Free Questions › FRM › Risk Management & Investment Management
Free FRM Risk Management & Investment Management Practice Questions & Answers
398 exam-style Risk Management & Investment Management questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 1
What is 'Enterprise Risk Management' (ERM)?
Select an option first.
Correct answer: B — A comprehensive, integrated framework for identifying, assessing, prioritising, and managing all material risks across an entire organisation — financial, operational, strategic, reputational — to support achievement of business objectives
Explanation: B is correct. ERM (COSO ERM framework): takes a holistic view — integrating risk management across all business units and risk types. It connects risk management to strategy setting and performance. Key benefits: avoids siloed risk management that misses correlations between risks. A is narrow financial risk. C restricts ERM by size. D is regulatory loss reporting.
Question 2
What is the 'risk appetite' of an organisation?
Select an option first.
Correct answer: B — The amount and type of risk an organisation is willing to accept in pursuit of its strategic objectives — expressed qualitatively (statements) and quantitatively (VaR limits, loss thresholds)
Explanation: B is correct. Risk appetite: set by the board, it defines how much risk to take. It is distinct from risk tolerance (the acceptable variation around the appetite) and risk capacity (the maximum risk the organisation can absorb). A is a historical outcome. C is a risk register. D is a regulatory constraint.
Question 3
What is a 'risk register'?
Select an option first.
Correct answer: B — A formal document cataloguing all identified risks, their likelihood and impact, current controls, residual risk level, and risk owners — the foundation of an ERM programme
Explanation: B is correct. Risk register: systematically documents risks identified through the risk assessment process. For each risk: description, likelihood (1-5 scale), impact (1-5), risk rating (likelihood × impact), existing controls, and residual risk after controls. Enables prioritisation and monitoring. A is a regulatory register. C is a penalty schedule. D is a financial reserve.
Question 4
What is a 'risk heat map'?
Select an option first.
Correct answer: B — A visual matrix plotting risks by their likelihood and potential impact, with colour coding (green/amber/red) to prioritise risk response — a key ERM communication tool
Explanation: B is correct. Risk heat map: two-dimensional matrix with likelihood on one axis and impact on the other. Risks in the top-right quadrant (high likelihood, high impact) are red (urgent action needed). Used to communicate risk prioritisation to senior management and boards. A is an IT operations tool. C is geographic concentration risk. D is a loss event history.
Question 5
What is 'risk tolerance' in ERM, and how does it differ from risk appetite?
Select an option first.
Correct answer: B — Risk appetite is the desired level of risk, while risk tolerance is the acceptable variation around the appetite — the boundaries within which the organisation is comfortable operating without requiring immediate action
Explanation: B is correct. Risk appetite: desired level of risk. Risk tolerance: acceptable range around the appetite. Risk capacity: maximum absorbable risk. Example: appetite = 5% annual VaR of equity; tolerance = 4-6%; capacity = 10%. Exceeding tolerance triggers review; exceeding capacity triggers crisis response. A conflates them. C and D are incorrect distinctions.
Get the full FRM question bank — free
Drop your email and we'll send you fresh FRM practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 6
What is 'market risk' in a financial institution context?
Select an option first.
Correct answer: B — The risk of losses arising from adverse movements in market prices — interest rates, equity prices, foreign exchange rates, and commodity prices — affecting a firm's trading book and investment portfolio
Explanation: B is correct. Market risk: financial institutions face losses when market prices move against their positions. The trading book holds positions for short-term profit (mark-to-market daily); the banking book holds assets to maturity. Market risk capital requirements under Basel are based on VaR and stressed VaR. A is absurd. C is credit risk. D is operational risk.
Question 7
What is 'credit risk' and its main components?
Select an option first.
Correct answer: B — The risk that a borrower or counterparty will fail to meet their contractual financial obligations — comprising probability of default (PD), loss given default (LGD), and exposure at default (EAD)
Explanation: B is correct. Credit risk components: PD (probability the borrower defaults), LGD (fraction of exposure lost if default occurs = 1 − Recovery Rate), EAD (total exposure outstanding at default). Expected Loss = PD × LGD × EAD. A is market risk. C is rating migration risk (a sub-component). D is interest rate risk (a market risk).
Question 8
What is 'operational risk' and how is it defined under Basel?
Select an option first.
Correct answer: B — The risk of losses resulting from inadequate or failed internal processes, people, systems, or from external events — including legal risk but excluding strategic and reputational risk
Explanation: B is correct. Operational risk (Basel definition): four causes — processes (inadequate procedures), people (fraud, errors), systems (IT failures), external events (natural disasters, fraud). Basel II/III requires capital for operational risk. It excludes strategic risk (competitor threats) and reputational risk. A is market risk. C is strategic risk. D is macro/political risk.
