I85PREP
⌘ K
III IC-83 study materials
III IC-83 study resources

III IC-83 practice questions

One question at a time. Build your III IC-83 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Unverified - official IC-83 syllabus not available in retrieved source

In the context of III IC-83 exam preparation, which term best describes the systematic process of identifying, assessing, and prioritizing risks followed by coordinated use of resources to minimize, monitor, and control the probability or impact of unfortunate events?

  1. Configuration control
  2. Quality assurance
  3. Change enablement
  4. Risk management Correct answer.

Explanation

Risk management is the discipline that identifies, evaluates, and prioritizes uncertainty and then applies resources to reduce likelihood or impact. The other options are narrower process areas that do not encompass the full identification-to-treatment cycle.

Question 2Unverified - official IC-83 syllabus not available in retrieved source

A team records a risk with a stated probability of 0.2 and an estimated impact of 50,000 currency units. Using the standard risk exposure calculation, what is the expected value of this risk?

  1. 250,000
  2. 2,500
  3. 50,000
  4. 10,000 Correct answer.

Explanation

Risk exposure, also called expected monetary value, is probability multiplied by impact: 0.2 × 50,000 = 10,000. This figure expresses the average loss the organization should anticipate from the risk over many repetitions.

Question 3Unverified - official IC-83 syllabus not available in retrieved source

Which risk response strategy involves transferring the financial consequences of a risk to a third party while the organization retains the operational activity?

  1. Insurance transfer Correct answer.
  2. Acceptance
  3. Mitigation
  4. Avoidance

Explanation

Transfer shifts the financial burden of a risk to another party, most commonly through insurance or contractual indemnity, while the activity continues. Avoidance eliminates the activity, mitigation reduces likelihood or impact, and acceptance retains the exposure.

Question 4Unverified - official IC-83 syllabus not available in retrieved source

A control is described as detective rather than preventive. Which example best illustrates a detective control in an operational process?

  1. Segregating duties between requisition and payment
  2. Requiring dual approval before a payment is released
  3. Reviewing a monthly reconciliation report for anomalies Correct answer.
  4. Encrypting data at rest in the primary database

Explanation

Detective controls identify problems after they occur, and a periodic reconciliation review does exactly that by surfacing anomalies. Approval gates, segregation of duties, and encryption act before or during the event to stop errors or attacks.

Question 5Unverified - official IC-83 syllabus not available in retrieved source

When constructing a risk register for an operational service, which attribute is most important for enabling later prioritization and trend analysis?

  1. A consistent scoring scale applied to likelihood and impact Correct answer.
  2. The number of meetings at which the risk was mentioned
  3. The name of the person who first noticed the risk
  4. The date the risk register document was last printed

Explanation

A consistent scoring scale allows risks to be compared, ranked, and tracked over time, which is the foundation of prioritization and trend analysis. Attributes such as discoverer name or meeting counts do not provide comparable measures of severity.

Question 6Unverified - official IC-83 syllabus not available in retrieved source

A risk assessment team uses a five-by-five matrix with likelihood on one axis and impact on the other. What is the primary limitation of this approach that a careful analyst should document?

  1. It automatically eliminates the need for management judgment
  2. It collapses continuous variables into coarse bands and can hide differences within a cell Correct answer.
  3. It cannot be used when more than ten risks exist
  4. It requires quantitative monetary estimates for every risk

Explanation

A matrix bands continuous likelihood and impact into a small number of categories, so risks with materially different profiles can land in the same cell and appear equivalent. Analysts should note this loss of resolution and use finer quantification where decisions are sensitive.

Question 7Unverified - official IC-83 syllabus not available in retrieved source

In risk terminology, what distinguishes inherent risk from residual risk?

  1. Inherent risk is measured annually; residual risk is measured only after an incident
  2. Inherent risk applies only to financial processes; residual risk applies to technical processes
  3. Inherent risk is always higher than the organization's risk appetite; residual risk is always lower
  4. Inherent risk exists before controls; residual risk remains after controls are applied Correct answer.

Explanation

Inherent risk is the exposure that exists absent any controls, while residual risk is what remains once existing controls are taken into account. Comparing the two shows how much protection current controls actually deliver.

