You’re on a roll
Create a free account to save your FRM progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › FRM › Operational Risk and Resilience
Free FRM Operational Risk and Resilience Practice Questions & Answers
400 exam-style Operational Risk and Resilience questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 241
What is 'horizon risk' in operational risk and how is it managed?
Select an option first.
Correct answer: B — The risk that an operational risk event identified today will have consequences stretching well into the future — creating horizon uncertainty in capital planning. Examples: regulatory investigations (a bank under AML investigation may face fines 3-5 years later), large litigation (class action suit may take 10 years to resolve), and long-tail reputational damage. Capital planning must account for future obligations from present-day events
Explanation: B is correct. Horizon risk management: ICAAP: forward-looking capital planning should include: identified contingent liabilities (regulatory investigations, pending litigation), expected remediation costs from known conduct issues, and provisions for estimated settlements. Stress scenarios: what if several long-running regulatory investigations result in adverse findings simultaneously? Capital buffers: may need to include a specific buffer for long-horizon operational obligations. Horizon risk differs from parameter uncertainty (uncertainty about model parameters) — it's uncertainty about future materialisation of known obligations. A is interest rate/market risk. C is a model specification issue. D: applicable to all banks with long-horizon obligations.
Question 242
What is 'Basel II' Pillar 1 operational risk capital compared to Basel IV?
Select an option first.
Correct answer: B — Basel II (2004) introduced three approaches for OpRisk capital: BIA (15% × gross income), SA (different multipliers by business line), and AMA (internal models). Basel IV (effective 2023+) replaces all three with a single Standardised Approach using the Business Indicator and Internal Loss Multiplier — eliminating the AMA, introducing the ILM, and making capital partially dependent on actual loss history for large banks. The capital amount has changed for many banks
Explanation: B is correct. Evolution: Basel II innovation — OpRisk capital requirement for the first time (2004, effective 2007). Basel III — maintained the same approaches. Basel IV — abolished AMA, introduced SA with BIC and ILM. Impact: for large banks previously using AMA with low internal model capital, Basel IV SA may increase capital significantly. For banks using BIA, the change may be modest. For banks with high loss history (ILM > 1), capital increases relative to BI-only calculation. A: significant differences. C: Basel IV AMA is eliminated. D: Basel IV: single mandatory SA.
Question 243
What is the '10 Principles for Sound Management of Operational Risk' (BCBS 2011) and which principles address governance?
Select an option first.
Correct answer: B — 11 (not 10) principles from the Basel Committee providing the international benchmark for operational risk management quality — governance principles (1-3): (P1) Board should establish a strong risk management culture. (P2) Banks should develop, implement and maintain a framework that is fully integrated into the bank's overall risk management processes. (P3) Board should approve and review the ORMF. Risk management principles (4-7) cover identification, assessment, monitoring and reporting, and control/mitigation
Explanation: B is correct. BCBS 2011 principles summary: P1-P3: governance. P4: identify. P5: assess. P6: monitor and report. P7: control and mitigate. P8: business continuity. P9: disclosure. P10: role of supervisors. P11: role of banks' disclosures (Pillar 3). The principles are the benchmark supervisors use in SREP to assess ORMF quality — a bank failing multiple principles faces P2R capital add-ons. The governance principles are particularly scrutinised: board culture and involvement in ORMF is a key supervisory concern. A is capital calculation. C: weighted by regulatory application. D: applies to all banks.
Question 244
What is 'operational risk in trading operations' and what specific risks arise?
Select an option first.
Correct answer: B — Operational risks specific to trading environments: (1) Trade booking errors (wrong instrument, wrong direction, wrong quantity — potentially very large P&L impacts); (2) Model risk (incorrect pricing models give wrong values); (3) Limit monitoring failures (positions exceed approved limits, potentially due to system or process failures); (4) Settlement failures (trades don't settle on time); (5) Data errors (incorrect market data inputs causing mispricing); (6) Algorithmic trading failures (Knight Capital 2012: $440M in 45 minutes)
Explanation: B is correct. Trading operations OpRisk: the boundary between market risk and operational risk is blurry in trading: a trade booking error that leads to a market loss = OpRisk (process failure) even though the loss is market-driven. Key controls: T+0 trade confirmation (same-day), real-time position limits monitoring, front-to-back reconciliation (risk system vs accounting vs settlement), independent price verification, and model validation. Algorithmic trading: Knight Capital is the paradigmatic example — a software deployment error caused erroneous orders worth billions of dollars to be placed. A: applicable to all firms with trading activities. C: market and operational risk are both involved. D: electronic trading introduced new OpRisk (algorithmic failures).
