I85PREP
⌘ K
CISI Operational Risk study materials
CISI Operational Risk study resources

CISI Operational Risk practice questions

One question at a time. Build your CISI Operational Risk understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Introduction to operational risk

In operational risk terminology, which definition best describes operational risk as used in the CISI framework?

  1. The risk that a counterparty will fail to settle a trade on the agreed value date
  2. The risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events Correct answer.
  3. The risk that a borrower's credit rating is downgraded after a loan is issued
  4. The risk that interest rate movements reduce the value of a trading book position

Explanation

Operational risk is defined around failures of internal processes, people, systems and external events, and it deliberately excludes strategic and reputational risk in the narrowest Basel-style definition. Credit, settlement and market risks are separate risk categories with their own capital treatments. Recognising the boundary is essential before allocating losses to the correct risk type.

Question 2Introduction to operational risk

A bank's operational risk framework classifies a loss caused by a rogue trader exceeding authorised limits as arising primarily from which risk driver?

  1. Systems outage
  2. External fraud by a third party
  3. People and internal process failure Correct answer.
  4. Legal change in the jurisdiction

Explanation

Limit breaches by staff are failures of people behaviour combined with weak internal controls and monitoring processes. The loss originates inside the firm rather than from an outside party, a technology failure or a change in law. Correct classification matters because it directs remediation towards supervision, segregation of duties and limit monitoring.

Question 3Introduction to operational risk

Which statement correctly distinguishes operational risk from strategic risk?

  1. Operational risk only applies to back-office functions, while strategic risk applies to the board
  2. Operational risk arises from day-to-day failures in processes, people and systems, while strategic risk arises from adverse business decisions or improper implementation of decisions Correct answer.
  3. Operational risk is always quantifiable, while strategic risk can never be measured in any way
  4. Strategic risk is a subset of operational risk captured within the Basel loss taxonomy

Explanation

The accepted boundary is that operational risk concerns execution failures in everyday activity, whereas strategic risk stems from business direction, competitive positioning and the implementation of major decisions. The Basel definition expressly excludes strategic and reputational risk. Both can be measured, so the claim that strategic risk is unmeasurable is incorrect.

Question 4Introduction to operational risk

Under the Basel operational risk framework, which event type category covers losses from employment practices and workplace safety?

  1. Execution, delivery and process management
  2. Damage to physical assets
  3. Clients, products and business practices
  4. Employment practices and workplace safety Correct answer.

Explanation

Employment practices and workplace safety is a standalone Level 1 event type covering discrimination claims, workers' compensation and similar staff-related losses. It is kept separate from execution and process failures, which concern transaction handling. Placing losses in the right category supports consistent external reporting and capital calculation.

Question 5Introduction to operational risk

A firm records a loss because a settlement instruction was keyed with the wrong account number, causing a failed delivery and buy-in cost. Which Basel Level 1 event type applies?

  1. Business disruption and system failures
  2. Clients, products and business practices
  3. Execution, delivery and process management Correct answer.
  4. External fraud

Explanation

Data entry errors and failed transaction processing fall squarely within execution, delivery and process management. The error is a processing mistake rather than deliberate deception, technology unavailability or a suitability issue. Accurate mapping to this category drives the right control improvements such as maker-checker and straight-through processing.

Question 6Introduction to operational risk

Which of the following best describes the role of a risk and control self-assessment (RCSA) within an operational risk framework?

  1. It is a pricing model used to charge clients for operational risk capital
  2. It is a backward-looking reconciliation of the general ledger to regulatory returns
  3. It replaces the need for capturing external loss data
  4. It is a forward-looking process in which business units identify risks, assess controls and rate residual exposure Correct answer.

Explanation

An RCSA is a structured, forward-looking exercise in which process owners identify inherent risks, evaluate the design and effectiveness of controls and record residual risk. It complements rather than replaces loss data and scenario analysis. It is not an accounting reconciliation or a client pricing tool.

Question 7Introduction to operational risk

A firm uses key risk indicators (KRIs) within its operational risk framework. Which characteristic makes an indicator most useful as an early warning tool?

  1. It is reported only after an annual audit has been completed
  2. It is measurable frequently and has a demonstrated link to a risk that precedes actual losses Correct answer.
  3. It measures the firm's share price volatility
  4. It is chosen because the data is easy to collect regardless of relevance

Explanation

Effective KRIs are quantifiable at a useful frequency and have a credible causal or statistical link to a risk event so they move before losses materialise. Convenience of data collection alone does not justify an indicator. Share price volatility reflects market perceptions rather than a specific operational risk driver.

