I85PREP
⌘ K
IIBF Operational Risk Management study materials
IIBF Operational Risk Management study resources

IIBF Operational Risk Management practice questions

One question at a time. Build your IIBF Operational Risk Management understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Operational risk: definition, scope and regulatory context

Under the Basel Committee's definition, operational risk is best described as the risk of loss resulting from which of the following?

  1. Adverse movements in foreign exchange rates on the banking book
  2. Changes in market prices and interest rates affecting the trading book
  3. Inadequate or failed internal processes, people and systems, or from external events Correct answer.
  4. A borrower failing to repay a loan on the due date

Explanation

Basel defines operational risk as the risk of loss arising from inadequate or failed internal processes, people and systems, or from external events. This definition is deliberately residual in nature, capturing causes other than credit and market risk. Events such as fraud, system outages and processing errors all fall within its scope.

Question 2Operational risk: definition, scope and regulatory context

Which of the following loss events is classified as operational risk under the Basel taxonomy?

  1. Loss from a downgrade of a sovereign bond holding
  2. Loss from a widening of credit spreads on a derivative
  3. Loss from a central bank raising the policy rate
  4. Loss from an internal fraud perpetrated by a bank employee Correct answer.

Explanation

Internal fraud is one of the seven Basel event types and sits squarely within operational risk. It arises from acts by employees involving theft, misappropriation or circumvention of regulations. The other options are driven by price or credit movements and belong to market or credit risk.

Question 3Operational risk: definition, scope and regulatory context

The Basel operational risk definition explicitly excludes which two risk types?

  1. Strategic risk and business risk
  2. Legal risk and compliance risk
  3. Credit risk and market risk Correct answer.
  4. Liquidity risk and reputational risk

Explanation

Basel states that operational risk excludes strategic and reputational risk, and separately clarifies that credit and market risk are treated under their own frameworks. Legal risk, by contrast, is explicitly included within operational risk. This exclusion keeps the three risk categories conceptually distinct for capital purposes.

Question 4Operational risk: definition, scope and regulatory context

A bank's legal department reports a loss from an out-of-court settlement following a customer lawsuit over mis-selling. How is this loss treated under the Basel operational risk framework?

  1. Included only if the settlement exceeds the bank's insurance deductible
  2. Included, because legal risk is expressly part of the operational risk definition Correct answer.
  3. Excluded, because litigation is a legal matter rather than an operational failure
  4. Excluded, because mis-selling is a conduct issue outside the capital framework

Explanation

Basel explicitly includes legal risk within operational risk, so litigation settlements arising from business conduct are captured. Mis-selling losses are a recognised operational risk event type under clients, products and business practices. Insurance recoveries may reduce the net loss but do not change the classification.

Question 5Operational risk: definition, scope and regulatory context

Which Basel event type category covers losses from natural disasters such as floods or earthquakes damaging a branch?

  1. Execution, delivery and process management
  2. Damage to physical assets Correct answer.
  3. Business disruption and system failures
  4. External fraud

Explanation

Damage to physical assets is the Basel event type covering losses from natural disasters and other events that damage premises or property. Business disruption and system failures covers technology and utility outages rather than physical damage. Keeping these categories distinct matters for loss data classification and scenario analysis.

Question 6Operational risk: definition, scope and regulatory context

Under the Basel framework, which approach to operational risk capital was withdrawn and is no longer available to banks?

  1. The Standardised Approach
  2. The New Standardised Approach
  3. The Basic Indicator Approach
  4. The Advanced Measurement Approach Correct answer.

Explanation

The Basel Committee removed the Advanced Measurement Approach when it finalised the post-crisis reforms, replacing all approaches with the single Standardised Approach. The Basic Indicator Approach and the original Standardised Approach were also superseded. The New Standardised Approach, based on the Business Indicator, is now the sole framework.

Question 7Operational risk: definition, scope and regulatory context

The New Standardised Approach for operational risk capital introduced by Basel uses which measure as its basis?

  1. The bank's internal loss data over a ten-year window
  2. Gross income averaged over three years
  3. The Business Indicator, combining interest, services and financial components Correct answer.
  4. Total risk-weighted assets across all risk categories

Explanation

The New Standardised Approach calculates capital from the Business Indicator, which aggregates interest, leases and dividend components, services components, and financial components. This produces the Business Indicator Component through marginal coefficients. Internal loss data is not used to set capital under this approach.