Question 245
What is the 'NSFR' and 'LCR' relationship with operational risk?
Select an option first.
Correct answer: B — The LCR and NSFR are liquidity risk metrics (not operational risk capital measures), but they are related to operational risk management because: a major operational failure can trigger liquidity stress (a cyber attack causing reputational damage may trigger a bank run); maintaining LCR-qualifying HQLA supports the ability to meet liquidity obligations during an operationally-driven crisis; and operational failures in treasury systems can prevent effective liquidity management
Explanation: B is correct. LCR/NSFR and OpRisk linkage: the 2008 Northern Rock bank run was triggered partly by: media exposure of its high reliance on wholesale funding (reputational/conduct risk event) → depositor panic → liquidity crisis. Operational failures in payments systems can disrupt the bank's ability to move liquidity between entities. DORA: ensuring operational resilience of treasury management systems supports LCR compliance. In ICAAP/ILAAP: operational scenarios should consider liquidity implications of major OpRisk events. A: different regulatory requirements. C: LCR/NSFR are liquidity metrics. D: LCR/NSFR are regulatory ratios, not KRIs.
Get the full FRM question bank — free
Drop your email and we'll send you fresh FRM practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 246
What is the 'accountability mapping' requirement under senior accountability regimes like SMCR?
Select an option first.
Correct answer: B — The requirement for each Senior Manager to have a clear, documented Statement of Responsibilities specifying which functions, activities, or decisions they are personally accountable for — relevant to operational risk: if the Head of Operations holds SMCR responsibility for payment processing, they are personally accountable for the operational risk of that process. This creates strong individual incentives to manage operational risk effectively
Explanation: B is correct. SMCR accountability and OpRisk: Statements of Responsibilities (SoR): each Senior Manager's SoR is submitted to and held by the FCA/PRA. Accountability test: if a major operational failure occurs in a Senior Manager's area of responsibility, the regulator will assess whether they took 'reasonable steps' to manage the risk. Personal liability: a Senior Manager who approved an OpRisk-reducing shortcut that later caused harm may face FCA/PRA enforcement. Culture impact: knowing that responsibility is personally attributed to named individuals changes decision-making — senior managers take operational risk management more seriously when personally accountable. A is CRO-mapping. C is a listing. D is process mapping.
Question 247
What is 'enterprise risk taxonomy' and how does it support operational risk management?
Select an option first.
Correct answer: B — A comprehensive, structured classification system for all risk types that applies consistently across the entire organisation — enabling: consistent risk identification (all business units use the same definitions), aggregation (comparing 'people risk' across divisions is meaningful only if they use the same definition), benchmarking (industry comparison requires consistent categories), regulatory reporting (consistent with Basel event type taxonomy), and risk culture (a common language for risk discussion
Explanation: B is correct. Risk taxonomy components: Tier 1 (broad categories): Market Risk, Credit Risk, Operational Risk, Liquidity Risk, Strategic Risk. Tier 2 (sub-types): within Operational Risk — Process Risk, People Risk, Technology Risk, External Event Risk, Legal/Compliance Risk. Tier 3 (specific risks): within Technology Risk — System Failure, Cyber Risk, Data Quality Risk. This hierarchy enables: consistent RCSA (everyone classifies the same way), meaningful aggregation (add up Technology Risk capital across business lines), and regulatory consistency (map to Basel event type categories). A is a risk ranking. C is regulatory catalogue. D is product classification.
Question 248
What is 'total cost of risk' in operational risk and how is it measured?
Select an option first.
Correct answer: B — The comprehensive cost to an organisation of its operational risk exposure — components: (1) Expected losses (operational losses actually incurred); (2) Insurance premiums (cost of transferring risk); (3) Control investment (cost of risk management infrastructure, compliance, and risk function); (4) Capital cost (cost of holding regulatory/economic capital against unexpected losses); (5) Opportunity costs (business foregone due to risk constraints). Total cost of risk provides a more complete picture than capital alone
Explanation: B is correct. Total cost of risk (TCOR): used in risk-adjusted performance measurement. Example: a business unit generates €100M revenue. TCOR components: actual losses €5M + insurance €2M + control costs €10M + capital cost (EC × hurdle rate) €8M = €25M total. Net risk-adjusted profit = €75M. If a 'cheaper' strategy avoids control investment (€10M saving) but increases expected losses (€20M additional losses) and capital (€5M capital cost), the TCOR increases — the 'savings' are false. TCOR helps make risk investment decisions explicit. A is one component. C is an allocation method. D is a Pillar 3 disclosure component.
