I85PREP
⌘ K
HKIB ECF-Operational Risk Core study materials
HKIB ECF-Operational Risk Core study resources

HKIB ECF-Operational Risk Core practice questions

One question at a time. Build your HKIB ECF-Operational Risk Core understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Operational Risk Management

Under the three-lines-of-defence model as applied in a Hong Kong bank's operational risk framework, which function is primarily responsible for independently challenging the adequacy of the operational risk framework and reporting on it to the board?

  1. The operational risk management function within the second line Correct answer.
  2. The external auditor engaged for the annual statutory audit
  3. The internal audit function
  4. The front-office business units that own the processes

Explanation

In the three-lines model the second line, which includes operational risk management, sets the framework, monitors it and provides independent challenge to the business. Internal audit is the third line and gives assurance on the framework rather than owning or challenging it day to day. External auditors provide an opinion on financial statements, not on internal operational risk governance.

Question 2Operational Risk Management

A bank classifies an incident as a 'near miss' rather than an actual operational risk loss. Which characteristic best distinguishes a near miss in an operational risk taxonomy?

  1. The event occurred but was intercepted before any financial loss or gain materialised Correct answer.
  2. The event affected only reputational rather than financial impact
  3. The event caused a loss below the bank's internal reporting threshold
  4. The event was detected by internal audit rather than by the business line

Explanation

A near miss is an operational risk event that was prevented or interrupted before it produced a loss, so it carries no financial impact but still signals control weakness. Loss-threshold events are still actual losses, merely small ones. Reputational impact and the detecting function do not define the near-miss category.

Question 3Operational Risk Management

Which Basel event-type category would capture losses arising from the accidental release of confidential customer data caused by a staff member emailing a file to the wrong recipient?

  1. Business disruption and system failures
  2. Damage to physical assets
  3. Clients, products and business practices
  4. Execution, delivery and process management Correct answer.

Explanation

Execution, delivery and process management covers failed processing, documentation and data-entry errors, including inadvertent disclosure of client information by staff. Clients, products and business practices covers deliberate or negligent misconduct toward clients and market impropriety. Physical damage and system failure categories require those specific causes.

Question 4Operational Risk Management

In the Basel operational risk capital framework, which approach calculates the capital charge by applying a single fixed percentage to a bank's average annual gross income over three years?

  1. The Basic Indicator Approach Correct answer.
  2. The Advanced Measurement Approach
  3. The Standardised Approach
  4. The internal ratings-based approach

Explanation

The Basic Indicator Approach applies a fixed alpha of 15 per cent to the average positive gross income over the preceding three years. The Standardised Approach applies different betas to business lines, and the Advanced Measurement Approach uses a bank's own models. The internal ratings-based approach is a credit risk methodology.

Question 5Operational Risk Management

A bank uses a loss-distribution approach for operational risk capital and calibrates the severity distribution to a very high confidence level. Which effect does raising the confidence level of the aggregate loss distribution have on the resulting capital estimate?

  1. It has no effect because capital depends only on expected losses
  2. It reduces the capital estimate because fewer scenarios are captured
  3. It changes the capital estimate only if the frequency distribution is Poisson
  4. It increases the capital estimate because a more remote tail percentile is used Correct answer.

Explanation

Capital under a loss-distribution approach is typically read at a high percentile of the aggregate loss distribution, such as 99.9 per cent. Raising the confidence level moves the reading further into the tail, so the required capital rises. Expected loss alone does not determine the tail-based capital figure, and the frequency assumption does not negate the tail effect.

Question 6Operational Risk Management

Which statement best describes the purpose of a Risk and Control Self-Assessment (RCSA) in an operational risk programme?

  1. It documents the business units' own view of inherent risk, control effectiveness and residual risk Correct answer.
  2. It replaces the need for collecting internal loss data
  3. It is the primary tool for allocating regulatory capital across legal entities
  4. It records external loss events for benchmarking against peers

Explanation

An RCSA is a structured exercise in which process owners identify inherent risks, assess the design and performance of controls, and derive residual risk. It complements rather than replaces loss data, and it is not a capital-allocation or external-data tool. External loss data is gathered separately for benchmarking.

Question 7Operational Risk Management

A treasury desk has a control requiring dual authorisation of large payments, but during a staffing shortage one dealer both initiates and releases a payment. Which control attribute has most directly failed?