Question 8Operational risk: definition, scope and regulatory context

A bank's operational risk management function is required to be independent from which of the following?

  1. The internal audit function
  2. The business lines whose risks it monitors Correct answer.
  3. The external auditor
  4. The board risk committee

Explanation

The second line of defence must be independent of the business lines it oversees so that it can challenge risk-taking objectively. Independence from revenue-generating units is the core governance principle in operational risk. Internal audit forms a separate third line rather than a body the function must be independent from.

Question 9Operational risk: definition, scope and regulatory context

The 'three lines of defence' model assigns operational risk ownership primarily to which line?

  1. The second line, meaning the independent risk function
  2. The first line, meaning the business units that take the risk Correct answer.
  3. The third line, meaning internal audit
  4. The board of directors acting collectively

Explanation

In the three lines model, the first line comprises the business units that own and manage the risks they generate. The second line provides independent oversight and framework setting, while the third line gives assurance. Ownership of risk therefore rests with the business, not with oversight functions.

Question 10Operational risk: definition, scope and regulatory context

Which of the following best explains why operational risk is described as 'residual' in the Basel definition?

  1. It applies only to losses remaining after insurance recoveries
  2. It is measured only for residual balances left on the balance sheet
  3. It is calculated only after credit and market risk capital is deducted
  4. It captures all risks not classified as credit or market risk, plus explicitly included legal risk Correct answer.

Explanation

The residual description reflects that operational risk captures everything other than credit and market risk, subject to the stated exclusions of strategic and reputational risk. Legal risk is expressly included within this residual category. The term does not refer to accounting residuals or post-insurance amounts.

Question 11Operational risk: definition, scope and regulatory context

A bank suffers a loss when a power failure shuts down its data centre and transactions cannot be processed. Which Basel event type applies?

  1. Damage to physical assets
  2. Clients, products and business practices
  3. Business disruption and system failures Correct answer.
  4. Execution, delivery and process management

Explanation

Business disruption and system failures captures losses from hardware, software, telecommunications and utility outages. A power failure that halts processing is a classic example of this event type. Process management failures involve errors in execution rather than infrastructure unavailability.

Question 12Operational risk: definition, scope and regulatory context

Which statement about the scope of operational risk under Basel is most accurate?

  1. It covers all activities of the bank across business lines and legal entities Correct answer.
  2. It applies only to the trading book and payment operations
  3. It is limited to risks that can be quantified from internal loss data
  4. It applies only to losses above a materiality threshold set by the supervisor

Explanation

Operational risk is enterprise-wide and attaches to every activity, product and process, not just selected functions. Basel requires banks to manage it across all business lines and legal entities. Materiality thresholds and loss data availability affect measurement, not the scope of the risk itself.

Question 13Operational risk: definition, scope and regulatory context

Under Basel principles, a bank's operational risk policy framework should be approved by which body?

  1. The external supervisor directly
  2. The internal audit committee exclusively
  3. The board of directors Correct answer.
  4. The operational risk management committee alone

Explanation

Basel's principles require the board of directors to approve and periodically review the operational risk management framework. The board sets the tone and ensures the framework is understood across the organisation. Committees and functions execute the framework but do not hold the approval authority.

Question 14Operational risk: definition, scope and regulatory context

Which of the following is an example of external fraud as a Basel operational risk event type?

  1. A trader exceeding an approved position limit
  2. A clerk entering an incorrect settlement amount
  3. A hacker stealing customer data through a system intrusion Correct answer.
  4. An employee colluding with a customer to divert funds

Explanation

External fraud covers acts by third parties such as theft, hacking, forgery and cheque fraud. A system intrusion by an outside hacker is a standard example of this event type. Employee collusion is internal fraud, while limit breaches and data entry errors are process failures.

Question 15Operational risk: definition, scope and regulatory context

Which Basel principle requires banks to identify and assess operational risk inherent in all material products, activities, processes and systems?

  1. The principle on disclosure and transparency
  2. The principle on supervisory approval of capital models
  3. The principle on business continuity planning
  4. The principle on risk identification and assessment Correct answer.

Explanation

Basel's principles include an explicit requirement that banks identify and assess the operational risk inherent in all material products, activities, processes and systems. This underpins risk and control self-assessments and scenario analysis. The other listed items either do not exist as separate principles or address different obligations.

