new valuation model (model risk), complex settlement (settlement risk). (2) New digital channel: cyber risk from internet exposure, fraud risk from identity verification gaps. (3) New geography: local regulatory compliance risk, language barriers, different fraud patterns. The NPA ensures: OpRisk is assessed before product launch, control gaps are addressed as a condition of approval, and responsibility is allocated. A: NPA includes but is broader than marketing. C: regulatory approval is sometimes required separately. D: scenario analysis is a different process.
Question 213
What is 'horizon scanning' in operational risk management?
Select an option first.
Correct answer: B — A proactive process of identifying and monitoring emerging risks before they materialise — sources: regulatory publications (consultations, guidance papers), industry working groups (ISDA, BBA, FCA speeches), academic research, news monitoring (AI/ML tools for natural language processing), threat intelligence feeds, and peer-bank near-miss sharing. Output: emerging risk register updated regularly with new or growing risks
Explanation: B is correct. Horizon scanning: most OpRisk frameworks are reactive (historical data) or current (RCSA of known risks). Horizon scanning is explicitly forward-looking: what risks don't yet appear in the loss database but should be on our radar? Recent examples: (1) Generative AI risks (2023): not yet in historical data but significant. (2) Quantum computing threats to encryption (5-10 year horizon): need to start preparing cryptographic defences now. (3) CBDC operational risks: central bank digital currencies will require new operational processes. A is retrospective analysis. C is capital planning. D is regulatory reporting.
Question 214
What is the 'BCBS Principles for Operational Resilience' (2021) and what do they require?
Select an option first.
Correct answer: B — A set of seven principles published by the Basel Committee in 2021 focusing specifically on operational resilience — requiring banks to: identify critical operations (services whose disruption would be most harmful), set impact tolerances, identify and manage the internal and external interdependencies supporting critical operations, test resilience continuously, and recover and learn from incidents. Complementary to the Principles for Sound Management of Operational Risk (2011)
Explanation: B is correct. BCBS Operational Resilience Principles (2021): (1) Governance: board sets resilience strategy and tolerances. (2) Operational risk management: connect resilience to OpRisk framework. (3) BCP: maintain effective BCP. (4) Mapping and testing: map critical operation dependencies, test against impact tolerances. (5) Third-party dependency management: manage third-party operational risks. (6) Incident management: rapid response and communication. (7) Resilient ICT: IT infrastructure supports critical operations within tolerances. These complement the 2011 Sound Management Principles (capital and risk management focused). A: focused on resilience, not capital. C: BCBS applies globally. D: different documents with different focus.
Question 215
What is 'operational risk capital planning' and why must it be forward-looking?
Select an option first.
Correct answer: B — A forward-looking process projecting operational risk capital requirements and buffers over a 3-5 year planning horizon — important because: (1) Business growth changes the BI and capital; (2) Changes in the loss history (large events) affect the ILM; (3) New products and activities introduce new risk; (4) Regulatory changes (e.g., Basel IV implementation) alter capital requirements; (5) Capital must be in place before risk is taken — planning ensures capital is raised or retained in advance
Explanation: B is correct. OpRisk capital planning: part of the wider capital planning process (ICAAP). Inputs: current capital requirement (Pillar 1 SA), planned business changes (how will BI change?), large emerging risks (additional Pillar 2 buffer needed?), stress scenarios (what if a major OpRisk event occurs this year?). Output: projected minimum capital requirement by year, capital buffer strategy, and contingency plans if capital falls short. Board approval: capital plan should be reviewed and approved by the board as part of the annual ICAAP. A: retrospective. C: a one-time calculation. D: must also consider Pillar 2.
Get the full FRM question bank — free
Drop your email and we'll send you fresh FRM practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 216
What is 'technology risk governance' and how is it organised in financial institutions?
Select an option first.
Correct answer: B — The framework of oversight, accountability, and control over technology risks — organised through: a Technology Risk Committee (or embedded in the Risk Committee), a Chief Information Security Officer (CISO) responsible for cybersecurity, an IT Risk function within the second line, clear policies for IT risk management, and regular board-level reporting on technology risk. Technology risk governance has become a board-level priority following major cyber incidents and DORA requirements
Explanation: B is correct. Technology risk governance: CISO: responsible for information security strategy and cyber risk management (reports to CRO or directly to CEO/board). IT Risk: second line function overseeing technology risks across the organisation. Risk Committee: oversees technology risk alongside market, credit, and operational risks. Board: receives regular technology risk reports — understanding the cyber threat landscape and the firm's resilience is now an expectation of board members. Post-DORA: EU regulators require explicit board accountability for ICT risk governance. A: risk function is independent of IT. C: applies to all financial institutions regardless of data centre ownership. D: applies to all banks.