Question 8Introduction to operational risk

In operational risk language, what does the term 'expected loss' refer to?

  1. The largest loss the firm could suffer in a stress scenario
  2. The average loss the firm anticipates from a risk over a defined period, often built into pricing and provisions Correct answer.
  3. The loss that has already been recorded in the current financial year
  4. The loss arising only from regulatory fines

Explanation

Expected loss is the statistical mean of the loss distribution for a given risk and horizon, and it is typically covered through pricing, provisioning and day-to-day controls. Unexpected loss and stress losses are distinct concepts used for capital. Historical recorded losses are actuals, not the expected measure.

Question 9Introduction to operational risk

Which of the following is the clearest example of an external event driver of operational risk?

  1. Insufficient training of new joiners
  2. A trader exceeding an authorised position limit
  3. A change in tax legislation requiring costly system reconfiguration Correct answer.
  4. A failure of the firm's internal reconciliation procedure

Explanation

External drivers originate outside the firm's control, such as legislative or regulatory change, natural disasters or third-party failures. Limit breaches, reconciliation failures and training gaps are internal people and process issues. Distinguishing external from internal drivers helps determine where mitigation is possible and where contingency planning is needed.

Question 10Introduction to operational risk

A firm wishes to use scenario analysis within its operational risk framework. What is the primary purpose of this technique?

  1. To confirm that historical losses will repeat exactly
  2. To calculate the firm's credit value at risk
  3. To estimate the potential impact of severe but plausible events that may be rare or absent from internal loss data Correct answer.
  4. To replace the internal audit function

Explanation

Scenario analysis brings together business experts to assess severe but plausible events, particularly where internal data is thin because the event is rare. It feeds capital assessment and contingency planning rather than replacing audit. It addresses operational risk, not credit value at risk.

Question 11Introduction to operational risk

Which control is best described as a detective control in an operational risk framework?

  1. Daily reconciliation of nostro accounts against bank statements Correct answer.
  2. Segregating trading from settlement duties
  3. Setting position limits in the trading system
  4. Requiring dual authorisation before a payment is released

Explanation

Detective controls identify problems after they occur, and reconciliation uncovers discrepancies that have already arisen. Dual authorisation, segregation of duties and position limits are preventive because they stop an error or abuse before it happens. A balanced control environment uses both types across each process.

Question 12Introduction to operational risk

A business unit reports that a key control is performed but no evidence of performance is retained. How should this be treated in a risk and control assessment?

  1. As irrelevant because controls do not need documentation
  2. As having a design and evidence weakness, which raises residual risk even if the control may be operating Correct answer.
  3. As fully effective because staff confirm it is done
  4. As an external event beyond the firm's control

Explanation

Without retained evidence, the firm cannot demonstrate that the control operated, so assurance is weakened and residual risk should be rated higher. Verbal confirmation alone is insufficient for audit or regulatory purposes. Documentation gaps are internal control weaknesses, not external events.

Question 13Introduction to operational risk

Which statement best explains why operational risk is often described as 'pervasive' across a financial firm?

  1. It arises in every business line and function, from front office to IT and HR Correct answer.
  2. It is confined to the compliance department
  3. It only materialises during market downturns
  4. It is managed solely through insurance

Explanation

Operational risk is pervasive because every process, system and person in the firm can generate it, so ownership must sit with each business line rather than one central team. It is not limited to compliance, nor is it only a downturn phenomenon. Insurance is one mitigation tool among several, not the sole response.

Question 14Introduction to operational risk

A firm's operational risk policy sets out risk appetite. Which description correctly captures the concept of operational risk appetite?

  1. The amount and type of operational risk the firm is willing to accept in pursuing its objectives Correct answer.
  2. The total number of staff employed in the risk function
  3. The list of all external auditors engaged by the firm
  4. The maximum profit the firm expects from its trading desk

Explanation

Risk appetite expresses the level and nature of operational risk the firm accepts while pursuing strategy, and it is usually articulated through tolerances and thresholds. It is not a profit target, a headcount measure or an audit arrangement. Clear appetite statements allow escalation when exposures approach limits.

Question 15Introduction to operational risk

Which of the following best describes the 'three lines of defence' model in operational risk governance?