Question 16Operational risk: definition, scope and regulatory context

A bank uses a risk and control self-assessment to identify operational risk. What is the primary purpose of this tool?

  1. To compute regulatory capital using internal loss data
  2. To have business units assess their own risks and the adequacy of controls Correct answer.
  3. To determine insurance premiums for operational losses
  4. To replace internal audit testing of key controls

Explanation

A risk and control self-assessment lets business units identify their own risks and evaluate control effectiveness, embedding ownership in the first line. It complements, rather than replaces, independent assurance and loss data. It is not a capital calculation tool or an insurance pricing mechanism.

Question 17Operational risk: definition, scope and regulatory context

Which of the following best describes the role of scenario analysis in operational risk management?

  1. It forecasts credit losses under recession scenarios for capital planning
  2. It replaces the need for collecting internal loss data
  3. It estimates the potential impact of severe but plausible operational loss events Correct answer.
  4. It sets the interest rate stress used in market risk limits

Explanation

Scenario analysis explores severe but plausible operational events that may be underrepresented in historical loss data. It helps a bank assess tail risk and the adequacy of controls and capital. It is a forward-looking supplement to, not a substitute for, loss data collection.

Question 18Operational risk: definition, scope and regulatory context

A bank's key risk indicator for operational risk shows a rising trend in failed trade confirmations. What is the most appropriate interpretation?

  1. A leading indicator suggests deteriorating control effectiveness in processing Correct answer.
  2. The bank's market risk exposure is increasing
  3. The bank should immediately increase its credit provisions
  4. The indicator confirms that no operational loss can occur

Explanation

Key risk indicators are metrics that signal changes in the operational risk profile, often before losses materialise. A rising trend in failed confirmations points to weakening process controls that warrant investigation. It does not directly measure market or credit risk or guarantee loss avoidance.

Question 19Operational risk: definition, scope and regulatory context

Which of the following losses would be captured under the 'clients, products and business practices' event type?

  1. A fire destroying a warehouse of collateral
  2. A fine imposed for selling unsuitable products to retail customers Correct answer.
  3. A settlement failure caused by a back-office system error
  4. A robbery at a branch by armed intruders

Explanation

The clients, products and business practices category covers conduct failures such as mis-selling, fiduciary breaches and improper advice. A regulatory fine for unsuitable product sales is a typical example. Settlement errors are process failures, while fire and robbery fall under physical damage and external fraud respectively.

Question 20Operational risk: definition, scope and regulatory context

Which of the following statements about the relationship between operational risk and reputational risk under Basel is correct?

  1. Reputational risk is excluded from the operational risk definition but must still be managed Correct answer.
  2. Reputational risk replaces operational risk in the capital framework
  3. Reputational risk is a subset of operational risk and is capitalised within it
  4. Reputational risk is treated as a form of market risk under the trading book rules

Explanation

Basel excludes reputational risk from the operational risk definition used for capital purposes, yet supervisors expect banks to manage it. Operational failures can damage reputation even though that harm is not directly capitalised. Banks therefore address reputational consequences through governance and risk processes rather than the operational risk capital charge.

Question 21Operational risk: definition, scope and regulatory context

Under the New Standardised Approach, a bank's Business Indicator is used to derive the Business Indicator Component through which mechanism?

  1. Using the indicator as a floor beneath the internal models calculation
  2. Dividing the Business Indicator by the number of business lines
  3. Multiplying the Business Indicator by marginal coefficients applied to successive buckets Correct answer.
  4. Applying the bank's internal loss multiplier directly to the indicator

Explanation

The Business Indicator is allocated across buckets, each with its own marginal coefficient, and the sum of these products gives the Business Indicator Component. This creates a progressive capital requirement as the indicator rises. Internal loss data enters only through a separate loss component for certain banks, not as a direct multiplier on the indicator.

Question 22Operational risk: definition, scope and regulatory context

A supervisor is assessing whether a bank's operational risk framework meets Basel principles. Which element is most central to the assessment?

  1. Whether the framework is embedded, understood and regularly reviewed across the organisation Correct answer.
  2. Whether the bank has eliminated all operational losses in the past year
  3. Whether the bank uses a single software vendor for risk systems
  4. Whether the bank's share price has outperformed peers

Explanation

Basel principles focus on whether the framework is effectively embedded, understood at all levels and periodically reviewed. Elimination of all losses is unrealistic and not a supervisory expectation. Vendor choice and share price performance are not measures of framework adequacy.