Question 217
What is the 'principle of risk ownership' and how does it apply to operational risk?
Select an option first.
Correct answer: B — The principle that risks should be owned by the business unit or individual closest to the risk, who is best placed to understand, manage, and accept accountability for it — in operational risk: business line managers own their operational risks (first line). The operational risk function provides oversight, tools, and challenge but does not own the risks. If the business unit owns the risk, they have the incentive and accountability to manage it well
Explanation: B is correct. Risk ownership principle: clear risk ownership drives accountability — 'if you own the risk, you are responsible for keeping it within appetite.' First line: business managers own the risk and sign off on RCSA assessments for their area. Second line: provides the framework and challenges. Third line: assesses whether ownership and management are effective. Problems when ownership is unclear: no one is responsible for managing the risk; controls are designed without knowledge of the actual process; and there is no accountability when losses occur. A reverses the ownership principle. C: regulators oversee, not own. D: ownership is ongoing, not annual.
Question 218
What is 'risk escalation' and what triggers it in an operational risk management context?
Select an option first.
Correct answer: B — The process of bringing a risk issue to the attention of a higher level of management or authority when it exceeds defined thresholds or requires decisions beyond the current level's authority — triggers: KRI exceeds amber or red threshold, loss event above a defined size, control failure in a material control, a new risk identified that exceeds the unit's risk tolerance, a near miss in a critical process
Explanation: B is correct. Escalation triggers: well-defined escalation criteria ensure the right people are informed at the right time. Example framework: (1) Loss event > $50K: report to CRO within 24 hours. (2) KRI in red zone: immediate management action required. (3) Control failure in a material control: report to risk committee at next meeting. (4) Single loss event > $5M: immediate board notification. Culture: employees must feel safe to escalate — punishment for bringing bad news kills escalation. Pre-defined escalation paths: ensure everyone knows where to escalate without needing to decide. A is regulatory reporting. C is capital adjustment. D is external audit notification.
Question 219
What is 'scenario analysis facilitation' and what biases must be managed?
Select an option first.
Correct answer: B — The expert-guided process of running scenario workshops to produce probability and impact estimates for severe operational risk events — biases to manage: anchoring (initial estimates anchor subsequent discussion), availability bias (over-weighting recent or memorable events), groupthink (pressure to conform to dominant view), optimism bias (systematic underestimation of probabilities), and herding (experts align with the group rather than their true belief)
Explanation: B is correct. Scenario facilitation: a skilled facilitator is critical — must ensure all voices are heard, challenge overly optimistic or pessimistic estimates, present external benchmarks to calibrate estimates, and document rationale for the estimates. Structured elicitation: use Delphi method (individual estimates before group discussion), probabilistic questions ('what is the probability this event causes more than $50M?'), and pre-mortem analysis ('imagine this event has just occurred — what caused it?'). Anchoring mitigation: don't reveal previous estimates; start each estimate independently. A is historical analysis. C is regulatory approval. D is statistical selection.
Question 220
What is 'the linkage between RCSA and capital' and how should they be connected?
Select an option first.
Correct answer: B — RCSA qualitative assessments (residual risk ratings, control quality) should inform and be consistent with the quantitative capital model outputs — high RCSA risk ratings in a cell should correspond to higher capital estimates; improvements in control quality should eventually reduce capital. The linkage is often indirect: RCSA informs scenario selection and calibration (higher risk cells get more conservative scenarios), and BEICAFs (under AMA) translated RCSA scores into capital adjustments. Under Basel IV SA, the linkage is through the ICAAP Pillar 2 assessment
Explanation: B is correct. RCSA-capital linkage: consistency test: if RCSA shows a specific risk cell has deteriorating controls, but the capital model shows declining capital for that cell, there is an inconsistency that should be investigated. ICAAP: RCSA findings (high residual risk areas, control weaknesses) inform the qualitative narrative in the ICAAP and support arguments for Pillar 2 buffers. Feedback loop: large loss events trigger RCSA updates (is this risk now better understood and higher than previously assessed?). A: RCSA doesn't produce a single number for capital. C: both serve different purposes. D: RCSA is a fundamental risk management tool regardless of capital sophistication.