  1. Risk is managed by the first line only, with no oversight or assurance
  2. The board, the regulator and the external auditor each manage risk in turn
  3. Business units own and manage risk, a risk and compliance function provides oversight, and internal audit provides independent assurance Correct answer.
  4. Front office, middle office and back office share identical risk responsibilities

Explanation

The model separates risk ownership in the business, independent oversight by a risk and compliance function, and independent assurance by internal audit. This structure avoids conflicts of interest and provides layered challenge. It is not a division between board, regulator and auditor, nor a front-middle-back office split.

Question 16Introduction to operational risk

An operations manager must decide whether to accept, mitigate, transfer or avoid a newly identified operational risk. Which factor is most relevant when deciding between mitigation and acceptance?

  1. The cost of the control relative to the reduction in expected loss and the firm's appetite Correct answer.
  2. The colour of the risk register template
  3. The length of the firm's annual report
  4. The number of staff in the internal audit team

Explanation

The decision should weigh the cost of the proposed control against the reduction in expected loss and whether the residual exposure fits within appetite. If mitigation costs exceed the benefit and the risk is within tolerance, acceptance may be justified. Register formatting and reporting length are irrelevant to the decision.

Question 17Introduction to operational risk

Which of the following is the most accurate description of how internal loss data is used in an operational risk framework?

  1. It is used solely to calculate market risk capital
  2. It replaces the need for risk and control self-assessments entirely
  3. It is collected only to satisfy external auditors and has no analytical use
  4. It provides evidence of actual events used to calibrate models, identify control gaps and track trends Correct answer.

Explanation

Internal loss data grounds the framework in observed events, supporting capital modelling, root-cause analysis and trend monitoring. It complements self-assessments and scenarios rather than replacing them. It relates to operational risk capital, not market risk capital.

Question 18Introduction to operational risk

A firm sets a threshold on a key risk indicator and defines escalation triggers. What is the main governance benefit of this arrangement?

  1. It allows the firm to ignore external loss events
  2. It ensures timely management action and accountability when risk levels deteriorate Correct answer.
  3. It removes the need for independent assurance
  4. It guarantees that no operational losses will occur

Explanation

Thresholds and escalation triggers convert monitoring into action by assigning responsibility when an indicator breaches tolerance. They support timely intervention but cannot eliminate losses. They supplement, rather than replace, assurance and external event monitoring.

Question 19Introduction to operational risk

A firm's operational risk taxonomy contains overlapping categories, and the same loss is being recorded under two event types. What is the most significant consequence for the framework?

  1. It automatically triggers a regulatory enforcement action
  2. It has no effect because taxonomies are purely descriptive
  3. It improves the accuracy of capital modelling
  4. It distorts loss aggregation, trend analysis and the allocation of remediation effort Correct answer.

Explanation

Overlapping categories cause double counting or misallocation, which undermines loss aggregation, comparative analysis and the targeting of control improvements. A clear, mutually exclusive taxonomy with defined boundaries is therefore essential. The issue is an internal data-quality weakness and does not by itself trigger enforcement.

Question 20Introduction to operational risk

Which combination best reflects the relationship between operational risk and reputational risk under the Basel definition?

  1. Reputational risk is expressly excluded from the Basel operational risk definition, though operational failures often damage reputation Correct answer.
  2. Operational risk and reputational risk are treated as identical concepts
  3. Reputational risk is the largest sub-category of operational risk losses
  4. Reputational risk is measured only through internal loss data

Explanation

The Basel definition of operational risk excludes strategic and reputational risk, recognising that reputation is a consequence rather than a directly managed event type. In practice, operational failures frequently cause reputational harm, so firms monitor the linkage. Reputational risk is not a loss sub-category and cannot be captured solely through internal loss data.

Question 21Operational risk in the context of enterprise risk management

In an enterprise risk management framework, how is operational risk most accurately positioned relative to credit and market risk?

  1. It is treated solely as a compliance matter and excluded from the risk appetite statement
  2. It is a sub-component of market risk that concerns trading settlement failures
  3. It is a residual category that applies only when credit and market risk limits are breached
  4. It is a distinct risk type arising from people, processes, systems and external events, cutting across all business lines Correct answer.

Explanation

Operational risk is defined by its sources - inadequate or failed internal processes, people, systems, and external events - rather than by a financial exposure category. Because it arises in every business line, it is managed as a cross-cutting risk type within the enterprise framework, alongside but separate from credit and market risk.