Question 8Unverified - official IC-83 syllabus not available in retrieved source

A service owner decides to accept a risk whose residual exposure exceeds the stated risk appetite. Which action is most appropriate under sound governance?

  1. Silently close the risk because the owner has authority
  2. Escalate the acceptance decision to the level authorized to accept exposures above appetite Correct answer.
  3. Reduce the recorded impact until the exposure falls within appetite
  4. Reclassify the risk as an issue so it leaves the register

Explanation

Acceptance above the defined appetite requires authority at a level empowered to carry that exposure, so escalation is the correct path. Altering records or reclassifying the risk merely disguises the exposure and defeats governance.

Question 9Unverified - official IC-83 syllabus not available in retrieved source

Which statement best captures the purpose of a business impact analysis within continuity planning?

  1. It lists every employee and their reporting line
  2. It identifies critical activities and the tolerable period of disruption for each Correct answer.
  3. It records the audit findings from the previous financial year
  4. It documents the technical architecture of the primary data center

Explanation

A business impact analysis determines which activities are critical and establishes recovery time and recovery point objectives by identifying tolerable disruption periods. It is the analytical input that drives continuity strategy and resource prioritization.

Question 10Unverified - official IC-83 syllabus not available in retrieved source

An organization sets a recovery time objective of four hours for a payment service and a recovery point objective of fifteen minutes. What does the recovery point objective specify?

  1. The budget allocated to continuity testing each year
  2. The maximum time the service may remain unavailable
  3. The maximum acceptable data loss measured in time before the disruption Correct answer.
  4. The number of staff required to restore the service

Explanation

The recovery point objective defines how far back in time data may be lost, which drives backup frequency and replication design. The recovery time objective separately defines the maximum tolerable outage duration.

Question 11Unverified - official IC-83 syllabus not available in retrieved source

A continuity plan has been written and approved but never exercised. Why is this considered a significant weakness?

  1. Untested assumptions about dependencies, timing, and roles may fail under real conditions Correct answer.
  2. Plans become legally void if not printed annually
  3. Exercising is only needed when the plan exceeds fifty pages
  4. Regulators require plans to be written in a specific font

Explanation

Exercising reveals whether assumptions about dependencies, sequencing, and role clarity hold up in practice and exposes gaps that document review cannot. An unexercised plan is therefore a hypothesis rather than a validated capability.

Question 12Unverified - official IC-83 syllabus not available in retrieved source

Which activity belongs to the recovery phase rather than the response phase of incident management?

  1. Declaring the incident severity and assembling the response team
  2. Issuing the initial stakeholder notification
  3. Containing the immediate spread of the failure
  4. Restoring the service from validated backups and confirming integrity Correct answer.

Explanation

Recovery restores service and data after the incident is contained, so restoring from validated backups and verifying integrity sits in that phase. Declaration, containment, and initial communication are response activities that occur earlier.

Question 13Unverified - official IC-83 syllabus not available in retrieved source

In a post-incident review, which practice most improves future resilience rather than merely assigning blame?

  1. Recording the total number of staff involved in the response
  2. Documenting contributing factors and the control gaps that allowed the event Correct answer.
  3. Publishing the incident timeline without any analysis
  4. Identifying the individual who made the triggering mistake

Explanation

A blameless review that documents contributing factors and control gaps produces actionable improvements to systems and processes. Focusing on individual fault discourages reporting and leaves the underlying conditions unchanged.

Question 14Unverified - official IC-83 syllabus not available in retrieved source

Which principle underlies the segregation of duties control in a financial approval process?

  1. All transactions must be processed within one business day
  2. Approvals should be recorded only in paper form
  3. No single person should be able to initiate, approve, and record the same transaction Correct answer.
  4. Every transaction must be approved by the most senior available manager

Explanation

Segregation of duties prevents one individual from controlling all stages of a transaction, which reduces both error and fraud opportunity. It does not require the most senior approver or impose timing or format constraints.

Question 15Unverified - official IC-83 syllabus not available in retrieved source

A control owner reports that a key control operated correctly in all twelve months of the year. Which evidence would most strongly support this assertion during an independent review?

  1. A summary slide presented at the annual audit committee
  2. A verbal confirmation from the control owner
  3. A signed statement from the department head
  4. Sampled execution records with timestamps and reviewer sign-offs Correct answer.