Question 9
What is 'liquidity risk' and what are its two forms?
Select an option first.
Correct answer: B — Funding liquidity risk (inability to raise sufficient cash to meet obligations as they fall due) and market liquidity risk (inability to sell an asset quickly at a fair price without significantly impacting the price)
Explanation: B is correct. Two forms: (1) Funding liquidity: inability to fund positions (access credit, roll debt) when needed — a bank run is an extreme form. (2) Market liquidity: inability to sell assets at fair prices — bid-ask spreads widen, depth shrinks. Both converged in the 2008 crisis. A is dividend risk. C is a specific cause of funding liquidity risk. D is a consequence.
Question 10
What is 'model risk' and how does it arise?
Select an option first.
Correct answer: B — The risk of losses arising from incorrect model outputs, including errors in model design, incorrect calibration, inappropriate application, or inadequate validation — e.g., using a model outside its intended range
Explanation: B is correct. Model risk: arises from: (1) Model error — incorrect mathematical specification; (2) Calibration error — wrong input data; (3) Implementation error — coding bugs; (4) Misuse — applying a model outside its valid range. The 2008 crisis demonstrated massive model risk in CDO valuation models that underestimated default correlation. A is IT infrastructure risk. C is competitive risk. D is a regulatory model approval risk.
Question 11
What is 'reputational risk'?
Select an option first.
Correct answer: B — The risk of loss arising from adverse perceptions of a firm's practices, products, or culture by customers, counterparties, regulators, or the public — can cause loss of business, customer defection, regulatory action, and stock price decline
Explanation: B is correct. Reputational risk: often triggered by an operational failure (data breach, mis-selling), ethical lapses, regulatory fines, or environmental incidents. Can exceed the direct financial loss through customer defection and reduced future revenues. A is a positive reputational change. C is key-person risk. D is a credit rating action.
Question 12
What is 'concentration risk' in portfolio and lending contexts?
Select an option first.
Correct answer: B — Excessive exposure to a single borrower, sector, geography, or asset class — such that an adverse event affecting that concentration causes a disproportionate loss
Explanation: B is correct. Concentration risk: a bank with 40% of its loan book in commercial real estate (like many US banks in 2008) has high concentration risk. Basel requires monitoring concentration and applying add-ons to capital. A is the antidote to concentration risk. C and D are opposite (diversification-related) risks.
Question 13
What is 'systemic risk'?
Select an option first.
Correct answer: B — The risk that the failure of one institution or market can trigger a cascading failure across the entire financial system — interconnectedness means that what starts as a firm-level problem becomes a system-wide crisis
Explanation: B is correct. Systemic risk: Lehman Brothers' failure in 2008 triggered a global credit freeze. Sources: interconnectedness (balance sheet linkages), common exposures (all banks held MBS), fire-sale dynamics (forced selling amplifies price declines). Macroprudential regulation (Basel III, DFAST) aims to reduce systemic risk. A is idiosyncratic firm risk. C is a specific operational risk. D is regulatory risk.
Question 14
What is 'counterparty credit risk' (CCR) in derivatives?
Select an option first.
Correct answer: B — The risk that a counterparty to a derivatives transaction defaults before the contract's final settlement, resulting in a replacement cost loss to the non-defaulting party
Explanation: B is correct. CCR: bilateral OTC derivatives create CCR because the mark-to-market value fluctuates — the party with positive MTM faces loss if the counterparty defaults. Key measures: current exposure (current MTM), potential future exposure (PFE), credit VaR. Central clearing (CCPs) shifts CCR to the clearinghouse. A is market risk. C is operational risk. D is delivery risk.
Question 15
What is 'Wrong Way Risk' (WWR) in CCR?
Select an option first.
Correct answer: B — The risk that counterparty credit quality deteriorates when the exposure to them increases — the exposure and default probability are positively correlated. Example: being long a CDS with a bank whose credit quality falls when the same event triggers a payout
Explanation: B is correct. Wrong way risk: when the underlying asset of a derivative is positively correlated with the counterparty's credit quality. Specific WWR example: buying oil price protection (put on oil) from an oil company — if oil prices fall, the protection has value, but the counterparty (oil company) is also in distress. This makes the protection less reliable exactly when needed most. A is hedging failure. C and D are model/estimation errors.
Question 16
What is 'stress testing' used for in banking risk management?
Select an option first.