Question 22Operational risk in the context of enterprise risk management

A firm's board approves a statement setting the maximum acceptable operational losses and the types of operational risk it will not accept. What is this statement called?

  1. Key risk indicator threshold
  2. Operational risk appetite Correct answer.
  3. Business continuity objective
  4. Control self-assessment score

Explanation

Risk appetite expresses the amount and type of risk an organisation is willing to accept in pursuit of its objectives. For operational risk this typically combines tolerance for expected losses with explicit exclusions of unacceptable event types. Indicators and assessments are monitoring tools rather than statements of acceptable risk.

Question 23Operational risk in the context of enterprise risk management

Which three-lines model arrangement best reflects good practice for operational risk governance?

  1. The risk function owns all controls and the business units merely execute instructions
  2. The internal audit function owns the risk register while business units only report losses
  3. External auditors sit on the risk committee and approve the risk appetite annually
  4. The business owns and manages risk, a risk function sets frameworks and challenges, and internal audit provides independent assurance Correct answer.

Explanation

The three-lines model separates risk ownership from oversight and assurance. The first line (business) owns and manages risk day to day, the second line (risk and compliance) designs the framework and challenges, and the third line (internal audit) gives independent assurance to the board.

Question 24Operational risk in the context of enterprise risk management

In ERM terminology, what distinguishes inherent risk from residual risk for an operational process?

  1. Inherent risk is measured in currency while residual risk is measured in percentages
  2. Inherent risk applies only to external events and residual risk only to internal process failures
  3. Inherent risk is the exposure before controls are applied, while residual risk is the exposure remaining after controls operate Correct answer.
  4. Inherent risk is set by the regulator and residual risk by the firm's board

Explanation

Inherent risk describes the gross exposure of an activity if no controls were in place. Residual risk is what remains once existing controls have been applied, and it is the figure typically compared against risk appetite.

Question 25Operational risk in the context of enterprise risk management

A bank maps its operational risk universe into business lines and event types so that losses can be aggregated consistently. What is the primary purpose of this taxonomy?

  1. To allocate marketing budget across divisions
  2. To enable consistent identification, capture and comparison of operational risk exposures across the enterprise Correct answer.
  3. To replace the need for scenario analysis
  4. To determine individual staff bonuses

Explanation

A common taxonomy allows losses, incidents and assessments from different units to be captured and compared on a like-for-like basis. This supports aggregation, reporting and capital modelling within the ERM framework rather than serving commercial or remuneration purposes.

Question 26Operational risk in the context of enterprise risk management

Which statement best describes the relationship between operational risk management and a firm's overall enterprise risk management framework?

  1. Operational risk is managed in isolation because it cannot be aggregated with other risks
  2. Operational risk replaces the ERM framework in firms with high transaction volumes
  3. Operational risk is only relevant to back-office functions
  4. Operational risk is one component within an integrated framework that aggregates and reports risks against a common appetite Correct answer.

Explanation

ERM provides the overarching structure of governance, appetite, aggregation and reporting into which individual risk types fit. Operational risk is one such component, measured and reported consistently with the others so that the board sees an integrated risk profile.

Question 27Operational risk in the context of enterprise risk management

A firm's operational risk policy requires that any new product be assessed for operational risk before launch. Which ERM principle does this requirement most directly reflect?

  1. Risk transfer should precede risk identification
  2. Risk should be reported only after losses have occurred
  3. Risk appetite should be reviewed only during an annual audit
  4. Risk should be identified and assessed at the point where it is created, before exposure is taken Correct answer.

Explanation

Embedding risk assessment into change and product approval processes ensures risk is identified when it is created rather than after losses emerge. This forward-looking, front-line identification is a core ERM principle that links decision-making to the risk framework.

Question 28Operational risk in the context of enterprise risk management

An operational risk committee receives a dashboard showing that a key risk indicator has breached its amber threshold for three consecutive months. What is the most appropriate ERM response?

  1. Wait for the annual risk review to consider the trend
  2. Immediately close the indicator because amber is not a breach
  3. Escalate the trend, investigate root causes and require a remediation plan from the accountable owner Correct answer.
  4. Remove the indicator from the dashboard to avoid noise

Explanation

A sustained breach indicates deteriorating control effectiveness and should trigger escalation, root-cause analysis and an owned remediation plan. Monitoring only has value if thresholds prompt action proportionate to the trend.

Question 29Operational risk in the context of enterprise risk management

A firm decides to buy insurance against fraud losses. Within the ERM framework, how should this decision be characterised?