Explanation

Contemporaneous execution records with timestamps and reviewer sign-offs are direct evidence that the control ran as described. Assertions and summaries are representations about the control rather than proof of its operation.

Question 16Unverified - official IC-83 syllabus not available in retrieved source

Which of the following best describes a key risk indicator?

  1. A control that prevents a risk from occurring
  2. A metric that provides early warning of increasing exposure to a defined risk Correct answer.
  3. A financial statement line item reported to shareholders
  4. A list of every risk recorded in the register

Explanation

A key risk indicator is a forward-looking metric that signals rising exposure before the risk materializes, enabling early intervention. It is distinct from a control, which acts on the risk, and from the register itself.

Question 17Unverified - official IC-83 syllabus not available in retrieved source

An organization applies a tolerance threshold to a key risk indicator so that a breach triggers a defined escalation. What is the main benefit of pre-defining this trigger?

  1. It ensures escalation happens promptly and consistently rather than depending on individual judgment Correct answer.
  2. It eliminates the need for periodic risk reporting
  3. It guarantees the risk will not materialize
  4. It removes the need to record the underlying risk

Explanation

Pre-agreed thresholds convert monitoring data into a consistent, timely escalation path that does not rely on ad hoc discretion. They do not prevent the risk, remove the need for recording, or replace broader reporting.

Question 18Unverified - official IC-83 syllabus not available in retrieved source

Which scenario best illustrates concentration risk in an operational context?

  1. A process is reviewed quarterly by an independent function
  2. A service uses two independent data centers in different regions
  3. A team documents its procedures in a shared knowledge base
  4. A service depends on a single supplier for a critical component with no qualified alternative Correct answer.

Explanation

Concentration risk arises when dependence on a single supplier, site, person, or system creates a single point of failure. Dual sites, documentation, and independent review are generally mitigating rather than concentrating factors.

Question 19Unverified - official IC-83 syllabus not available in retrieved source

A third-party supplier hosts a critical service. Which contractual provision most directly supports the customer's continuity objectives?

  1. A clause allowing either party to terminate with thirty days' notice
  2. Defined service levels with recovery objectives and audit rights Correct answer.
  3. A discount schedule for multi-year commitments
  4. A marketing co-branding agreement

Explanation

Service levels with recovery objectives and audit rights give the customer enforceable expectations and verification of the supplier's resilience. Termination, pricing, and branding terms do not address continuity performance.

Question 20Unverified - official IC-83 syllabus not available in retrieved source

When assessing a supplier's risk, why should the assessment consider fourth parties as well as the direct supplier?

  1. Fourth parties are legally responsible for the customer's obligations
  2. Assessing fourth parties is required only for marketing purposes
  3. The direct supplier's own dependencies can cause the same service disruption Correct answer.
  4. Fourth parties are always more expensive than the direct supplier

Explanation

A supplier's upstream dependencies can fail and interrupt the service just as the direct supplier could, so the effective risk extends through the chain. Mapping these dependencies prevents blind spots in continuity planning.

Question 21Unverified - official IC-83 syllabus not available in retrieved source

Which statement accurately describes the purpose of a risk treatment plan?

  1. It replaces the risk register once approved
  2. It certifies that the organization has no remaining risk exposure
  3. It lists all incidents that occurred in the previous quarter
  4. It records the actions, owners, and target dates for reducing or otherwise responding to a risk Correct answer.

Explanation

A treatment plan converts a chosen response into concrete actions with accountable owners and target dates. It complements the risk register rather than replacing it and cannot certify the elimination of exposure.

Question 22Unverified - official IC-83 syllabus not available in retrieved source

A team identifies a risk, treats it, and then closes the register entry permanently. Why is permanent closure generally inappropriate?

  1. Closed risks cannot be reported to management
  2. Closure is only permitted after a financial audit
  3. Conditions can change and reintroduce or alter the exposure, so the risk should be monitored or periodically reassessed Correct answer.
  4. Risks must remain open for at least ten years by convention

Explanation

Risk conditions evolve as processes, suppliers, and threats change, so a treated risk may re-emerge or shift in severity. Monitoring or periodic reassessment keeps the register aligned with reality.

Question 23Unverified - official IC-83 syllabus not available in retrieved source

In a bow-tie risk analysis, what do the left and right sides of the diagram represent?