  1. Control design, because segregation of duties was not enforced in operation Correct answer.
  2. Control testing frequency, because the control was tested too rarely
  3. Key risk indicator thresholds, because the indicator was not breached
  4. Risk appetite, because the payment exceeded the desk's limit

Explanation

The control was designed with dual authorisation, but it failed in operation because segregation of duties was not actually enforced during the shortage. This is an operating effectiveness failure rather than a design flaw in the control itself. Testing frequency, risk appetite and indicator thresholds are separate concepts that do not describe this breakdown.

Question 8Operational Risk Management

Which item is the most appropriate example of a Key Risk Indicator (KRI) for monitoring operational risk in a retail payments processing unit?

  1. The bank's tier-one capital ratio
  2. The number of payment instructions manually repaired per 1,000 processed Correct answer.
  3. The percentage of the loan book rated substandard
  4. The average tenure of the unit's senior managers

Explanation

A KRI should be a forward-looking metric that tracks a driver of operational risk exposure, such as the rate of manual repairs indicating process fragility. The capital ratio is a financial strength measure, and the substandard-loan percentage is a credit risk indicator. Management tenure is at best a weak contextual factor.

Question 9Operational Risk Management

In operational risk scenario analysis, what is the primary role of subject-matter experts from the business?

  1. To estimate the likelihood and impact of severe but plausible events that may be absent from internal loss data Correct answer.
  2. To conduct the independent audit of the risk framework
  3. To approve the bank's annual capital plan
  4. To validate the bank's published financial statements

Explanation

Scenario analysis draws on expert judgement to assess severe but plausible events, especially tail events that internal loss data may not yet capture. It feeds the capital and risk-management process but is not a financial-statement validation, capital-plan approval or audit activity. Those tasks belong to other functions.

Question 10Operational Risk Management

A bank sets a risk appetite statement for operational risk that specifies a maximum tolerable level of losses from process failures. Which element is essential for the statement to be operationally useful?

  1. Quantified thresholds or limits against which actual performance can be measured and escalated Correct answer.
  2. A requirement that no operational losses ever occur
  3. A list of all historical loss events by business line
  4. A qualitative statement that the bank seeks to minimise all operational losses

Explanation

A useful operational risk appetite statement combines qualitative direction with quantified thresholds or limits so that actual exposures can be measured, monitored and escalated. A vague commitment to minimise losses or a zero-loss aspiration cannot be measured. A historical loss list is supporting data, not the appetite statement itself.

Question 11Operational Risk Management

Which of the following best describes the purpose of the operational risk loss database within a bank's framework?

  1. To record only losses above the regulatory reporting threshold
  2. To replace scenario analysis and external data entirely
  3. To store customer complaints for marketing analysis
  4. To capture, classify and analyse internal loss events to inform control improvement and capital modelling Correct answer.

Explanation

The internal loss database collects and classifies loss events so that root causes can be analysed, controls improved and severity and frequency parameters estimated for capital models. It captures events across thresholds, not only large regulatory-reportable ones, and it complements rather than replaces scenario and external data. Customer complaint storage for marketing is unrelated.

Question 12Operational Risk Management

A bank wants to reduce its operational risk exposure from a newly outsourced back-office function. Which action most directly addresses the residual operational risk arising from the vendor relationship?

  1. Including contractual service levels, audit rights and ongoing vendor performance monitoring in the arrangement Correct answer.
  2. Relying solely on the vendor's own published risk disclosures
  3. Transferring all responsibility for the process to the vendor and ceasing oversight
  4. Removing the process from the bank's risk register because it is now external

Explanation

Outsourcing transfers activity but not accountability, so the bank must manage residual vendor risk through service levels, audit rights and continuous performance monitoring. Ceasing oversight or deleting the process from the risk register leaves the bank exposed. Vendor disclosures alone are insufficient for effective oversight.

Question 13Operational Risk Management

Which change is most likely to increase a bank's operational risk profile in a branch network?

  1. Rotating staff between branches under an established cross-training programme
  2. Increasing the frequency of independent reconciliation checks
  3. Tightening the maker-checker rules on cash transactions
  4. Introducing a new core banking system without adequate parallel running and user training Correct answer.

Explanation

Major system changes without parallel running and training raise the likelihood of processing errors, outages and control breakdowns, increasing operational risk. Staff rotation under a structured programme, more frequent reconciliations and tighter maker-checker rules generally strengthen controls and reduce risk.