Question 249
What is 'continuous monitoring' vs 'periodic monitoring' in operational risk management?
Select an option first.
Correct answer: B — Continuous monitoring: automated, real-time or near-real-time tracking of risk indicators and controls (e.g., transaction monitoring systems, KRI dashboards updated daily from system feeds, real-time cyber threat monitoring). Periodic monitoring: manual review at defined intervals (monthly RCSA updates, quarterly risk committee reports, annual capital recalculation). Both are needed — continuous monitoring provides early warning; periodic monitoring provides context, trends, and governance review
Explanation: B is correct. Monitoring types: Continuous: automated — catches issues as they arise; reduces detection time; requires investment in monitoring infrastructure; generates large volumes of data requiring filtering. Periodic: human judgment applied at intervals; provides context and analysis; reviews trends; ensures governance oversight. Combination: automated continuous monitoring identifies issues; periodic governance reviews assess whether the overall framework is working and whether risk appetite is being met. A: continuous monitoring complements but doesn't replace governance review. C: both have accuracy and timeliness tradeoffs. D: applies to all risk types (continuous transaction monitoring, process KRIs).
Question 250
What is 'TLPT' (Threat-Led Penetration Testing) and how does it differ from standard penetration testing?
Select an option first.
Correct answer: B — A sophisticated cyber resilience test mandated by DORA for significant financial institutions — TLPT uses real threat intelligence specific to the institution to design and conduct attack scenarios, carried out by authorised external red-team testers. Unlike standard pen tests (methodological checklists), TLPT: targets the most critical systems and likely attack vectors based on actual intelligence, simulates the most capable threat actors relevant to the institution, and provides more realistic assessment of resilience
Explanation: B is correct. TLPT (DORA, Article 26): frequency: at least every 3 years for significant entities. Methodology: based on TIBER-EU (Threat Intelligence-Based Ethical Red-Teaming) framework developed by the ECB. Phases: (1) Preparation: scope, rules of engagement; (2) Threat intelligence: produce threat intelligence report specific to the entity; (3) Red-team testing: simulate attacks using the threat intelligence; (4) Closure: assess results, remediate. Key difference from standard pen test: standard tests check for generic vulnerabilities; TLPT simulates attacks by specific adversaries relevant to the institution using actual intelligence about current TTPs. A: frequency is every 3 years, not monthly. C: must use external authorised testers. D: TLPT tests defences against intelligent adversaries, not just known vulnerabilities.
Question 251
What is 'AI-assisted operational risk management' and what are its applications?
Select an option first.
Correct answer: B — The application of artificial intelligence and machine learning to enhance specific operational risk management activities: (1) Anomaly detection in transaction monitoring (ML detects unusual patterns better than rules); (2) Natural language processing for loss event narrative analysis (auto-classify events by risk type); (3) Predictive KRIs (ML models predicting future loss frequency from leading indicators); (4) Automated RCSA support (NLP identifies risks from business process descriptions); (5) Regulatory change monitoring (NLP scans publications for relevant changes)
Explanation: B is correct. AI in OpRisk management: benefits — processes large volumes of data that humans cannot review manually; detects subtle patterns; reduces false positive rates in transaction monitoring. Limitations: AI models are subject to model risk (need validation); they may discriminate or have biases from training data; explainability required for regulatory decisions; adversarial ML (attackers learn to evade ML detection). Governance: AI tools used in risk management should be subject to the same model risk management standards as other quantitative models. A: AI augments, doesn't replace, human judgment. C: human oversight remains essential. D: the three lines of defence structure remains.
Question 252
What is 'restitution and remediation' after an operational risk event causing customer harm?
Select an option first.