Question 221
What is 'regulatory capital floor' and how does the output floor in Basel IV apply to operational risk?
Select an option first.
Correct answer: B — In Basel IV, the Output Floor requires that a bank's total risk-weighted assets (calculated using approved internal models for credit risk, market risk, etc.) cannot be less than 72.5% of what they would be under the standardised approaches. For operational risk specifically: Basel IV eliminates internal models (AMA) and mandates the standardised approach — so there is no internal model for OpRisk to which the output floor applies. The output floor affects other risk types; OpRisk capital IS the standardised approach
Explanation: B is correct. Basel IV output floor and OpRisk: the output floor (72.5% of SA RWA) applies to the total capital calculation (credit + market risk internal models). For operational risk: since AMA has been abolished and replaced by the mandatory SA, there is no internal model to constrain. Banks calculate OpRisk capital solely using the SA (BIC × ILM). The output floor does not further constrain this — the SA IS the floor for OpRisk. The output floor is most relevant for credit risk (IRB models) and market risk (IMA models). A: the floor is regulatory, not voluntary. C: the output floor doesn't apply to OpRisk per item. D: regulatory.
Question 222
What is 'cross-border operational risk' and what unique challenges does it present?
Select an option first.
Correct answer: B — Operational risks arising from conducting business activities across multiple jurisdictions — unique challenges: different regulatory requirements in each jurisdiction (AML laws, data protection, capital rules), different legal systems (enforceability of contracts), language and cultural barriers increasing miscommunication risk, operational complexity from multiple time zones, political risk (government actions affecting operations), and concentration risk if a critical function is located in a high-risk jurisdiction
Explanation: B is correct. Cross-border OpRisk: a global bank operates in 50+ countries, each with its own OpRisk profile. Data residency: some jurisdictions require customer data to be stored locally (cannot use global data centres). Employment law: differences in labour laws affect HR practices (a control that works in the UK may not be legal in another jurisdiction). Insolvency risk: an operational failure in a foreign subsidiary may have complex resolution under local bankruptcy law. Regulatory access: regulators require access to systems and data wherever they are located. A is FX risk. C and D: broader than just regulatory risk.
Question 223
What is the 'risk of over-reliance on models' in operational risk management?
Select an option first.
Correct answer: B — The risk that management uses quantitative operational risk models (LDA, scenario models) without sufficient understanding of their limitations — leading to: false confidence in model outputs, under-appreciation of model uncertainty, reduced qualitative risk judgment, and potential capital inadequacy if models systematically underestimate tail risk. Models should inform judgment, not replace it
Explanation: B is correct. Model over-reliance: the pre-2008 crisis: quantitative models (Gaussian copula for CDOs, VaR models for market risk) gave false confidence in risk management. For OpRisk: the 99.9th percentile from an LDA model looks precise but carries enormous uncertainty (the confidence interval may span 3-10x the point estimate). Board and management should understand: what assumptions drive the capital estimate, how sensitive the estimate is to key assumptions, and what types of risks may not be captured in the model. A: over-reliance on a single model is the concern. C: over-reliance applies to quantitative AND qualitative tools. D: all tools can be misused.
Question 224
What is 'risk communication to the board' and how should complex OpRisk quantitative topics be presented?
Select an option first.
Correct answer: B — Translating complex quantitative operational risk information into clear, jargon-free language accessible to non-specialist board members — key principles: use absolute numbers (not percentages of percentages), provide context (compare to budget, peers, prior period), use visuals (heat maps, trend charts), focus on material matters (top 5 risks, not all risks), provide narratives for major events, and give clear recommendations for board decisions
Explanation: B is correct. Board communication principles: non-executive directors may not have quantitative risk backgrounds — they need clear insights, not model outputs. Effective board report: (1) Executive summary: 'Our operational risk profile is elevated due to [specific reason].' (2) Key risk highlights: top 5 material risks with trend direction. (3) Major incidents: root cause and remediation status. (4) Capital position: regulatory vs economic, vs appetite. (5) Actions required from the board. Avoiding: model parameters, statistical jargon, and information overload. A is model output dumping. C is monitoring, not board communication. D is regulatory reporting.
Question 225
What is 'enterprise-wide risk aggregation' and what technical challenges does it present?
Select an option first.