Question 14Operational Risk Management

A bank defines its operational risk taxonomy using the Basel event types. Why is a consistent taxonomy important for aggregating operational risk information across business units?

  1. It sets the regulatory capital formula for the bank
  2. It guarantees that no future loss events will occur
  3. It removes the need for internal loss data collection
  4. It enables comparable classification, aggregation and analysis of events across the organisation Correct answer.

Explanation

A consistent taxonomy lets events from different units be classified comparably, aggregated for reporting and analysed for patterns and capital modelling. It does not prevent future events, replace loss data collection or determine the capital formula, which is set by the chosen approach and regulatory rules.

Question 15Operational Risk Management

An operational risk manager is reviewing a business unit's risk register and finds that a high inherent risk is recorded with a residual risk assessed as low solely because a single key control is believed effective. What is the most appropriate challenge?

  1. Reclassify the risk as a credit risk instead
  2. Remove the risk from the register because residual risk is low
  3. Accept the residual rating because one effective control is always sufficient
  4. Request evidence of the control's operating effectiveness and consider the impact if the control fails Correct answer.

Explanation

Second-line challenge should test whether the key control actually operates effectively and consider the consequence of control failure, since reliance on a single control creates concentration risk. Accepting the rating without evidence, removing the risk or reclassifying it as credit risk are all inappropriate responses.

Question 16Operational Risk Management

Which statement correctly describes the relationship between expected loss and unexpected loss in operational risk management?

  1. Unexpected loss is managed only through insurance and never through capital
  2. Expected loss is covered through pricing and provisioning, while unexpected loss is the focus of capital Correct answer.
  3. Expected loss is always zero because operational losses are unpredictable
  4. Expected and unexpected loss are identical concepts in operational risk

Explanation

Expected loss represents the average anticipated level of operational losses and is generally addressed through business pricing and provisions. Unexpected loss, the variability around that average, is what regulatory and economic capital are designed to absorb. Insurance can mitigate certain losses but is not the sole treatment for unexpected loss.

Question 17Operational Risk Management

A bank's operational risk policy requires that all operational risk events above a defined threshold be reported within a set number of days. Which control objective does this reporting deadline primarily support?

  1. Reduction of the bank's credit exposure to borrowers
  2. Elimination of the need for root-cause analysis
  3. Maximisation of the bank's capital base
  4. Timely escalation and remediation of significant events Correct answer.

Explanation

A reporting deadline ensures significant events reach management quickly so that escalation, root-cause analysis and remediation can begin promptly. It does not increase capital, remove the need for root-cause analysis, or affect credit exposure to borrowers. Timeliness is a governance and escalation control.

Question 18Operational Risk Management

A bank is considering purchasing insurance to mitigate operational risk. Which limitation should the bank recognise when relying on insurance as a risk mitigant?

  1. Insurance may not cover all event types, has policy limits and involves claims and payout uncertainty Correct answer.
  2. Insurance only applies to credit risk exposures
  3. Insurance is prohibited under the Basel operational risk framework
  4. Insurance eliminates all residual operational risk immediately

Explanation

Insurance can transfer some operational risk but coverage is often incomplete, subject to limits and exclusions, and payouts may be delayed or disputed. It does not eliminate residual risk, is recognised rather than prohibited under Basel, and is not confined to credit risk.

Question 19Operational Risk Management

Which of the following is the best example of a preventive control in an operational risk framework for a wire-transfer process?

  1. An annual review of the operational risk policy
  2. A monthly report of loss events to the risk committee
  3. A mandatory callback verification before a transfer is released Correct answer.
  4. A daily reconciliation that detects breaks after settlement

Explanation

A callback verification stops an erroneous or fraudulent transfer before it is released, so it prevents the loss. Daily reconciliation and loss reporting detect events after they occur, and an annual policy review is a governance activity rather than a transaction-level preventive control.

Question 20Operational Risk Management

A bank's operational risk function reports a rising trend in the number of failed straight-through-processing transactions. Which response best reflects sound operational risk management?