Correct answer: B — The obligations to restore affected customers to the position they would have been in had the operational failure not occurred — including: refunding overcharged fees, compensating for losses caused by mis-selling, correcting administrative errors, and providing compensation for distress and inconvenience where appropriate. Regulatory expectations: banks must identify all affected customers, calculate the correct redress, contact and pay customers proactively, and evidence the process to regulators
Explanation: B is correct. Remediation examples: PPI mis-selling (UK): banks proactively contacted millions of customers, offered redress without requiring individual complaints — the largest remediation programme in banking history (£50B+). IT system failures: TSB 2018 migration failure — compensated customers for direct losses caused by system unavailability. Incorrect interest charges: identify all affected accounts, calculate correct amounts, refund automatically. Regulatory expectations: banks should not rely on customers identifying issues — banks must identify affected populations proactively. A is third-party recovery. C is insurance. D is capital provisioning.
Question 253
What is the 'proportionality principle' in DORA and how does it apply to operational resilience requirements?
Select an option first.
Correct answer: B — DORA explicitly applies the proportionality principle: smaller or less complex financial entities face less burdensome requirements than large, complex, systemically important institutions. The requirements are calibrated based on: size (total assets), nature, scale and complexity of operations, and systemic importance. For TLPT: only significant financial entities must conduct threat-led penetration testing. ICT risk management framework: 'simplified' for smaller entities. Third-party risk: proportionate to the number and importance of critical third-party providers
Explanation: B is correct. DORA proportionality: DORA Article 4 explicitly provides that entities shall implement requirements proportionate to their size, risk profile, and nature of operations. Simplified ICT risk management framework: available for microenterprises and small/non-systemically important entities. TLPT: Article 26 designates which entities are subject to TLPT — primarily larger, complex institutions. The ESAs publish criteria for designation. For smaller entities: basic ICT risk management, incident reporting, and third-party risk management still apply, but with less complexity. A: proportionate requirements differ. C: DORA does not just reduce capital. D: DORA applies broadly — proportionality adjusts the level of requirements.
Question 254
What is 'the convergence of operational and financial risks' in a crisis?
Select an option first.
Correct answer: B — During severe market or economic stress, operational risks can amplify financial risks and vice versa — examples: (1) A cyber attack during a market crash prevents banks from managing trading positions, amplifying market losses. (2) A bank run (financial stress) overloads operational systems (technology failure). (3) A major operational failure (regulatory fine) creates liquidity pressure (financial stress). Integrated risk management must capture these feedback loops
Explanation: B is correct. Risk convergence in crises: September 2008: Lehman collapse (credit event) triggered: liquidity stress (financial), counterparty operational failures (post-trade settlement problems), massive volume spikes in operations (systems stressed), staff departures (people risk), and regulatory scramble (compliance risk). The 2020 COVID crisis: operational disruption (remote working transition) + market volatility + credit stress all hit simultaneously. Integrated risk management: ICAAP should model scenarios where multiple risk types materialise together — correlation between OpRisk and market/credit risk is positive in crises. A: they strongly interact in crises. C: OpRisk often increases in crises. D: siloed management misses these interactions.
Question 255
What is the 'EBA operational risk framework' and how does it guide EU banks?
Select an option first.
Correct answer: B — The European Banking Authority provides binding and non-binding guidance supplementing the Basel capital requirements for operational risk within the EU regulatory framework — through: (1) Binding regulatory technical standards (RTS) for OpRisk reporting (COREP format); (2) Guidelines on internal governance including OpRisk governance; (3) Guidelines on ICT and security risk management; (4) Guidelines on outsourcing arrangements; (5) Q&A responses clarifying Basel SA implementation. EU banks must comply with both Basel (as implemented in CRR/CRD) and EBA guidelines
Explanation: B is correct. EBA role: EBA is the EU's banking prudential standard-setter (equivalent to the UK's PRA for Basel implementation). Key EBA outputs for OpRisk: COREP reporting templates (the standardised format for all EU banks to report OpRisk capital — enabling cross-bank comparison by the ECB). ICT security guidelines (precursor to DORA — operational resilience standards before DORA). Outsourcing guidelines (EBA 2019 — comprehensive third-party risk management requirements). Final Q&A (clarifying practical implementation of the Basel SA for OpRisk). A: EBA supplements Basel; doesn't replace the SA. C: applies to all EU credit institutions and investment firms. D: EBA guidelines are binding in practice through supervisory expectation.
Question 256
What is 'risk measurement vs risk management' and what is the difference?
Select an option first.