Question 23Operational risk: definition, scope and regulatory context

Which of the following best explains why operational risk gained greater regulatory prominence after the 1990s?

  1. Large high-profile losses from fraud, failures and litigation showed it was material and under-measured Correct answer.
  2. Market risk capital rules were abolished by supervisors
  3. Banks stopped lending and became pure fee-based businesses
  4. Credit risk was removed from the Basel framework entirely

Explanation

High-profile losses from fraud, systems failures and litigation demonstrated that operational risk could be large and was poorly captured by existing capital rules. This led Basel to add an explicit operational risk capital charge. Credit and market risk frameworks were not abolished, and banks did not stop lending.

Question 24Operational risk: definition, scope and regulatory context

Which of the following is the most appropriate treatment of an operational loss caused by an employee's deliberate circumvention of internal controls for personal gain?

  1. Classify it as external fraud and exclude it from loss data
  2. Classify it as a strategic risk and exclude it from the framework
  3. Classify it as internal fraud and record it in the operational risk loss database Correct answer.
  4. Classify it as a market risk loss and report it in the trading book

Explanation

Deliberate circumvention of controls by an employee for personal gain is internal fraud under the Basel event types. Such events must be captured in the operational risk loss database to inform management and measurement. Internal fraud is not excluded from the framework.

Question 25Operational risk: definition, scope and regulatory context

A bank decides to purchase insurance against operational losses. How does this affect its regulatory capital under the New Standardised Approach?

  1. Insurance reduces the capital requirement through an explicit recognition formula
  2. Insurance transfers the operational risk entirely to the insurer for capital purposes
  3. Insurance is not recognised as a capital mitigant under the New Standardised Approach Correct answer.
  4. Insurance eliminates the need to record the underlying loss events

Explanation

The New Standardised Approach does not permit insurance recognition in the capital calculation, unlike the withdrawn advanced approach. Insurance remains a valid risk transfer tool for managing exposures but does not reduce the regulatory capital charge. Loss events must still be recorded regardless of insurance cover.

Question 26Operational risk: definition, scope and regulatory context

Which of the following best captures the Basel Committee's definition of operational risk?

  1. The risk of loss caused solely by deliberate employee misconduct
  2. The risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events Correct answer.
  3. The risk that a counterparty will fail to meet its contractual obligations
  4. The risk of loss arising from movements in market prices and interest rates

Explanation

Basel defines operational risk as the risk of loss from inadequate or failed internal processes, people and systems, or from external events. This definition is deliberately broad and includes legal risk while excluding strategic and reputational risk. Market, credit and pure fraud-only descriptions are narrower or belong to other risk categories.

Question 27Operational risk: definition, scope and regulatory context

Under the Basel definition, which risk is explicitly included within the scope of operational risk even though it is not a process or systems failure?

  1. Systemic contagion risk
  2. Strategic risk
  3. Legal risk Correct answer.
  4. Reputational risk

Explanation

The Basel definition states that operational risk includes legal risk. Legal risk covers exposures such as fines, penalties and private settlements arising from regulatory or contractual failures. Reputational and strategic risk are expressly excluded, and systemic contagion is not a named component of the definition.

Question 28Operational risk: definition, scope and regulatory context

A bank's operational risk loss database records an incident where a rogue trader exceeded authorised limits and concealed the positions. Into which Basel event type does this loss most properly fall?

  1. Execution, delivery and process management
  2. External fraud
  3. Damage to physical assets
  4. Internal fraud Correct answer.

Explanation

Internal fraud covers acts by at least one internal party involving theft, misappropriation or circumvention of regulations or company policy. A trader deliberately exceeding limits and concealing positions is a classic internal fraud. External fraud requires a third party, and process management covers unintentional execution failures.

Question 29Operational risk: definition, scope and regulatory context

Which statement best explains why operational risk cannot be fully eliminated by a bank?

  1. Operational risk disappears once insurance cover is purchased for all identified events
  2. Operational risk is limited to back-office processing functions and can be outsourced away
  3. Operational risk only arises when internal controls are documented incorrectly
  4. Operational risk is inherent in all business activities and some residual exposure always remains after controls Correct answer.