  1. Investigate the root cause, assess control gaps and track a remediation plan with owners and deadlines Correct answer.
  2. Reclassify the failures as technology risk outside the operational risk framework
  3. Increase the loss reporting threshold so fewer failures are recorded
  4. Wait for the annual audit to identify the root cause

Explanation

A rising trend in processing failures is a warning indicator that should trigger root-cause investigation, control-gap assessment and a tracked remediation plan with clear ownership. Waiting for audit, raising the reporting threshold to hide failures or reclassifying the issue outside the framework all suppress rather than manage the risk.

Question 21Operational Risk Management

In the context of operational risk governance, what is the primary function of a board-level risk committee?

  1. Executing daily transaction controls in the business lines
  2. Overseeing the bank's risk profile and approving the operational risk framework and appetite Correct answer.
  3. Preparing the bank's statutory financial statements
  4. Conducting the internal audit of operational risk controls

Explanation

A board-level risk committee provides oversight of the bank's risk profile and approves the framework and appetite within its mandate. Daily control execution belongs to the first line, financial statements to finance, and internal audit to the third line. The committee's role is oversight and approval, not operational execution.

Question 22Operational Risk Management

A bank uses external loss data to supplement its internal data. What is the main benefit of this practice for operational risk management?

  1. It guarantees that the bank's own losses will fall
  2. It replaces the need for scenario analysis workshops
  3. It provides information on severe events that the bank may not yet have experienced Correct answer.
  4. It sets the bank's regulatory capital floor directly

Explanation

External loss data broadens the evidence base, giving insight into severe tail events that may be rare or absent internally, which supports scenario design and model calibration. It does not guarantee lower losses, replace scenario analysis or directly set a capital floor.

Question 23Operational Risk Management

Which situation best illustrates a conflict of interest that weakens the independence of an operational risk control function?

  1. The operational risk function reports to the board risk committee on framework adequacy
  2. The head of a trading desk also approves the operational risk limits for that same desk Correct answer.
  3. The compliance function monitors conduct against regulatory requirements
  4. The internal audit function reports to the audit committee

Explanation

Independence is compromised when the person accountable for taking a risk also approves the limits governing that risk, since they can set limits to suit their own objectives. Reporting lines to board committees and separate compliance monitoring preserve independence rather than undermine it.

Question 24Operational Risk Management

A bank is designing key control indicators (KCIs) to complement its KRIs. Which measure is the best example of a KCI for a loan-documentation process?

  1. The average credit score of new borrowers
  2. The number of new loan products launched in the year
  3. The percentage of loan files that passed a quality review with complete documentation Correct answer.
  4. The bank's net interest margin

Explanation

A key control indicator measures how well a control is performing, such as the pass rate of documentation quality reviews. Net interest margin is a financial performance measure, product launches are business activity, and average credit score is a credit risk characteristic rather than a control performance measure.

Question 25Operational Risk Management

A bank's operational risk capital model relies heavily on a small number of internal high-severity losses. Which concern should the model validation team raise?

  1. The model should be replaced by the Basic Indicator Approach in all cases
  2. The model may be over-reliant on sparse data, making capital estimates unstable and sensitive to single events Correct answer.
  3. The model should ignore severity and use only frequency
  4. The model is invalid because operational risk cannot be modelled

Explanation

When severity estimation rests on very few large losses, the resulting capital figure is highly sensitive to individual events and statistically unstable. This is a data-sufficiency concern that scenario analysis and external data can help address. Operational risk can be modelled, severity cannot simply be discarded, and the Basic Indicator Approach is not automatically required.

Question 26Operational Risk Management

Under the three-lines-of-defence model used in operational risk management, which group forms the first line of defence against operational losses?

  1. The internal audit function reporting to the audit committee
  2. The external regulator's supervisory review team
  3. The business units and process owners who run the activity and own its risks Correct answer.
  4. The independent operational risk oversight function

Explanation

The first line of defence is the business itself: the staff and managers who execute processes own the risks and the controls embedded in those processes. Independence is achieved by keeping oversight and audit functions separate from that day-to-day ownership.

Question 27Operational Risk Management

In operational risk terminology, which pair correctly matches a cause with a resulting event?

  1. A fall in interest rates leading to lower net interest margin
  2. A market price movement leading to a trading loss
  3. A credit default leading to a loan loss provision
  4. Inadequate staff training leading to a processing error Correct answer.

Explanation

Operational risk concerns losses from failed or inadequate internal processes, people, systems or external events, so a training gap causing a processing error is a classic cause-and-event link. The other pairs describe credit or market risk exposures, which sit outside the operational risk definition.