Correct answer: B — Risk measurement: the quantification of risk using models, data, and analytical methods (LDA, VaR, KRIs, scenario analysis). Risk management: the set of decisions, actions, controls, and strategies taken to bring risk to an acceptable level. Measurement without management is useless (knowing the risk but not acting). Management without measurement is ineffective (acting on instinct without data). Together: measurement informs management decisions
Explanation: B is correct. Measurement-management gap: a common failure in financial institutions: sophisticated capital models (excellent measurement) but weak actual management of the risks (poor management). The model produces a $500M capital number, but no one asks: what specific risks are driving this? What actions would reduce it? How do controls improvements translate to capital reduction? Bridge: the connection between measurement and management should be explicit — model outputs should feed directly into RCSA actions, KRI monitoring, and capital management decisions. A: different activities. C: management requires human judgment. D: both are essential.
Question 257
What is 'risk taxonomy alignment' with accounting and how does it affect loss data quality?
Select an option first.
Correct answer: B — Aligning operational risk event classifications with accounting categories ensures that: (1) Loss amounts in the OpRisk database tie to actual financial statement impacts; (2) Auditors can verify operational loss data; (3) Provisioning for OpRisk losses (IFRS) is consistent with the OpRisk capital model; (4) Regulatory reporting (COREP) is consistent with financial reporting. Misalignment creates: unexplained differences between risk and finance data, reduced credibility of the capital model, and BCBS 239 data quality concerns
Explanation: B is correct. Finance-risk alignment: the operational risk loss database should be reconciled to the P&L: every gross loss in the OpRisk database should correspond to a P&L impact in the financial accounts (except provisions and near-misses). Reconciliation process: OpRisk team and finance team jointly review large items. Unexplained differences: if $5M appears in the OpRisk database but doesn't correspond to any P&L item — data quality issue. Provisioned losses: an IFRS provision for a regulatory fine = OpRisk event that is recorded before the cash outflow. BCBS 239: data accuracy requires this reconciliation. A: they must align. C: different taxonomies serve different purposes. D: alignment is an ongoing process.
Question 258
What is 'reputational risk quantification' and is it feasible?
Select an option first.
Correct answer: B — Fully precise quantification of reputational risk is extremely challenging and largely impossible because: (1) It depends on future customer behaviour (unpredictable); (2) The magnitude depends on media coverage and public perception (non-linear); (3) Recovery time is uncertain; (4) The specific event characteristics (who was responsible? Was the bank apologetic?) matter enormously. Approaches: scenario analysis (estimate customer attrition under different scenarios), revenue sensitivity analysis, equity market event studies (how much does stock price drop after OpRisk events?)
Explanation: B is correct. Reputational risk measurement: qualitative: risk assessments, management judgment, scenario descriptions. Semi-quantitative: revenue sensitivity ('a major data breach could reduce retail banking revenue by 5-15% for 2 years' → range estimate). Event studies: empirical research on stock price reactions to announced OpRisk events provides base rates. ICAAP: reputational risk scenarios should include revenue and funding cost impacts — even if imprecise, having an estimate is better than ignoring it. A: precise quantification is not feasible. C: imprecision doesn't mean it's unquantifiable in approximate terms. D: it is excluded from Basel Pillar 1 and is only partially captured in Pillar 2.
Question 259
What is 'conduct risk culture' and how do incentive structures create or mitigate it?
Select an option first.
Correct answer: B — Sales and bonus incentive structures that reward short-term performance without risk adjustment create conduct risk: employees are financially motivated to sell inappropriate products, misrepresent terms, or take shortcuts on compliance to meet targets. This drove PPI mis-selling (UK banks: commission-based sales teams with no accountability for claims), LIBOR manipulation (traders' bonuses dependent on rates they were submitting), and Wells Fargo fake accounts (branch staff under impossible sales targets). Incentive redesign: link compensation to customer outcomes, product suitability metrics, and conduct record
Explanation: B is correct. Conduct risk and incentives: the regulatory response (SM&CR, Consumer Duty, Regulation Z, CFPB): require that incentives consider the long-term outcome for customers, not just sales volumes. Malus and clawback: bonus deferrals that can be reduced or clawed back if conduct failures emerge. Product governance: sales process must include suitability assessment regardless of incentive pressure. Monitoring: management information tracking product complaint rates, cancellation rates, and suitability assessments provides early warning of incentive-driven conduct risk. A: incentives are a primary driver. C: not solely individual ethics. D: incentives are one of multiple causes.