  1. Risk reduction through control improvement
  2. Risk transfer, which changes the loss profile but does not eliminate the underlying risk Correct answer.
  3. Risk avoidance, because the firm no longer bears the fraud exposure
  4. Risk acceptance, because insurance is a cost of doing business

Explanation

Insurance transfers a defined portion of financial loss to a third party but does not remove the underlying operational risk or its reputational and conduct consequences. It is therefore a transfer treatment used alongside controls, not an avoidance or acceptance of the risk itself.

Question 30Operational risk in the context of enterprise risk management

During a scenario analysis workshop, a team estimates the impact of a prolonged outage of a critical payment system. Which ERM output does this exercise most directly support?

  1. Assessing tail operational risk exposure and informing capital and continuity planning Correct answer.
  2. Confirming the accuracy of the prior year's financial statements
  3. Selecting new suppliers for the procurement function
  4. Setting the firm's dividend policy

Explanation

Scenario analysis explores plausible but severe events to estimate tail exposures that historical loss data may not capture. Its outputs feed capital assessment, risk appetite calibration and business continuity planning within the ERM framework.

Question 31Operational risk in the context of enterprise risk management

A business unit argues that because its operational losses last year were below budget, its risk profile is acceptable. Which ERM critique of this reasoning is most valid?

  1. Historical loss experience alone may understate exposure to low-frequency, high-severity events Correct answer.
  2. Losses below budget prove that all controls are effective
  3. Budget variances are the primary measure of operational risk under ERM
  4. Operational risk can be fully captured by accounting profit

Explanation

Operational risk includes rare but severe events that may not appear in a single year's loss history. Relying only on past losses ignores tail exposure, near misses and emerging risks, so ERM combines loss data with indicators, scenarios and control assessments.

Question 32Operational risk in the context of enterprise risk management

Which pairing of an operational risk cause with an appropriate ERM treatment is most coherent?

  1. System outage risk - increase the marketing budget for the affected product
  2. Frequent small payment errors - purchase directors' and officers' liability insurance
  3. High staff turnover in a control function - introduce retention incentives and cross-training to reduce key-person dependency Correct answer.
  4. External fraud - reduce the number of internal audit reviews

Explanation

Treatments should address the specific cause identified. Retention incentives and cross-training directly mitigate key-person dependency arising from turnover, reducing both likelihood and impact of control failures.

Question 33Operational risk in the context of enterprise risk management

A firm's risk register lists a control as 'effective' but no evidence of testing is recorded. How should an ERM reviewer treat this entry?

  1. Delete the control from the register to avoid confusion
  2. Reclassify the risk as a market risk
  3. Accept it, because the business owner has asserted effectiveness
  4. Treat the control as unproven and require testing evidence before relying on it to reduce residual risk Correct answer.

Explanation

Residual risk assessments depend on controls actually operating as intended, which requires evidence such as testing or monitoring results. An untested assertion is not sufficient assurance, so the control should be treated as unproven until evidence is obtained.

Question 34Operational risk in the context of enterprise risk management

In an ERM framework, what is the main purpose of aggregating operational risk information across business lines?

  1. To calculate individual employee performance ratings
  2. To eliminate the need for business-level risk ownership
  3. To ensure each unit reports independently without comparison
  4. To give senior management and the board a consolidated view of exposures and concentrations against appetite Correct answer.

Explanation

Aggregation allows the firm to see total exposure, concentrations and correlations that are invisible at business-unit level. This consolidated view supports board oversight and comparison of the overall profile against the approved risk appetite.

Question 35Operational risk in the context of enterprise risk management

A regulator asks a firm to demonstrate that its operational risk appetite is operationalised rather than merely stated. Which evidence most convincingly shows this?

  1. A schedule of upcoming board meetings
  2. A glossy appetite statement published on the corporate website
  3. Documented limits, escalation triggers and decision records showing appetite has constrained business choices Correct answer.
  4. A list of all risk types the firm has identified

Explanation

An appetite is operationalised when it is translated into limits and triggers and actually influences decisions, with records showing escalation and action. Documentation of that linkage demonstrates the statement has practical effect rather than being aspirational.

Question 36Operational risk in the context of enterprise risk management

A firm uses a heat map to present its operational risk profile to the board. What is a recognised limitation of this tool within ERM reporting?