Explanation

Operational risk is inherent in every product, activity and process, so controls reduce but never remove it. The residual exposure that remains after controls is what the bank must manage and hold capital against. Insurance transfers some loss but does not eliminate the underlying risk.

Question 30Operational risk: definition, scope and regulatory context

Which of the following is the primary purpose of the operational risk management function within a bank's second line of defence?

  1. To execute daily transaction processing and reconcile nostro accounts
  2. To provide external assurance to shareholders on financial statements
  3. To approve individual customer credit limits and pricing
  4. To independently oversee, challenge and report on the operational risk framework across the bank Correct answer.

Explanation

The second line provides independent oversight, challenge and reporting on the operational risk framework owned by the first line. It designs the framework and monitors its effectiveness but does not execute business processes. Credit approval and external audit assurance sit outside this function.

Question 31Operational risk: definition, scope and regulatory context

A bank's board approves an operational risk appetite statement that sets tolerances for losses from process failures. Which Basel principle is most directly supported by this action?

  1. The principle requiring disclosure of operational risk capital
  2. The principle requiring banks to capture all material operational losses in a database
  3. The principle requiring an approved operational risk management framework Correct answer.
  4. The principle requiring independent review by internal audit

Explanation

Basel requires the board of directors to approve and periodically review the operational risk management framework, including the risk appetite and tolerances. An appetite statement with loss tolerances is a direct expression of that board-approved framework. Loss data capture, independent review and disclosure are separate principles.

Question 32Operational risk: definition, scope and regulatory context

Which of the following best describes the relationship between operational risk and credit risk in a lending transaction?

  1. Operational risk in lending is limited to interest rate movements on the loan book
  2. Operational risk and credit risk are mutually exclusive and never overlap in a lending transaction
  3. Operational risk replaces credit risk once a loan is disbursed
  4. Operational risk can arise from failures in the lending process itself, independently of whether the borrower defaults Correct answer.

Explanation

Even a performing loan can generate operational losses, for example through documentation errors, collateral registration failures or unauthorised disbursement. Operational risk therefore sits alongside credit risk within the same transaction. The two are not mutually exclusive, and interest rate movements are market risk.

Question 33Operational risk: definition, scope and regulatory context

A bank outsources its payment processing to a third-party vendor. How does this affect the bank's operational risk under the Basel framework?

  1. Operational risk transfers entirely to the vendor and can be removed from the bank's assessment
  2. Operational risk remains with the bank and the outsourcing arrangement must be captured within its risk management framework Correct answer.
  3. Operational risk is eliminated because the vendor is contractually liable for losses
  4. Operational risk becomes a market risk because the vendor is paid a fee

Explanation

Outsourcing does not transfer regulatory responsibility; the bank remains accountable and must manage the risks of the arrangement within its framework. Vendor failure, service disruption and concentration risk stay on the bank's risk profile. Contractual liability may recover money but does not remove the risk.

Question 34Operational risk: definition, scope and regulatory context

Which of the following is the clearest example of the 'damage to physical assets' Basel event type?

  1. A hacker steals customer card data from the bank's servers
  2. A flood destroys a branch building and its equipment Correct answer.
  3. A clerk keys an incorrect amount into a payment instruction
  4. A customer sues the bank over mis-sold investment products

Explanation

Damage to physical assets covers loss or damage to tangible property from natural disasters or other events such as floods, fires or vandalism. A destroyed branch building and equipment fits this category directly. Mis-selling, cyber theft and keying errors belong to other event types.

Question 35Operational risk: definition, scope and regulatory context

A bank operates in a jurisdiction that introduces a new data protection law. Which consequence for the bank's operational risk profile is most direct?

  1. An increase in market risk capital because compliance costs affect earnings
  2. A reduction in operational risk because the law standardises data handling
  3. An increase in credit risk because customers may default on loans
  4. A rise in legal and compliance risk from potential fines and remediation costs for breaches Correct answer.

Explanation

New regulatory obligations create legal risk, which Basel includes within operational risk. Breaches can trigger fines, remediation costs and customer compensation. The law does not reduce operational risk, and earnings or default effects relate to other risk categories.

Question 36Operational risk: definition, scope and regulatory context

Which of the following best describes the treatment of strategic and reputational risk under the Basel operational risk framework?