Question 260
What is 'risk governance failure' and what historical examples illustrate it?
Select an option first.
Correct answer: B — Failures in risk governance — board oversight, accountability, risk culture, and control frameworks — that allowed major operational losses to develop and escalate. Examples: (1) Barings Bank 1995: Nick Leeson managed both trading AND back-office — no segregation of duties, management ignored anomalies; (2) UBS 2011: Kweku Adoboli incurred $2.3B losses — delta-one desk risk limits were inadequate, risk management culture prioritised revenues; (3) Wells Fargo 2016: fake accounts scandal — board oversight of sales practices culture was inadequate
Explanation: B is correct. Governance failure patterns: single points of failure (no SoD). Management override of controls (revenue pressure trumping risk management). Inadequate board oversight (board not asking hard questions). Risk culture issues (silence enforced by culture). Regulatory response to governance failures: SMCR (individual accountability), three lines of defence clarification (EBA guidelines), Sound Management Principles (BCBS 2011), and Consumer Duty (UK FCA 2023). These reforms attempt to address the root causes of governance failures, not just their symptoms. A: governance can fail. C: governance failures occur in all types of banks. D: governance failures continue to occur despite reforms.
Question 261
What is 'GDPR' and what operational risk does non-compliance create for financial institutions?
Select an option first.
Correct answer: B — The General Data Protection Regulation (EU 2016/679, effective May 2018): the EU's comprehensive data protection law applying to all organisations processing personal data of EU residents — creates operational risks through: (1) Regulatory fines (up to 4% of global annual turnover or €20M for most serious violations); (2) Reputational damage (public fines database); (3) Operational costs of compliance (data mapping, consent management, DSAR response); (4) Breach notification obligations (72-hour window to supervisory authority). Key principles: lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity/confidentiality
Explanation: B is correct. GDPR and financial institutions: all banks processing EU customer data must comply (including non-EU banks with EU customers). Major fines: Google (France) €50M (2019), H&M (Germany) €35M (2020), Clearview AI (various). Financial sector-specific risks: extensive customer data processing (transactions, credit history, KYC data), international data transfers (complex compliance), and data subject rights (right to access, erasure, portability — operationally complex for banks with many legacy systems). UK GDPR: retained in UK law post-Brexit with similar requirements. A: mandatory, not voluntary. C: UK has its own version. D: applies to all sectors including financial services.
Question 262
What is 'risk appetite for new and emerging technologies' and how should it be set?
Select an option first.
Correct answer: B — Financial institutions need a specific risk appetite framework for emerging technologies — covering: (1) Acceptable use cases (what can AI/cloud/blockchain be used for?); (2) Prohibited uses (what cannot be automated or delegated to AI?); (3) Testing and validation requirements before deployment; (4) Maximum exposure to any single technology vendor; (5) Data governance requirements (what data can be processed by which technology?). This enables innovation while managing the specific operational risks of new technologies
Explanation: B is correct. Technology risk appetite elements: AI use case policy: AI can be used for fraud detection and customer segmentation (subject to model validation). AI cannot be used for final credit decisions without human review (explainability requirement, fair lending). Cloud policy: critical systems can use cloud with appropriate controls; certain highly sensitive data must remain on-premises. GenAI: can be used for internal productivity tools; cannot be used to generate customer-facing regulated content without human review. Governance: Technology Risk Committee reviews and approves new technology deployments against the appetite. A: risk management enables responsible adoption. C: risk assessment before adoption is required. D: technology risk appetite needs specific technology-specific parameters.
Question 263
What is 'regulatory examination readiness' and what does it involve for operational risk?
Select an option first.
Correct answer: B — The continuous state of having an operational risk management framework that can withstand regulatory scrutiny at any time — involves: (1) Up-to-date, accurate RCSA documentation; (2) Complete, validated loss database; (3) Current, tested BCP/DR plans; (4) Documented, validated capital model; (5) Board risk committee minutes evidencing oversight; (6) Evidence of KRI monitoring and escalation; (7) Training records for all required courses. Regulatory examinations are increasingly unannounced
Explanation: B is correct. Examination readiness: regulators (PRA, ECB, FCA, Fed) assess: does the bank's actual practice match its documented policies? A bank with excellent policies but poor implementation will receive negative findings. Evidence: regulators expect to see evidence of the framework functioning — RCSA worksheets with management signatures, loss events reviewed and actioned, KRI escalations addressed, model validation reports. Red flags: policies that were last updated 3 years ago, loss database with unexplained gaps, BCP plans not tested in 2 years, RCSAs completed by compliance (not business managers). A is false documentation (creates serious regulatory risk). C is regulatory risk washing. D: readiness must be continuous.