Correct answer: B — The process of combining operational risk data, KRIs, capital estimates, and risk assessments from all business units, subsidiaries, and geographies into a coherent enterprise-wide risk picture — technical challenges: inconsistent data formats across systems, different risk classification taxonomies, currency translation, data timeliness (not all units report at the same frequency), and the challenge of meaningful aggregation across qualitative and quantitative data
Explanation: B is correct. BCBS 239 addresses these challenges for G-SIBs: Principle 1: governance and risk data architecture — investment in common platforms. Principle 2: data accuracy — ensuring aggregate figures are reliably accurate. Principle 3: completeness — all material risks and legal entities included. Principle 4: timeliness — automated feeds rather than manual spreadsheets. Common OpRisk aggregation challenges: 100+ subsidiaries each with their own local loss databases; manual data extraction from local systems; time to consolidate may exceed the reporting deadline. A: aggregation always involves uncertainty and judgment. C: BCBS 239 applies to G-SIBs but risk aggregation is relevant for all.
Question 226
What is the 'ORSA' (Own Risk and Solvency Assessment) in an insurance context and how does it compare to banking's ICAAP?
Select an option first.
Correct answer: B — An insurer's self-assessment of all material risks facing the business and the capital required to cover them — under Solvency II. Similar to banking's ICAAP: both are internal assessments going beyond Pillar 1 minimum capital; both are forward-looking (3-5 year horizon); both require board approval; and both are reviewed by supervisors. Key difference: ORSA explicitly includes business strategy and considers risks from strategic decisions; ICAAP is somewhat more capital-focused
Explanation: B is correct. ORSA vs ICAAP comparison: Both: internal, forward-looking, board-approved, supervisor-reviewed, go beyond Pillar 1. ORSA differences: more explicitly strategy-connected (Solvency II designed this way), includes insurance-specific risks (longevity, catastrophe, underwriting). ICAAP: may be more mechanistic (capital adequacy calculation), though SREP increasingly expects strategy linkage. Format: both are significant documents submitted to supervisors. Good practice: both should be owned by the CRO with board engagement — not just regulatory compliance exercises. A is one deliverable from the ORSA. C is correct — not the same but similar. D is external audit.
Question 227
What is 'macroeconomic sensitivity' of operational risk and how does the economic cycle affect OpRisk?
Select an option first.
Correct answer: B — Operational losses tend to increase during economic downturns: (1) External fraud increases (more financially motivated fraudsters); (2) Internal fraud risk rises (staff under financial pressure); (3) Customer conduct risk increases (more claims, disputes, defaults); (4) Regulatory risk increases (regulators more scrutinising); (5) System capacity risks from increased transaction volumes in crises. Some OpRisk types decrease in downturns (smaller transaction volumes may reduce processing error frequency)
Explanation: B is correct. OpRisk economic cycle sensitivity: evidence from the 2008 financial crisis: conduct risk (mis-selling claims, LIBOR manipulation) was fuelled by the preceding boom. OpRisk losses surged post-2008: regulatory fines, litigation, customer redress claims. AML violations increased as money launderers exploited the crisis. System failures increased as banks processed more distressed asset transactions. Implication: OpRisk capital planning should include economic downturns in stress scenarios — OpRisk capital should not only reflect calm period assumptions. A: correlations exist. C: some increase in downturns. D: distribution is not uniform.
Question 228
What is 'privacy risk' and how does GDPR create operational risk for financial institutions?
Select an option first.
Correct answer: B — The risk of harm to individuals and the institution from inappropriate collection, use, storage, or disclosure of personal data — GDPR creates specific operational risks: (1) Data breach notification obligations (72-hour deadline to ICO in UK/SA in EU); (2) Right to erasure requests require operational capability to delete customer data across all systems; (3) Data minimisation requirements change operational data collection practices; (4) International transfer restrictions affect outsourcing operations
Explanation: B is correct. GDPR operational risks: data breach: failure to notify within 72 hours → regulatory fine up to 4% of global turnover. Right to erasure: a customer requests deletion of all their data — if data is stored in 50+ systems and backups, operationally complex to execute. Data portability: customer requests all their data in a machine-readable format — requires investment in data architecture. International transfers: post-Brexit, data transfers between UK and EU require specific mechanisms. Investment: GDPR compliance required massive operational investment (privacy impact assessments, data mapping, DPO appointment). A is broader. C and D: applies to all operations.