  1. The left side shows controls and the right side shows policies
  2. The left side shows suppliers and the right side shows customers
  3. The left side shows threats and causes, and the right side shows consequences Correct answer.
  4. The left side shows costs and the right side shows benefits

Explanation

The bow-tie model places threats and their causes on the left, the top event at the centre, and consequences on the right, with preventive and mitigative barriers on each side. This structure makes explicit where controls interrupt the path to harm.

Question 24Unverified - official IC-83 syllabus not available in retrieved source

Which factor most strongly increases the inherent risk of a manual data-entry process?

  1. The process relies on human transcription with no automated validation Correct answer.
  2. The process is documented in a controlled procedure
  3. The process uses a standardized template
  4. The process is reviewed annually by an independent function

Explanation

Manual transcription without automated validation creates a high inherent opportunity for error because nothing catches mistakes at the point of entry. Documentation, independent review, and templates are controls that reduce rather than raise inherent risk.

Question 25Unverified - official IC-83 syllabus not available in retrieved source

A risk appetite statement says the organization has 'low tolerance for regulatory breaches' but does not define what counts as a breach or how it is measured. What is the most significant consequence of this gap?

  1. The organization is automatically compliant with all regulations
  2. The appetite cannot be operationalized into thresholds, so decisions and escalation become inconsistent Correct answer.
  3. The statement must be withdrawn from the risk register
  4. The statement becomes legally binding on all employees

Explanation

Without definitions and measures, an appetite statement cannot be translated into thresholds or escalation criteria, so different teams will interpret it differently. Operationalizing appetite requires explicit metrics and tolerances.

Question 26Unverified - official IC-83 syllabus not available in retrieved source

An operational risk manager is defining the scope of an IC-83 risk register. Which entry best qualifies as an operational risk event?

  1. A failed internal settlement process causing duplicate client debits Correct answer.
  2. A change in corporate income tax legislation
  3. An increase in the central bank policy interest rate
  4. A decline in the market value of a held bond portfolio

Explanation

Operational risk arises from inadequate or failed internal processes, people, systems, or external events. A failed settlement process causing duplicate debits is a process failure within the firm's operations. Market value declines, interest rate changes, and tax legislation changes are market or external environment risks, not operational failures.

Question 27Unverified - official IC-83 syllabus not available in retrieved source

In IC-83 risk reporting, what is the primary purpose of an operational risk incident log?

  1. To replace the general ledger for financial reconciliation
  2. To capture details of operational risk events for analysis, reporting, and lessons learned Correct answer.
  3. To record only external fraud cases that result in financial loss
  4. To list all employees who have access to the trading system

Explanation

An operational risk incident log is a structured record of operational risk events and near misses. Its purpose is to enable root cause analysis, trend identification, regulatory reporting, and corrective action. It is not limited to fraud, does not replace accounting records, and is not an access control list.

Question 28Unverified - official IC-83 syllabus not available in retrieved source

A bank classifies an operational risk event as 'high severity, low frequency.' Which loss distribution characteristic does this classification imply?

  1. The event occurs often and each occurrence causes substantial loss
  2. The event occurs often but each occurrence causes negligible loss
  3. The event is expected to occur rarely but cause substantial financial or reputational damage when it does Correct answer.
  4. The event is expected never to occur and therefore requires no capital allocation

Explanation

Severity refers to the magnitude of loss per event, while frequency refers to how often events occur. A high-severity, low-frequency event is rare but damaging, often called a tail event. Such events still require capital and control attention because their impact can be severe.

Question 29Unverified - official IC-83 syllabus not available in retrieved source

Which element is essential in an IC-83 operational risk policy statement?

  1. A definition of operational risk and the roles responsible for managing it Correct answer.
  2. A list of all approved software vendors
  3. A detailed profit forecast for the next fiscal year
  4. The personal contact details of every employee

Explanation

An operational risk policy should establish the definition of operational risk, the risk appetite, governance roles, and responsibilities. It provides the framework for identifying, assessing, and managing operational risk. Financial forecasts, personal data, and vendor lists are separate documents.

Question 30Unverified - official IC-83 syllabus not available in retrieved source

In the context of IC-83, what does the term 'near miss' mean for operational risk?