  1. Both are excluded from the definition, although banks may manage them within the wider framework Correct answer.
  2. Reputational risk is included while strategic risk is excluded
  3. Both are explicitly included in the definition and capitalised alongside legal risk
  4. Strategic risk is included while reputational risk is excluded

Explanation

The Basel definition includes legal risk but expressly excludes strategic and reputational risk from the operational risk definition. Banks may still manage these risks within their broader frameworks and reporting. Neither is included for regulatory capital purposes under the definition.

Question 37Operational risk: definition, scope and regulatory context

A bank's internal audit function reviews the operational risk framework and reports weaknesses to the audit committee. Which Basel principle does this activity most directly satisfy?

  1. The principle requiring the board to approve the risk appetite
  2. The principle requiring independent review and validation of the operational risk framework Correct answer.
  3. The principle requiring public disclosure of operational risk
  4. The principle requiring the use of external loss data

Explanation

Basel requires an independent review of the operational risk framework, typically performed by internal audit or an equally independent function. Reporting weaknesses to the audit committee is the mechanism through which that review is effective. Approval of appetite, disclosure and external data use are separate principles.

Question 38Operational risk: definition, scope and regulatory context

Which of the following best explains why supervisors require banks to hold regulatory capital against operational risk even when controls are strong?

  1. Because operational losses are always larger than credit losses
  2. Because operational risk is inherent and unexpected losses can exceed those absorbed by controls and provisions Correct answer.
  3. Because strong controls guarantee that no operational losses will occur
  4. Because capital replaces the need for a risk management framework

Explanation

Controls reduce the frequency and severity of losses but cannot eliminate inherent operational risk. Capital provides a buffer for unexpected losses that exceed what controls and provisions absorb. Capital is a complement to, not a substitute for, a sound risk management framework.

Question 39Operational risk: definition, scope and regulatory context

A bank's operational risk taxonomy classifies events by cause, event type and business line. What is the main benefit of maintaining such a taxonomy?

  1. It removes the need for scenario analysis and risk indicators
  2. It replaces the regulatory definition of operational risk with the bank's own
  3. It guarantees that all losses are recovered from insurers
  4. It enables consistent identification, aggregation and comparison of operational losses across the bank Correct answer.

Explanation

A taxonomy provides a common language so losses can be captured consistently, aggregated and compared across business lines and over time. Consistency supports capital modelling, reporting and root-cause analysis. It does not replace the regulatory definition, nor does it remove the need for other tools.

Question 40Operational risk: definition, scope and regulatory context

Which of the following losses would be classified under the Basel event type 'execution, delivery and process management'?

  1. A settlement fails because a payment instruction was entered with the wrong beneficiary account Correct answer.
  2. An employee colludes with a supplier to inflate invoices
  3. A fire in the bank's archive room destroys loan files
  4. A customer claims the bank gave unsuitable investment advice

Explanation

Execution, delivery and process management covers failed transaction processing, data entry errors and settlement failures. A wrong beneficiary account causing a failed settlement is a direct example. Fire damage, collusion and unsuitable advice belong to other event types.

Question 41Operational risk identification, assessment and measurement

In operational risk management, what does the term 'risk appetite' most precisely refer to?

  1. The total operational risk capital the regulator requires the bank to hold
  2. The amount and type of operational risk a bank is willing to accept in pursuit of its objectives Correct answer.
  3. The list of key risk indicators reported monthly to the board
  4. The maximum loss the bank is willing to accept from a single operational failure event

Explanation

Risk appetite is the level and type of risk an institution is prepared to accept in pursuit of its strategic objectives, expressed through qualitative statements and quantitative limits. It is broader than a single-event loss cap and distinct from regulatory capital.

Question 42Operational risk identification, assessment and measurement

Which of the following is the clearest example of an internal operational risk driver rather than an external one?

  1. A rise in card fraud by organised criminal groups
  2. Inadequate segregation of duties in the payments unit Correct answer.
  3. A widespread power outage in the city
  4. A change in statutory data protection penalties

Explanation

Operational risk drivers are classified as internal or external. Internal drivers include people, process and system weaknesses within the bank, such as poor segregation of duties. Regulatory change, utility outages and external fraud are external drivers.

Question 43Operational risk identification, assessment and measurement

A bank uses a risk and control self-assessment (RCSA) exercise. What is the primary purpose of this tool?