Question 229
What is 'supervisory technology' (SupTech) and how does it differ from RegTech?
Select an option first.
Correct answer: B — The use of technology by supervisory authorities (regulators) to enhance their supervisory activities — examples: automated data collection and analysis of regulatory submissions (XBRL), machine learning for detecting suspicious activity in market data, natural language processing to analyse news and identify emerging risks, and data analytics to compare banks' risk profiles across the system. RegTech is used by regulated entities; SupTech is used by the regulator
Explanation: B is correct. SupTech: FCA Innovation Hub, ECB SupTech, Bank of England SupTech. Examples: (1) Automated data collection: real-time reporting feeds from banks to regulators (reduces manual submissions). (2) Machine learning: detecting market abuse patterns across thousands of trades. (3) Text analytics: scanning news and social media for systemic risk indicators. (4) Cross-bank analysis: comparing risk metrics across all supervised entities to identify outliers. SupTech and RegTech are complementary: banks use RegTech to produce data; regulators use SupTech to analyse it. A: SupTech is used by regulators, not banks. C: human judgment remains essential. D: RegTech is bank-side; SupTech is regulator-side.
Question 230
What is 'risk-appetite breach' and what actions should follow?
Select an option first.
Correct answer: B — An occurrence when an operational risk metric (KRI, loss level, capital utilisation) exceeds the limits defined in the risk appetite statement — action required: immediate escalation to the appropriate authority (senior management, board, or regulator depending on severity), root cause analysis (why was the limit breached?), remediation plan (what steps will bring the metric back within appetite?), reporting in the risk appetite dashboard, and consideration of temporary risk acceptance while remediation is underway
Explanation: B is correct. Breach management: the risk appetite framework should define: escalation paths for each metric (who is notified when KRI X exceeds the red threshold?), required response times, acceptable temporary risk acceptance procedures, and reporting to the board. Example: operational loss rate breaches 3% of revenue (amber threshold) → CRO notified immediately → investigation initiated → board informed at next risk committee. If breaches are frequent: the appetite may be set incorrectly (too tight) or risk management is genuinely inadequate. A is budget management. C and D: may be part of a serious breach but not the definition.
Question 231
What is 'risk appetite vs risk limit' and how do they differ in operational risk management?
Select an option first.
Correct answer: B — Risk appetite: the overall level and type of operational risk the organisation is willing to accept (expressed qualitatively and quantitatively — 'we will not tolerate more than 3% of revenue in annual operational losses'). Risk limit: a specific, granular, operational boundary set below the risk appetite to provide an early warning buffer (e.g., individual business unit loss limit = 1% of BU revenue). Limits are the operational implementation of the appetite
Explanation: B is correct. Appetite vs limit: risk appetite = the strategic tolerance set by the board. Risk limits = operational thresholds at a granular level, typically set below appetite to create a buffer. The tiered system: Board sets appetite → CRO translates into divisional limits → business unit managers set team limits → individual limits (transaction authorisation limits). Breach response: limit breach → management action. Appetite breach → board-level escalation. Rationale: limits provide early warning before the appetite is breached — management can take corrective action while still within the appetite. A: different levels and specificity. C: limits can be delegated; appetite is board-level. D: both apply at different organisational levels.
Question 232
What is 'Basel IV output floor' and how does it interact with operational risk?
Select an option first.
Correct answer: B — The Basel IV output floor requires that total risk-weighted assets calculated using approved internal models (for credit risk, market risk, etc.) cannot be less than 72.5% of the standardised approach RWA. For operational risk specifically: Basel IV replaced AMA with a mandatory standardised approach — there are no internal models for OpRisk under Basel IV Pillar 1. Therefore, the output floor does NOT separately apply to operational risk; OpRisk uses the SA exclusively. The output floor affects the overall total RWA calculation, not OpRisk specifically
Explanation: B is correct. Output floor and OpRisk: Pre-Basel IV: AMA allowed internal models for OpRisk → the output floor concept could apply to OpRisk (ensuring AMA capital ≥ 72.5% of SA). Post-Basel IV: AMA abolished → OpRisk capital = SA only. No internal model to constrain. The output floor applies to: credit risk (IRB vs SA), market risk (IMA vs SA), and CVA risk. For the bank's total capital ratio: the output floor ensures total RWA doesn't fall below 72.5% of total SA RWA across all risk types. A: the floor doesn't set a separate minimum for OpRisk. C: the floor doesn't double capital. D: the floor primarily addresses credit risk model gaming (RWA reduction through IRB).