  1. A control that has been tested and found effective
  2. An event that could have caused harm but was prevented or did not result in loss Correct answer.
  3. A loss event that has been fully recovered from insurance
  4. A risk that has been formally accepted by the board

Explanation

A near miss is an incident that did not cause actual loss or damage but had the potential to do so. Capturing near misses is valuable because they reveal control weaknesses before a real loss occurs. They are distinct from insured losses, accepted risks, and control test results.

Question 31Unverified - official IC-83 syllabus not available in retrieved source

A firm is building an operational risk taxonomy for IC-83 purposes. Which category set is most consistent with standard operational risk event types?

  1. Internal fraud, external fraud, employment practices, clients and products, physical assets, business disruption, execution and delivery Correct answer.
  2. Credit default, liquidity squeeze, interest rate shift, equity price fall
  3. Audit finding, control gap, policy exception, regulatory letter
  4. Strategic drift, reputational damage, competitive pressure, brand erosion

Explanation

Standard operational risk event-type taxonomies typically include internal fraud, external fraud, employment practices and workplace safety, clients products and business practices, damage to physical assets, business disruption and system failures, and execution delivery and process management. The other lists describe market, credit, strategic, or assurance concepts rather than operational risk event types.

Question 32Unverified - official IC-83 syllabus not available in retrieved source

Which statement best describes the role of a risk owner in IC-83 operational risk management?

  1. The risk owner is responsible for auditing the risk management function
  2. The risk owner is accountable for managing a specific risk and its controls within their area Correct answer.
  3. The risk owner is the external regulator who approves the risk appetite
  4. The risk owner is the IT vendor who supplies the risk system

Explanation

A risk owner is a named individual accountable for the identification, assessment, monitoring, and treatment of a specific risk. This accountability sits within the business or function where the risk arises. Auditors, regulators, and vendors have different roles and do not own the organization's risks.

Question 33Unverified - official IC-83 syllabus not available in retrieved source

An operational risk team is drafting a risk appetite statement for IC-83. Which characteristic makes the statement actionable?

  1. It expresses tolerance in measurable terms with defined escalation triggers Correct answer.
  2. It is reviewed only after a major loss event occurs
  3. It uses broad adjectives such as 'acceptable' without quantification
  4. It is kept confidential from business units to avoid misinterpretation

Explanation

An actionable risk appetite statement translates tolerance into measurable limits, thresholds, or qualitative criteria with clear escalation triggers. This allows business units to make consistent decisions. Vague adjectives, secrecy, and reactive review undermine its usefulness.

Question 34Unverified - official IC-83 syllabus not available in retrieved source

A control self-assessment (CSA) workshop is used in an IC-83 programme. What is its main objective?

  1. To replace all independent internal audit testing
  2. To document customer complaints for marketing analysis
  3. To calculate the firm's regulatory capital requirement
  4. To engage business staff in assessing the design and operating effectiveness of their controls Correct answer.

Explanation

A control self-assessment involves business process owners and staff in evaluating whether controls are designed appropriately and operating effectively. It raises risk awareness and provides early insight into control weaknesses. It complements, but does not replace, independent audit, and it is not a capital or marketing exercise.

Question 35Unverified - official IC-83 syllabus not available in retrieved source

An operational risk manager is designing key control indicators (KCIs) for IC-83 reporting. Which indicator best fits the definition of a KCI?

  1. Percentage of reconciliations completed within the required timeframe Correct answer.
  2. Count of employees who completed annual compliance training
  3. Total value of operational losses incurred in the quarter
  4. Number of customer complaints received about product pricing

Explanation

A key control indicator measures how well a specific control is performing, such as the timeliness of reconciliations. It provides assurance that the control is operating as intended. Complaints, losses, and training completion are risk or performance indicators rather than direct measures of a control's operation.

Question 36Unverified - official IC-83 syllabus not available in retrieved source

A business unit wants to launch a new digital onboarding channel. Under IC-83 operational risk principles, when should the operational risk assessment be performed?

  1. Only after the first operational loss event occurs
  2. At the next annual risk review regardless of the launch date
  3. Before the channel is approved and launched, as part of the change risk assessment Correct answer.
  4. After the channel has been live for six months

Explanation

Operational risk assessment should be embedded in the change management process and completed before launch. This allows risks and controls to be designed into the new process. Waiting for a loss, an annual cycle, or a post-implementation period leaves the organization exposed.