Question 28Operational Risk Management

A bank classifies an operational loss event. Which Basel event type category best captures losses arising from employment practices and workplace safety?

  1. Employment practices and workplace safety Correct answer.
  2. Execution, delivery and process management
  3. Clients, products and business practices
  4. Damage to physical assets

Explanation

The Basel event-type taxonomy has a dedicated category for employment practices and workplace safety, covering issues such as discrimination claims, workers' compensation and employee relations. Matching events to the correct category keeps loss data comparable for internal and external reporting.

Question 29Operational Risk Management

What does the term 'inherent risk' mean when a business unit completes an operational risk assessment?

  1. The level of risk before any controls or mitigants are applied Correct answer.
  2. The risk arising only from external fraud
  3. The residual risk remaining after controls are tested
  4. The risk that is transferred to an insurer

Explanation

Inherent risk is the gross exposure of an activity assuming no controls are in place, which gives a baseline for judging how much mitigation the controls provide. Comparing it with residual risk shows whether the control environment is effective.

Question 30Operational Risk Management

Which item is a loss recovery rather than a loss mitigation technique applied before an event?

  1. Staff anti-fraud awareness training
  2. A mandatory dual-check control on payment instructions
  3. Segregation of duties in the reconciliation team
  4. Reinsurance proceeds received after a fire damaged a branch Correct answer.

Explanation

Recoveries are amounts recovered after a loss has occurred, such as insurance proceeds or restitution from a fraudster, and they reduce net loss rather than preventing the event. Controls and training act before or during the event to reduce the likelihood or impact.

Question 31Operational Risk Management

Which document typically records each identified operational risk, its owner, the related controls and the assessed residual rating?

  1. The liquidity coverage ratio report
  2. The auditor's management letter
  3. The operational risk register Correct answer.
  4. The capital adequacy return

Explanation

The risk register is the working inventory that links each risk to an accountable owner, the controls that address it and the assessed residual exposure. It is the core artefact through which business units manage and report their operational risks.

Question 32Operational Risk Management

A bank records an operational loss event and must decide what 'near miss' reporting adds to its framework. Which statement best describes a near miss?

  1. An event that was intercepted before it caused a loss but revealed a control weakness Correct answer.
  2. A loss that has been fully recovered from an insurer
  3. A loss event that falls below the reporting threshold
  4. An error that affected only the bank's regulatory capital

Explanation

A near miss is an incident that could have caused loss but was caught in time, so capturing it exposes weaknesses that might otherwise stay hidden. Including near misses gives early warning and strengthens learning before a real loss occurs.

Question 33Operational Risk Management

Which statement best describes the role of an operational risk appetite statement within a bank's framework?

  1. It sets the level of operational risk the bank is willing to accept in pursuing its objectives Correct answer.
  2. It lists the individual transactions that require dual authorisation
  3. It fixes the exact capital charge the regulator will impose
  4. It replaces the need for a risk register in each business unit

Explanation

A risk appetite statement expresses the amount and type of operational risk the board is prepared to tolerate, guiding limits and escalation thresholds. It is a governance tool that frames decisions rather than a list of operational procedures or a capital formula.

Question 34Operational Risk Management

A payment operations team introduces a mandatory callback to customers for any new beneficiary added above a set value. Which control classification best applies?

  1. A capital allocation decision
  2. A preventive detective hybrid control that reduces fraud likelihood Correct answer.
  3. A loss recovery arrangement with an insurer
  4. A purely corrective control applied after settlement

Explanation

The callback stops a fraudulent payment before it is released, so it is primarily preventive, though it also detects a suspicious instruction during the check. Controls are classified by how they act on likelihood or impact, and this one acts before the loss crystallises.

Question 35Operational Risk Management

A business unit reports a residual risk above appetite and proposes to accept it because remediation is costly. What is the most appropriate governance response?

  1. Allow the business unit manager to accept the risk without further review
  2. Remove the risk from the register to avoid reporting a breach
  3. Immediately close the related control and record a saving
  4. Escalate the acceptance decision to the appropriate risk committee with documented rationale Correct answer.

Explanation

Accepting risk above appetite is a governance decision that must be escalated with documented justification so senior committees can weigh it against strategy and capital. Business units cannot unilaterally accept exposures that breach board-approved limits.