Question 264
What is 'financial stability oversight' and which bodies are responsible?
Select an option first.
Correct answer: B — Macroprudential oversight is conducted by designated authorities responsible for monitoring and addressing systemic risks to the entire financial system — key bodies: (1) Financial Stability Board (FSB): global, coordinates macroprudential policies, monitors G-SIBs; (2) European Systemic Risk Board (ESRB): EU-level, issues recommendations; (3) Financial Stability Oversight Council (FSOC): US, identifies SIFIs; (4) Bank of England Financial Policy Committee (FPC): UK. For operational risk: these bodies monitor systemic OpRisk (shared infrastructure failures, concentrated third-party dependencies)
Explanation: B is correct. Systemic OpRisk and macroprudential oversight: the FSB has a mandate to address operational risk at a systemic level — particularly through its work on third-party dependency (concentration in cloud providers) and financial market infrastructure (FMI) resilience. ESRB: can issue warnings and recommendations on systemic risks including IT concentration. National macroprudential authorities: monitor systemic OpRisk as part of their financial stability mandate. Post-DORA: ESAs (EBA, ESMA, EIOPA) will directly oversee critical ICT third-party providers — a form of macroprudential OpRisk oversight. A: systemic risk is beyond individual bank management. C: coordination is essential. D: systemic OpRisk is increasingly recognised as a financial stability concern.
Question 265
What is 'risk governance at subsidiary level' and what unique challenges does it present?
Select an option first.
Correct answer: B — Managing operational risk at the level of individual legal entities within a banking group — challenges: (1) Allocation of group-level risks to subsidiaries (how much of a group-wide cyber attack cost is attributable to each subsidiary?); (2) Local regulatory requirements (each jurisdiction may have different OpRisk rules); (3) Group vs local risk appetite (a subsidiary's local risk appetite must be consistent with the group's but reflect local conditions); (4) Data flows (sharing risk data across borders may create data sovereignty issues); (5) Intragroup transactions (management charges between entities)
Explanation: B is correct. Subsidiary governance challenges: regulatory: local regulators may require the subsidiary to have its own ICAAP, risk committee, and CRO — not just reliance on the group. Ring-fencing: UK ring-fencing (Vickers) requires retail banking subsidiaries to be operationally self-sufficient — group IT shared services must be available to the ring-fenced subsidiary without dependency on group entities. Resolution: for resolution planning, the subsidiary must be capable of operating independently. Capital: local capital requirements may differ from group capital requirements (add-ons from local regulators). A: local regulatory requirements apply separately. C: governance must function continuously. D: ongoing, not just examination-driven.
Question 266
What is 'non-modellable risk factors' (NMRF) concept and its analogy in operational risk?
Select an option first.
Correct answer: B — In market risk (FRTB), NMRFs are risk factors with insufficient market data for statistical modelling — they receive a specific capital treatment (stress scenario capital). The analogy in operational risk: risk cells or scenarios where there is insufficient historical data to fit statistical distributions ('non-modellable operational risk factors'). For these: scenario analysis provides the capital estimate rather than LDA. The challenge: ensuring appropriate capital for risks that cannot be statistically modelled
Explanation: B is correct. NMRFs in OpRisk: the LDA is most reliable for risks with sufficient historical data. For rare, novel, or structural risks (a new digital currency operational failure scenario; a pandemic-level operational disruption), there is no historical data. Solution: scenario analysis provides point estimates. In the ICAAP: the total capital includes LDA capital (for modellable risk cells) + scenario capital (for non-modellable ones). Validation: for non-modellable risks, the validation process focuses on the reasonableness of expert estimates rather than statistical backtesting. A: they require special treatment. C: scenario capital is required. D: the concept applies analogously to operational risk.
Question 267
What is 'financial crime compliance technology' (FCCT) and what role does it play in managing operational risk?
Select an option first.