  1. To compute regulatory capital under the standardised approach
  2. To record and settle customer complaints within service timelines
  3. To have business units identify their operational risks and assess the adequacy of controls Correct answer.
  4. To allocate economic capital across business lines by expected loss

Explanation

RCSA is a forward-looking self-assessment in which business units identify risks inherent in their activities and rate the design and effectiveness of the controls mitigating them. It supports risk identification and assessment rather than capital allocation or complaint handling.

Question 44Operational risk identification, assessment and measurement

In the Basel operational risk framework, which of the following is one of the seven defined event types?

  1. Execution, delivery and process management Correct answer.
  2. Interest rate risk in the banking book
  3. Strategic risk
  4. Liquidity risk

Explanation

The Basel framework groups operational risk losses into seven event types, one of which is execution, delivery and process management. Liquidity, interest rate and strategic risk are separate risk categories outside the operational risk event taxonomy.

Question 45Operational risk identification, assessment and measurement

Which statement best describes a key risk indicator (KRI)?

  1. A model that estimates the probability of default of a corporate borrower
  2. A ratio used to measure the bank's profitability relative to capital
  3. A backward-looking record of losses already incurred from operational failures
  4. A metric that provides early warning of rising operational risk exposure in a process or unit Correct answer.

Explanation

KRIs are forward-looking metrics chosen because they correlate with operational risk exposure, giving early warning before losses materialise. Loss records are historical incident data, while default probability and profitability ratios belong to credit and financial performance measurement.

Question 46Operational risk identification, assessment and measurement

A bank collects operational loss data above a set threshold. Which attribute is most essential for the data to be useful in risk measurement?

  1. The credit rating of the counterparty involved
  2. The marketing budget of the affected business unit
  3. A consistent event type, business line and loss amount recorded under defined criteria Correct answer.
  4. The name of the external auditor of the loss event

Explanation

Loss data must be complete, consistent and classified by event type, business line, amount and date so it can be aggregated and modelled. Auditor names, marketing budgets and counterparty credit ratings do not support operational risk measurement.

Question 47Operational risk identification, assessment and measurement

What does a control self-assessment rating of 'control design ineffective' indicate?

  1. The control was not tested during the reporting period
  2. The control is operated by an external vendor
  3. The control failed on one occasion but is generally well designed
  4. The control as designed does not adequately mitigate the identified risk even if operated as intended Correct answer.

Explanation

Design effectiveness asks whether the control, if performed as intended, would adequately mitigate the risk. A design-ineffective rating means the control concept itself is inadequate, independent of whether it was operated correctly or who operates it.

Question 48Operational risk identification, assessment and measurement

Which of the following best describes the purpose of scenario analysis in operational risk assessment?

  1. To reconcile the general ledger at month end
  2. To calculate the bank's net interest margin
  3. To estimate potential severe losses from plausible but rare events that may be absent from historical data Correct answer.
  4. To verify the accuracy of customer identity documents

Explanation

Scenario analysis brings together business and risk experts to assess the likelihood and impact of severe, plausible events, including tail events with little or no historical loss experience. It complements loss data and supports capital and control decisions.

Question 49Operational risk identification, assessment and measurement

A bank's operational risk loss data shows a cluster of small losses in a single retail branch during one quarter. Which action is the most appropriate first response under the risk assessment cycle?

  1. Investigate the root cause and assess whether a common control weakness exists Correct answer.
  2. Report the cluster to the credit committee as a default trend
  3. Write off the losses without further review because each is below threshold
  4. Immediately revise the bank's regulatory capital calculation

Explanation

A cluster of losses, even small ones, should trigger root cause analysis to determine whether a shared control weakness or process failure is responsible. Capital recalculation, write-off without review or credit committee escalation do not address the operational cause.

Question 50Operational risk identification, assessment and measurement

A payments team rates a reconciliation control as 'key' but notes it is performed manually by one person with no backup. How should the residual risk be assessed?

  1. Residual risk is higher than design suggests because of key-person dependency and manual error potential Correct answer.
  2. Residual risk is zero because reconciliation is a detective control
  3. Residual risk is low because the control exists and is documented
  4. Residual risk cannot be assessed without external loss data

Explanation

Residual risk reflects the risk remaining after controls operate in practice. A manual control with a single operator carries key-person and error risk, so residual exposure is higher than the documented design implies.