Question 233
What is 'risk-adjusted return' and how should operational risk be incorporated?
Select an option first.
Correct answer: B — Net profit adjusted for the cost of all risks taken to generate that profit — for operational risk: (Net Revenue − Expected Operational Loss − Operating Costs − OpRisk Capital Charge) / OpRisk Economic Capital. This ensures that high-revenue activities with large operational risk costs (expensive processes, high fraud rates) are evaluated on a risk-adjusted basis rather than gross revenue alone
Explanation: B is correct. OpRisk in risk-adjusted return: the capital charge for OpRisk is: OpRisk EC × hurdle rate (e.g., 12%). This charge should reduce the risk-adjusted return for high-OpRisk activities. Example: two businesses generate €50M revenue each. Business A has low OpRisk EC (€10M) → capital charge = €1.2M. Business B has high OpRisk EC (€100M) → capital charge = €12M. On a risk-adjusted basis, Business A is far more efficient. Without OpRisk in the calculation, management would see both businesses as equally profitable. A is a simplification. C omits the capital charge. D excludes OpRisk.
Question 234
What is 'systemic operational risk' and why is it a concern for financial stability?
Select an option first.
Correct answer: B — Operational risk events that can cascade across multiple financial institutions simultaneously — examples: (1) A major payment infrastructure failure (SWIFT outage would simultaneously affect all connected banks globally); (2) Concentrated third-party failure (if AWS cloud service fails and 70% of European banks use AWS for critical services); (3) A cyber attack on shared infrastructure (BGP route hijacking affecting all internet banking). Systemic OpRisk is a macro-prudential concern that can destabilise the entire financial system
Explanation: B is correct. Systemic OpRisk: most OpRisk is idiosyncratic (one bank's rogue trader doesn't affect other banks). Systemic OpRisk arises from: shared dependencies (many banks on the same infrastructure), interconnectedness (a failure at one bank triggers failures at others), and common vulnerabilities (all banks using the same unpatched software). Regulatory response: FSB monitoring of financial market infrastructures (FMIs), DORA oversight of critical ICT third-party providers, and central bank oversight of payment systems. A: systemic OpRisk is correlated across institutions. C: it applies to any institution relying on shared infrastructure. D: applies across financial institutions of all sizes.
Question 235
What is 'de minimis' treatment in operational risk data collection?
Select an option first.
Correct answer: B — A practical approach allowing operational losses below a very small threshold to be excluded from formal loss data capture without requiring truncation adjustment — typically applied for extremely small losses (e.g., below €1,000) where the administrative cost of capture exceeds the risk management benefit. Distinguished from the main capture threshold (€10-20K): de minimis covers truly trivial events
Explanation: B is correct. De minimis vs capture threshold: capture threshold (€10-20K): events below this are not captured but their absence is adjusted for in the LDA through truncation correction. De minimis (below €1K): truly trivial amounts where even knowing about them provides no risk management insight. In practice: most banks set their capture threshold to encompass de minimis amounts — events below €10K are simply not captured. The distinction is theoretical. Regulatory guidance: no specific de minimis exemption in Basel — all banks should have appropriate capture processes. A is a different concept. C is a definition of application scope. D is a regulatory tiering concept.
Question 236
What is 'loss event reserve' and how is it used in operational risk capital management?
Select an option first.
Correct answer: B — A provision set aside in the accounts to cover expected future payments arising from operational risk events that have already been identified — examples: a litigation provision (the bank has been sued and expects to pay $50M), a regulatory fine provision (a fine is probable but not yet paid), or customer redress provision (for identified mis-selling). Releases of provisions when the final outcome is less than provisioned create positive P&L; additional provisions reduce P&L
Explanation: B is correct. Loss event reserves: accounting (IFRS/GAAP): provisions are recognised when: (1) there is a present obligation from a past event; (2) an outflow of resources is probable; (3) a reliable estimate can be made. OpRisk implications: ICAAP should consider provisions already held — if a $200M litigation provision exists, this reduces the net unexpected loss above the provision that requires additional capital. Capital modelling: provisioned amounts are the expected portion; capital is needed for uncertainty around the final outcome. A is a capital buffer (different). B has the definition. C is an insurance concept. D is a different reserve.