Correct answer: B — Evaluating a bank's capital adequacy under hypothetical adverse scenarios (severe recession, market crash, geopolitical shock) to ensure sufficient capital buffers to absorb severe losses without becoming insolvent
Explanation: B is correct. Regulatory stress testing (DFAST in US, EBA stress tests in EU): simulate severe but plausible macroeconomic scenarios. Banks must demonstrate adequate capital under stress — if capital falls below minimum, they must raise capital or restrict dividends. Post-2008, stress testing became a central tool of bank supervision. A and C are operational tests. D is a service quality review.
Question 17
What are the Basel III minimum capital requirements for banks?
Select an option first.
Correct answer: B — 4.5% Common Equity Tier 1 (CET1), 6% Tier 1 total capital, and 8% total capital (Tier 1 + Tier 2), with additional capital buffers for conservation (2.5% CET1) and countercyclical purposes
Explanation: B is correct. Basel III minimum ratios (as % of risk-weighted assets): CET1 ≥ 4.5%, Tier 1 ≥ 6%, Total Capital ≥ 8%. Plus capital conservation buffer of 2.5% CET1. Countercyclical capital buffer (0-2.5% CET1) set by national regulators. G-SIB (systemically important banks) add 1-3.5%. A and C are incorrect. D ignores risk-weighting.
Question 18
What is 'risk-weighted assets' (RWA) in banking regulation?
Select an option first.
Correct answer: B — Total assets weighted by the credit, market, and operational risk attached to each asset type, used as the denominator for capital ratio calculations under Basel
Explanation: B is correct. RWA: different assets carry different risk weights (e.g., cash = 0%, government bonds = 0-20%, mortgages = 35-50%, corporate loans = 100%, equity = 100-250%). Higher RWA means the bank must hold more capital. Banks have incentive to understate RWA — Basel IV (SA-flooring) limits this. A and C are incorrect. D is the leverage ratio concept.
Question 19
What is the 'leverage ratio' in Basel III?
Select an option first.
Correct answer: B — A non-risk-based capital measure: Tier 1 capital divided by total exposure (on-balance-sheet assets + off-balance-sheet items), set at a minimum of 3% — acts as a backstop to risk-based ratios
Explanation: B is correct. Leverage ratio: complements risk-based ratios by ignoring risk weights (prevents banks from gaming risk weights to boost capital ratios). Basel III minimum = 3%; G-SIBs face additional buffers. A is the risk-based capital ratio. C is the financial leverage/gearing ratio. D is a business mix ratio.
Question 20
What is the 'Liquidity Coverage Ratio' (LCR)?
Select an option first.
Correct answer: B — A Basel III requirement that banks hold sufficient High Quality Liquid Assets (HQLA) to survive a 30-day stress scenario — LCR = HQLA / Net Cash Outflows over 30 days ≥ 100%
Explanation: B is correct. LCR: ensures banks can weather a 30-day acute stress event using a buffer of HQLA (cash, central bank reserves, government bonds). HQLA must cover net cash outflows (modelled using assumed runoff rates for deposits, committed facilities, etc.). LCR ≥ 100% since 2019. A is a loan-to-deposit ratio. C describes a different liquidity ratio. D is the inverse loan-to-deposit ratio.
Question 21
What is the 'Net Stable Funding Ratio' (NSFR)?
Select an option first.
Correct answer: B — A Basel III requirement that banks maintain a stable funding structure over a 1-year horizon — NSFR = Available Stable Funding / Required Stable Funding ≥ 100%
Explanation: B is correct. NSFR: addresses medium-term funding stability (structural liquidity risk). ASF = stable funding available (retail deposits, long-term debt, equity). RSF = stable funding required (assets weighted by liquidity risk profile). NSFR ≥ 100% ensures assets are funded by stable liabilities. A inverts the concept. C and D are narrow liquidity measures.
Question 22
What is 'ICAAP' (Internal Capital Adequacy Assessment Process)?
Select an option first.
Correct answer: B — A bank's own internal process for assessing its capital needs, covering all material risks — including risks not fully captured by Pillar 1 (regulatory minimum capital), such as concentration risk, interest rate risk in banking book, and strategic risk
Explanation: B is correct. ICAAP (Pillar 2 of Basel): banks must assess their own capital adequacy across ALL material risks — going beyond Pillar 1 requirements. Supervisors review ICAAP outputs and can impose Pillar 2 add-ons. ILAAP (Internal Liquidity Adequacy Assessment Process) is the liquidity equivalent. A is an internal audit function. C is Pillar 1. D is too narrow.
Question 23
What is 'SREP' (Supervisory Review and Evaluation Process)?
Select an option first.