  1. It cannot display more than one risk at a time
  2. It is only permitted for external reporting
  3. Its likelihood and impact bands can conceal the precision of underlying estimates and the quality of data Correct answer.
  4. It automatically eliminates the need for narrative commentary

Explanation

Heat maps summarise risks into broad likelihood and impact bands, which can obscure measurement uncertainty, data quality and the scale of differences between risks. Boards therefore need supporting narrative and quantitative detail alongside the visual.

Question 37Operational risk in the context of enterprise risk management

A firm's operational risk framework identifies a control gap, and management chooses to retain the exposure because the cost of remediation exceeds the expected loss. Which ERM concept does this decision illustrate, and what condition should accompany it?

  1. Risk avoidance, conditional on ceasing the activity entirely
  2. Risk ignorance, conditional on removing the risk from the register
  3. Risk transfer, conditional on purchasing insurance
  4. Deliberate risk acceptance, conditional on documented rationale and ongoing monitoring against appetite Correct answer.

Explanation

Knowingly retaining a risk within appetite is a valid treatment decision, but it must be documented with rationale and monitored so that the exposure remains within tolerance. Undocumented retention is indistinguishable from poor governance.

Question 38Operational risk in the context of enterprise risk management

A group operates in several jurisdictions and wants a single operational risk taxonomy while allowing local regulators to require additional event categories. What design approach best satisfies both needs?

  1. Let each subsidiary design an entirely separate taxonomy with no group mapping
  2. Abandon the group taxonomy and rely on external loss databases only
  3. Use a common core taxonomy with permitted local extensions mapped back to group categories for aggregation Correct answer.
  4. Impose the group taxonomy unchanged and ignore local requirements

Explanation

A common core with controlled local extensions preserves comparability for group aggregation while accommodating regulatory differences. Mapping extensions back to core categories ensures consolidated reporting remains coherent.

Question 39Operational risk in the context of enterprise risk management

A board is reviewing an operational risk report that shows improving loss trends but rising near-miss volumes and control-testing failures. What is the most defensible ERM interpretation?

  1. The improving loss trend confirms the risk profile is strengthening
  2. Control-testing failures are irrelevant while actual losses remain low
  3. Leading indicators suggest deteriorating control effectiveness that may precede future losses, so the profile should be treated as worsening Correct answer.
  4. Near misses should be excluded from board reporting as they cause no loss

Explanation

Near misses and control-testing failures are leading indicators of control weakness, and rising volumes can foreshadow future losses even while lagging loss data look benign. A sound ERM view weights both leading and lagging information rather than relying on the loss trend alone.

Question 40Operational risk in the context of enterprise risk management

An internal audit report finds that the second line challenges first-line risk assessments only occasionally and that the risk committee rarely records dissent. Which ERM weakness is most significant here?

  1. Over-reliance on scenario analysis in capital modelling
  2. Too frequent escalation of breaches to the board
  3. Insufficient constructive challenge, which risks unchallenged optimism in risk assessments and residual ratings Correct answer.
  4. Excessive independence between the three lines

Explanation

Effective ERM depends on robust challenge from the second line and documented debate at committee level. Where challenge is rare and dissent is not recorded, assessments may reflect optimism bias and residual ratings may be overstated in their effectiveness.

Question 41The regulatory framework and capital requirements for operational risk

Under the Basel framework, which approach to operational risk capital allows a firm to use its own internal loss data and risk estimates, subject to supervisory approval?

  1. The Advanced Measurement Approach Correct answer.
  2. The Basic Indicator Approach
  3. The Simplified Approach
  4. The Standardised Approach

Explanation

The Advanced Measurement Approach permits a bank, with supervisory approval, to calculate operational risk capital using its own internal measurement system, including internal loss data, scenario analysis, business environment factors and control factors. The Basic Indicator and Standardised Approaches rely on gross income as a proxy rather than the firm's own risk estimates.

Question 42The regulatory framework and capital requirements for operational risk

In the Basic Indicator Approach, operational risk capital is calculated by applying what percentage to the average annual gross income of the previous three years?

  1. 20%
  2. 15% Correct answer.
  3. 12%
  4. 18%

Explanation

The Basic Indicator Approach sets capital equal to 15% of the average annual gross income over the preceding three years, counting only years with positive gross income. This single alpha factor is the simplest supervisory proxy for operational risk exposure.

Question 43The regulatory framework and capital requirements for operational risk

A bank subject to the Standardised Approach maps its activities to eight business lines. Which of the following is one of those Basel business lines?