Correct answer: B — Specialised technology solutions that automate financial crime compliance obligations — including: transaction monitoring systems (real-time screening for suspicious patterns), KYC/onboarding automation (identity verification, document checking, PEP/sanctions screening), case management systems (tracking AML investigations), and sanctions screening systems (real-time payment screening against OFAC/OFSI lists). Reduces operational risk by: decreasing false positive rates, improving detection accuracy, and reducing human error in compliance processes
Explanation: B is correct. FCCT examples: transaction monitoring platforms (NICE Actimize, Oracle FCCM, Temenos): ML-based models that outperform rules-based systems. Automated KYC: document verification using OCR + facial recognition + database screening. Sanctions screening: real-time payment screening with millisecond latency required by payment processing speeds. Benefits for OpRisk: (1) Reduces false positive workload (human effort). (2) Improves detection rates (more true positives). (3) Creates audit trails (regulatory defensibility). (4) Enables real-time screening (keeping pace with payment speeds). A: used by regulated entities. C: manual processes introduce more human error. D: banks typically procure from specialist vendors.
Question 268
What is 'ICT concentration risk' under DORA and how are critical third-party providers identified?
Select an option first.
Correct answer: B — The systemic risk arising when many financial entities simultaneously depend on the same ICT third-party providers — DORA addresses this through the Oversight Framework for Critical ICT Third-Party Service Providers (CTPPs). The ESAs (EBA, ESMA, EIOPA) designate CTPPs based on: the number of financial entities relying on the provider, criticality of the services provided, and substitutability (ease of switching). Designated CTPPs face direct oversight by the ESAs, including annual assessments and required risk management improvements
Explanation: B is correct. DORA CTPP oversight: designation criteria: if a provider serves many significant financial entities for critical functions (e.g., core banking, payment processing, trading infrastructure), they may be designated. Oversight powers: ESAs can conduct inspections, require improvements, impose fees, and in extreme cases recommend prohibition of providing services to EU financial entities. Financial entities: must report their use of critical ICT providers and notify ESAs of material changes. The oversight framework addresses the systemic risk that a single provider failure could simultaneously disrupt financial services across Europe. A: concentration exists even with multiple providers if they serve a large part of the market. C: designation is determined by regulators based on systemic criteria. D: identification by the ESAs, not self-reported.
Question 269
What is 'risk appetite refresh' and how often should the OpRisk risk appetite be reviewed?
Select an option first.
Correct answer: B — The periodic review and update of the operational risk appetite statement and associated metrics to ensure they remain aligned with: (1) Changes in business strategy; (2) Lessons learned from loss events; (3) Evolving regulatory expectations; (4) Changes in the risk environment (new threats, changed control quality); (5) New products or activities introducing new risk types. Annual review at minimum, with triggered reviews when material changes occur
Explanation: B is correct. Appetite refresh triggers: (1) Annual: board review as part of ICAAP and business planning cycle. (2) Major incident: a significant OpRisk loss event should prompt: 'does this change our appetite?' (3) New product/market: new risk types require new appetite metrics. (4) Regulatory change: new requirements may require new appetite expressions. (5) Business strategy change: entering new markets or changing business model changes the risk profile. Process: CRO proposes updates → OpRisk Committee reviews → Board Risk Committee approves. Consistency: the refreshed appetite must be cascaded into updated limits and KRI thresholds. A: dynamic, not static. C: capital model outputs inform appetite review. D: board ownership, not regulator-driven.
Question 270
What is 'risk identification completeness' and how is it tested?
Select an option first.
Correct answer: B — Assessing whether the risk identification process has captured all material operational risks — not just those that have already caused losses. Tested through: (1) Comparison to industry loss databases (are there event types in ORX that are absent from the bank's RCSA?); (2) Process mapping coverage (has every significant business process been through RCSA?); (3) New product and activity risk assessment reviews (are recent business changes captured?); (4) Historical loss event review (are all historical loss categories represented in the RCSA?)
Explanation: B is correct. Completeness testing: the most dangerous risks are those not identified — you can't manage what you don't know about. Common incompleteness sources: (1) New activities not yet through RCSA (a digital bank launch creates cyber and fraud risks before the RCSA is updated). (2) Tail risks excluded from 'normal' RCSA (scenario analysis needed for rare extreme events). (3) Third-party risks not fully captured (vendor risks underestimated). Internal audit: test completeness by comparing RCSA risk inventories to: industry event databases, regulatory enforcement actions in similar banks, and new product risk assessments. A: completeness ≠ accuracy. C: the 56-cell matrix covers categories but not all specific risks within each cell. D: practical value in risk management.
More free FRM topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.