Correct answer: B — The regulator's (e.g., ECB, PRA) structured assessment of a bank's ICAAP and ILAAP, resulting in a Pillar 2 Requirement (P2R) capital add-on and Pillar 2 Guidance (P2G) — ensures capital held is sufficient relative to the bank's risk profile
Explanation: B is correct. SREP (under Basel Pillar 2): the regulator reviews the bank's capital and liquidity adequacy assessment, evaluates all material risks, and sets: P2R (binding minimum add-on above Pillar 1), P2G (guidance buffer). Banks falling below P2G face dividend restrictions. A is ICAAP. C is a product approval process. D is an external audit.
Question 24
What is 'climate risk' in the context of financial risk management?
Select an option first.
Correct answer: B — Physical climate risk (damage from extreme weather, sea-level rise) and transition risk (losses from policy, technology, or market shifts toward a low-carbon economy) — both can affect asset values, credit quality, and operational resilience of financial institutions
Explanation: B is correct. Climate risk has two components: (1) Physical risk: chronic (sea-level rise, temperature change) and acute (floods, wildfires) affecting collateral and operations; (2) Transition risk: carbon-intensive assets may become stranded; regulatory carbon pricing; market preference shifts. Regulators (ECB, PRA, Fed) now require climate risk assessment in stress tests. A is one transition risk element. C is a regulatory risk. D is ESG.
Question 25
What is a 'Key Risk Indicator' (KRI)?
Select an option first.
Correct answer: B — A forward-looking metric that provides early warning signals of increasing risk exposure or control failures — e.g., staff turnover rate (operational risk), volume of exception approvals (process control risk), near-miss incident rate
Explanation: B is correct. KRIs: proactive monitoring tools. Examples: IT system downtime %, customer complaint rate (reputational risk), leverage ratio trend (financial risk). Different from KPIs (performance) — KRIs focus on risk and control health. A is a performance indicator. C is a loss event analysis. D is a capital calculation.
Question 26
What is 'scenario analysis' in the context of ERM?
Select an option first.
Correct answer: B — A forward-looking risk assessment technique that evaluates potential future events (economic downturn, pandemic, cyber attack) and their potential financial and operational impact on the organisation
Explanation: B is correct. ERM scenario analysis: identifies plausible but severe future scenarios and models their impact (financial losses, operational disruption, reputational damage). Informs risk appetite, capital planning, and business continuity planning. A is historical loss data analysis. C is benchmarking. D is capital budgeting.
Question 27
What is 'operational resilience' and how does it differ from business continuity planning (BCP)?
Select an option first.
Correct answer: B — Operational resilience is the broader ability to prevent, adapt, respond to, recover, and learn from operational disruptions while continuing to deliver critical services — BCP is a specific component (recovery planning), while resilience is a continuous capability
Explanation: B is correct. Operational resilience (FCA/PRA definition): the ability to stay within 'impact tolerances' for critical services even during severe disruptions. BCP: specific response plans for defined disruption scenarios. Resilience is broader — it includes impact tolerance setting, scenario testing, and ongoing improvement. A conflates them. C and D are too narrow.
Question 28
What is 'cyber risk' as a risk category for financial institutions?
Select an option first.
Correct answer: B — The risk of loss resulting from cyberattacks, data breaches, ransomware, system failures, or insider threats affecting an institution's IT infrastructure and sensitive data — can cause financial loss, operational disruption, and reputational damage
Explanation: B is correct. Cyber risk: a major operational risk category. Types: data theft (customer data breach), ransomware (system lockdown), DDoS attacks (service disruption), insider threats (employee data theft/sabotage). Financial sector is the most targeted industry for cyberattacks. A describes technology dependency risk. C is technology obsolescence. D is algo/HFT risk.
Question 29
What is the 'three lines of defence' model in risk management governance?
Select an option first.
Correct answer: B — A governance model where: (1st) business units own and manage risk; (2nd) risk management and compliance functions provide oversight and challenge; (3rd) internal audit provides independent assurance — together ensuring comprehensive risk oversight
Explanation: B is correct. Three lines of defence: 1st line: business operations — takes and manages risk day-to-day. 2nd line: risk management (CRO, compliance) — sets policies, monitors, challenges. 3rd line: internal audit — independent review of effectiveness of 1st and 2nd lines. External audit is sometimes called the 4th line. A is not the model's purpose. C and D are incorrect descriptions.
Question 30
What is the role of a Chief Risk Officer (CRO)?
Select an option first.
Correct answer: B — Leading the firm's risk management function: developing risk strategy, overseeing risk measurement and reporting, advising the board on risk appetite, and ensuring all material risks are identified and managed within the firm's risk tolerances
Explanation: B is correct. CRO responsibilities: risk strategy (aligned with board), risk framework (policies, methods, limits), risk reporting (to board and senior management), capital management, regulatory dialogue, and enterprise risk oversight. A is a fund manager's role. C is the CCO. D is the CFO/Controller's role.
More free FRM topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.