Question 36Operational Risk Management

A bank aggregates operational losses across business lines. Why does mapping each event to both a business line and an event type improve the analysis?

  1. It removes the need to collect external loss data
  2. It converts operational losses into market risk exposures
  3. It guarantees that no future loss will recur in that area
  4. It allows losses to be compared and benchmarked by activity and by failure mode Correct answer.

Explanation

The two-dimensional mapping lets management see which activities and which failure modes drive losses, supporting targeted remediation and meaningful peer comparison. It is an analytical structure, not a guarantee against recurrence or a substitute for external data.

Question 37Operational Risk Management

A bank introduces a new mobile onboarding journey. Which action best integrates operational risk management into the change process?

  1. Relying on the vendor's assurance statement as the only review
  2. Deferring all risk assessment until the annual review cycle
  3. Waiting for the first customer complaint before assessing the journey
  4. Completing a risk assessment and control review before go-live as part of change management Correct answer.

Explanation

Embedding risk assessment into change management means new processes are evaluated for failure modes and controls before they go live, when issues are cheapest to fix. Relying on vendor assurances or waiting for complaints leaves the bank exposed during the highest-risk launch period.

Question 38Operational Risk Management

An operational risk manager wants to combine loss frequency and severity data with expert judgement to estimate potential tail losses. Which technique is designed for this purpose?

  1. Scenario analysis with severity and frequency estimation Correct answer.
  2. A comparison of market risk value-at-risk across desks
  3. A simple average of the last twelve months of small losses
  4. A review of the bank's credit rating migration

Explanation

Scenario analysis uses expert judgement to estimate the frequency and severity of plausible but rare events, filling gaps that historical data alone cannot cover. Averaging small losses ignores the tail, while credit and market risk techniques address different risk types.

Question 39Operational Risk Management

A bank wants a forward-looking measure of operational risk control effectiveness. Which indicator type is most appropriate?

  1. The prior year's audited financial statements
  2. Key control indicators tracking control performance such as reconciliation completion rates Correct answer.
  3. Backward-looking counts of settled customer complaints
  4. The regulatory capital ratio reported last quarter

Explanation

Key control indicators monitor whether controls are operating as designed, giving forward-looking warning before losses emerge. Backward-looking loss or complaint counts describe what has already happened rather than current control health.

Question 40Operational Risk Management

A bank outsources a core processing platform to a third party. Which practice best manages the resulting operational risk?

  1. Reducing internal oversight because the activity is now external
  2. Removing the process from the bank's risk register after signing the contract
  3. Conducting due diligence and setting service levels with ongoing monitoring and exit planning Correct answer.
  4. Assuming the vendor's own risk framework transfers all responsibility

Explanation

Outsourcing transfers execution but not accountability, so the bank must perform due diligence, define service levels, monitor performance and plan for exit or failure. The bank remains responsible to customers and regulators for the outsourced activity.

Question 41Operational Risk Management

A trading system outage causes a bank to fail to settle trades on time, incurring compensation costs. Which Basel event type category primarily applies?

  1. Employment practices and workplace safety
  2. Business disruption and system failures Correct answer.
  3. Clients, products and business practices
  4. External fraud

Explanation

Losses from technology outages and system unavailability fall under business disruption and system failures. The category captures the failure of the bank's own systems to support processing, as distinct from fraud or customer misconduct.

Question 42Operational Risk Management

Which pair of indicators best distinguishes a leading indicator from a lagging indicator in operational risk monitoring?

  1. Leading: settled fraud losses; lagging: unresolved audit findings
  2. Leading: rising staff turnover in a control team; lagging: number of processing errors last quarter Correct answer.
  3. Leading: customer complaints received; lagging: control self-assessment scores
  4. Leading: annual capital charge; lagging: training completion rate

Explanation

A leading indicator signals future risk, such as rising turnover in a key control team, while a lagging indicator records outcomes already realised, such as processing errors. The distinction guides whether management is anticipating or reporting risk.

Question 43Operational Risk Management

A bank's operational risk function wants to strengthen the independence of its second-line oversight. Which arrangement best supports this?