  1. Insurance Underwriting
  2. Retail Brokerage
  3. Wealth Management
  4. Payment and Settlement Correct answer.

Explanation

The Basel Standardised Approach specifies eight business lines: corporate finance, trading and sales, retail banking, commercial banking, payment and settlement, agency services, asset management, and retail brokerage. Payment and settlement is therefore a recognised business line, while the other listed terms are not part of that eight-line taxonomy.

Question 44The regulatory framework and capital requirements for operational risk

A firm using the Standardised Approach has three consecutive years of gross income of 100m, -20m and 80m in a business line. How is the average gross income for that line normally calculated for capital purposes?

  1. (100 - 20 + 80) / 3
  2. (100 + 80) / 3
  3. (100 - 20 + 80) / 2
  4. (100 + 80) / 2 Correct answer.

Explanation

Under the Standardised Approach, negative gross income in any year is excluded from both the numerator and the denominator, so the average is taken only over positive-income years. Here the average is (100 + 80) / 2 = 90m, not a figure that includes the loss year.

Question 45The regulatory framework and capital requirements for operational risk

Which Basel business line carries the highest beta factor under the Standardised Approach?

  1. Asset Management
  2. Commercial Banking
  3. Retail Banking
  4. Trading and Sales Correct answer.

Explanation

Trading and Sales carries a beta of 18%, the highest of the eight business lines, reflecting the greater operational risk intensity of trading activity. Retail banking and commercial banking carry lower betas, and asset management sits at 12%.

Question 46The regulatory framework and capital requirements for operational risk

Under the Basel II operational risk framework, which of the following is explicitly identified as a type of operational risk loss event?

  1. Losses from damage to physical assets Correct answer.
  2. Losses from adverse movements in foreign exchange rates
  3. Losses from a counterparty failing to repay a loan
  4. Losses from changes in market interest rates

Explanation

Damage to physical assets is one of the seven Basel operational risk event types, alongside internal fraud, external fraud, employment practices and workplace safety, clients products and business practices, business disruption and system failures, and execution delivery and process management. Market and credit losses fall outside the operational risk definition.

Question 47The regulatory framework and capital requirements for operational risk

A bank's internal fraud event type under the Basel taxonomy covers acts involving at least one internal party that are intended to defraud. Which situation best fits this category?

  1. A trader deliberately misstates a position to hide a loss Correct answer.
  2. A fire destroys a data centre
  3. A hacker breaches the bank's systems from outside
  4. A customer uses a counterfeit banknote at a branch

Explanation

Internal fraud involves intentional misappropriation, circumvention of regulation or company policy, or deliberate misreporting by an internal party. A trader misstating a position to conceal a loss is a classic internal fraud example, whereas external attacks and physical damage fall into other event types.

Question 48The regulatory framework and capital requirements for operational risk

The Basel Committee's Principles for the Sound Management of Operational Risk require the board of directors to do which of the following?

  1. Personally sign off every operational loss event
  2. Approve the operational risk appetite and oversee the framework Correct answer.
  3. Set individual trader position limits daily
  4. Delegate all operational risk oversight to external auditors

Explanation

The principles place ultimate responsibility for operational risk management with the board, which should approve and periodically review the operational risk appetite and framework and oversee senior management's implementation. Day-to-day activity such as trade-level limits belongs to management, not the board.

Question 49The regulatory framework and capital requirements for operational risk

Under the Basel principles, the 'three lines of defence' model assigns independent review and challenge of operational risk management to which function?

  1. The compliance helpdesk
  2. The treasury dealing desk
  3. The internal audit function Correct answer.
  4. The front-office business units

Explanation

In the three lines of defence model, the business owns and manages risk in the first line, an independent risk and compliance function provides oversight in the second line, and internal audit provides independent assurance in the third line. Internal audit therefore delivers the independent review and challenge.

Question 50The regulatory framework and capital requirements for operational risk

Which of the following best describes the role of scenario analysis in an Advanced Measurement Approach to operational risk capital?

  1. It is used only for market risk capital calculations
  2. It replaces the need for any internal loss data
  3. It sets the beta factors for each business line
  4. It captures severe but rare events that historical data may not reflect Correct answer.

Explanation

Scenario analysis is a forward-looking tool used within the AMA to estimate the potential impact of severe or rare events, including tail events that a firm's internal loss history may not capture. It complements rather than replaces internal and external loss data.