Question 237
What is 'near-real-time risk reporting' and what technology enables it?
Select an option first.
Correct answer: B — Risk reporting systems that provide updated risk metrics with minimal latency — enabling management to monitor operational risk indicators, KRIs, and system alerts as they change. Enabled by: data streaming technology (Apache Kafka), in-memory computing (SAP HANA), real-time database connections, and API-based data feeds. Particular value for: cyber incident monitoring (real-time threat alerts), payment processing KRIs (real-time error rates), and system availability monitoring
Explanation: B is correct. Near-real-time reporting technology: streaming data: events (transactions, system alerts, KRI updates) pushed to a central data store as they occur. Dashboard refresh: every few minutes rather than end-of-day batch. Benefits: operational incidents detected faster, management can respond before losses escalate, SLA breaches identified in real time. Challenges: data quality at speed (incorrect data feeds undermine real-time reporting), infrastructure cost (real-time systems are more expensive than batch), and alert fatigue (too many low-quality alerts reduce the effectiveness of important ones). A is end-of-day reporting. C is quarterly governance reporting. D is audit activity.
Question 238
What is 'risk appetite cascade failure' and what causes it?
Select an option first.
Correct answer: B — The breakdown of risk appetite communication from the board down to front-line business units — causes: (1) Appetite is expressed in abstract terms not translatable to daily operations; (2) No cascade process to convert appetite into specific metrics and limits for business units; (3) Business managers unaware of the appetite or how their activities relate to it; (4) Appetite is not embedded in decision-making or incentive structures; (5) No feedback mechanism confirming appetite is being met
Explanation: B is correct. Cascade failure consequences: if front-line staff don't know what the risk appetite is or how it applies to their role, risk management becomes a compliance exercise rather than a management tool. Example failure: board sets appetite — 'OpRisk losses not to exceed 2% of revenue.' This is never converted into specific KRIs, limits, or operational guidelines for payment teams. Payment teams continue with inadequate controls, losses exceed 2%, and no one has triggered an earlier warning. Fix: translate appetite into specific, role-relevant metrics; provide training; embed in incentive structures; and create regular feedback reporting. A is a governance gap. C is a limit breach. D is a capital process issue.
Question 239
What is 'enterprise resilience' and how does it extend beyond operational resilience?
Select an option first.
Correct answer: B — A holistic organisational capability encompassing operational, financial, strategic, and reputational resilience — the ability of the organisation to anticipate, prepare for, respond to, and adapt to incremental change and sudden disruptions in order to survive and prosper. Extends beyond operational resilience (which focuses on specific business services) to include: financial resilience (capital and liquidity buffers), strategic resilience (ability to adapt the business model), and cultural resilience (organisation's ability to function under stress)
Explanation: B is correct. Enterprise resilience dimensions: operational resilience: can we deliver critical business services? Financial resilience: do we have sufficient capital and liquidity to absorb shocks? Strategic resilience: can we adapt our business model to structural changes (digital disruption, regulatory change)? Cultural resilience: does the organisation have the psychological resilience to function under extreme stress? Integration: all four dimensions interact — a cyber attack (operational) that triggers a reputational crisis (cultural) and customer outflows (financial) requires all four resilience dimensions. A: enterprise resilience is broader. C: it's different and broader. D: applies enterprise-wide.
Question 240
What is 'risk communication failure' as an operational risk and what are the consequences?
Select an option first.
Correct answer: B — The failure to communicate risk information accurately, completely, or in a timely manner to decision-makers — consequences: management makes decisions without full risk picture, boards approve strategies without understanding the operational risk implications, escalations are delayed (losses grow), and regulators form negative views during inspections. Examples: JP Morgan London Whale (2012) — incomplete risk information to senior management; Lehman Brothers — senior management underestimated risk levels communicated to them
Explanation: B is correct. Risk communication failure as OpRisk: the risk function's output is information — if that information is wrong, incomplete, or not understood, risk management fails regardless of how sophisticated the underlying models are. Common failures: (1) Technical reports not understood by non-specialist boards. (2) Important risks buried in lengthy reports. (3) Infrequent reporting misses developing situations. (4) Cultural barriers to escalating bad news. (5) Data quality issues producing wrong figures. Regulatory expectation (BCBS 239): risk reports must be accurate, comprehensive, clear, useful, timely, and adaptable. A is a system failure. C is a financial error. D: potentially material consequences.
More free FRM topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.