  1. Locating the oversight team within the largest revenue-generating division
  2. Reporting lines that keep operational risk oversight separate from the business units it monitors Correct answer.
  3. Having the head of trading approve the oversight team's work plan
  4. Setting oversight staff bonuses purely on divisional profit

Explanation

Second-line independence requires that oversight does not report into, or depend financially on, the activities it challenges. Separate reporting lines and objective-setting preserve the ability to raise concerns without conflict.

Question 44Operational Risk Management

A bank's operational risk policy sets a loss reporting threshold. Which design choice best supports timely and complete capture of events?

  1. A rule that only events affecting reported profit must be logged
  2. An informal verbal reporting route to avoid paperwork
  3. A clear threshold with defined escalation timelines and a simple reporting channel Correct answer.
  4. A high threshold that excludes most small events to reduce workload

Explanation

Effective loss capture depends on a workable threshold, defined escalation timelines and an easy reporting channel so staff report promptly and consistently. Excluding small events or relying on informal routes creates gaps and delays in the loss dataset.

Question 45Operational Risk Management

A risk committee reviews a business unit whose key risk indicator has breached its threshold for three consecutive months. What is the most appropriate next step?

  1. Immediately close the business unit without further review
  2. Take no action because the indicator is only one data point
  3. Reclassify the indicator so the breach no longer appears
  4. Require a documented root-cause analysis and remediation plan with a deadline Correct answer.

Explanation

A sustained breach signals a developing problem, so the committee should require root-cause analysis and a time-bound remediation plan, then track progress. Reclassifying the indicator or ignoring the trend would conceal a genuine deterioration.

Question 46Operational Risk Management

A bank wants to reduce the likelihood of duplicate payments in its accounts payable process. Which control design most directly addresses this objective?

  1. An automated three-way match between purchase order, receipt and invoice before payment Correct answer.
  2. A customer satisfaction survey of suppliers
  3. An annual external audit of the financial statements
  4. A monthly review of the bank's overall profit and loss

Explanation

A three-way match verifies that an order, a receipt and an invoice agree before payment is released, directly preventing duplicate or unauthorised payments at the point of processing. Broader reviews and audits do not stop the error at source.

Question 47Operational Risk Management

A bank relies on a single experienced employee to perform a complex reconciliation each month. Which risk concentration concern is most relevant?

  1. Key person dependency that could cause process failure if the employee is absent Correct answer.
  2. Over-reliance on automated controls with no manual review
  3. A market risk exposure arising from the reconciliation
  4. Excessive segregation of duties within the reconciliation

Explanation

Concentrating a critical process in one person creates key person risk, because absence, error or departure can halt or corrupt the reconciliation. Mitigants include cross-training, documented procedures and a backup reviewer.

Question 48Operational Risk Management

A bank is comparing residual risk ratings across two business units. Unit A has strong controls but a very high inherent risk; Unit B has weak controls but a low inherent risk. Which conclusion is most defensible?

  1. Unit B is safer because its inherent risk is lower
  2. Residual ratings alone may mislead, so both inherent risk and control effectiveness should be examined Correct answer.
  3. Unit A is safer because it has strong controls
  4. The two units cannot be compared under any framework

Explanation

Residual risk combines inherent exposure with control effectiveness, so a low residual can mask either a low inherent risk or strong controls, and vice versa. Sound comparison therefore examines both components rather than a single residual number.

Question 49Operational Risk Management

A bank's operational risk loss data shows a cluster of small errors in one process alongside one very large loss. Which analytical approach best captures both features when estimating potential losses?

  1. Discarding the large loss as an outlier
  2. Modelling frequency and severity separately so the body and tail of the distribution are both represented Correct answer.
  3. Averaging all losses into a single expected figure
  4. Using only the largest loss to set the estimate

Explanation

Frequency and severity behave differently, so modelling them separately lets the many small events inform expected loss while the severity distribution captures the tail. Averaging or discarding the large loss would misstate the potential for severe outcomes.

Question 50Operational Risk Management

A bank is designing its operational risk reporting for the board. Which reporting principle best supports effective oversight?

  1. Present forward-looking indicators and emerging risks alongside loss trends and remediation status Correct answer.
  2. Limit reporting to a single aggregate loss figure
  3. Report only historical losses that have already been settled
  4. Provide detailed transaction-level data with no summary

Explanation

Board reporting should combine backward-looking loss trends with forward-looking indicators, emerging risks and the status of remediation so directors can act rather than merely observe. Excessive detail or a single aggregate figure obscures the drivers of risk.