Question 37Unverified - official IC-83 syllabus not available in retrieved source

In an IC-83 operational risk scenario, a trader exceeds an approved trading limit but the excess is corrected within the same day. How should this be treated?

  1. As a reportable operational risk incident requiring logging and root cause review Correct answer.
  2. As a near miss that should not be recorded
  3. As a market risk loss that requires no operational log
  4. As an accepted risk with no further action

Explanation

A limit breach is an operational risk incident even if corrected quickly. It indicates a control failure or weakness that should be logged, investigated, and remediated to prevent recurrence. It is not merely a market loss, an accepted risk, or an unrecorded near miss.

Question 38Unverified - official IC-83 syllabus not available in retrieved source

An IC-83 risk register records a risk with a gross rating of high and a net rating of medium. What does this indicate about the controls?

  1. Existing controls reduce the risk from high to medium, but residual risk remains above low Correct answer.
  2. The gross rating is irrelevant and should be removed
  3. The risk has been transferred to a third party
  4. The controls have eliminated the risk entirely

Explanation

Gross risk is the exposure before controls, and net or residual risk is the exposure after controls. A reduction from high to medium shows that controls have some effect but do not eliminate the risk. It does not imply elimination, transfer, or that the gross rating is irrelevant.

Question 39Unverified - official IC-83 syllabus not available in retrieved source

A firm uses a scenario analysis exercise for IC-83 operational risk capital. Which approach best strengthens the exercise?

  1. Excluding low-frequency events because they are unlikely
  2. Relying solely on external vendor software defaults
  3. Using only historical losses from the last quarter
  4. Involving business experts to estimate frequency and severity under a plausible severe scenario Correct answer.

Explanation

Scenario analysis combines expert judgment with data to estimate the frequency and severity of plausible severe events, including tail risks. Historical data alone may not capture rare events, software defaults are not firm-specific, and excluding low-frequency events undermines the purpose of scenario analysis.

Question 40Unverified - official IC-83 syllabus not available in retrieved source

An IC-83 operational risk team is reviewing a process with a single person responsible for both initiating and approving payments. Which control weakness is most evident?

  1. Absence of a business continuity plan for the payment system
  2. Lack of segregation of duties between initiation and approval Correct answer.
  3. Inadequate training on payment system functionality
  4. Insufficient encryption of payment data at rest

Explanation

Segregation of duties requires that incompatible functions, such as initiating and approving a payment, be performed by different individuals. Combining them in one person creates a control weakness that increases fraud and error risk. Encryption, continuity, and training are separate control areas.

Question 41Unverified - official IC-83 syllabus not available in retrieved source

A firm is implementing the three lines of defense model for IC-83 operational risk. Which group constitutes the second line?

  1. Internal audit, which provides independent assurance
  2. The business units that own and manage risk day to day
  3. The independent risk management and compliance function Correct answer.
  4. The external regulator supervising the firm

Explanation

In the three lines of defense model, the first line is the business that owns and manages risk, the second line is the independent risk and compliance function that sets frameworks and monitors, and the third line is internal audit. The regulator is external and not part of the model.

Question 42Unverified - official IC-83 syllabus not available in retrieved source

Under IC-83, a risk and control matrix (RACM) is being built for a key process. Which pairing correctly represents the matrix structure?

  1. Each product is mapped to its marketing budget
  2. Each vendor is mapped to its contract renewal date
  3. Each risk is mapped to the controls that mitigate it and to the evidence of control operation Correct answer.
  4. Each employee is mapped to their annual leave balance

Explanation

A risk and control matrix links identified risks to the controls designed to mitigate them and to the evidence that those controls operate. This structure supports assessment and testing. Leave balances, vendor renewal dates, and marketing budgets are unrelated record types.

Question 43Unverified - official IC-83 syllabus not available in retrieved source

An operational risk analyst is testing a preventive control in an IC-83 programme. Which control is preventive rather than detective?

  1. An annual audit of access rights
  2. A system rule that blocks a payment above the approved limit before release Correct answer.
  3. A monthly review of exception reports by a supervisor
  4. A daily reconciliation that identifies unmatched entries after posting

Explanation

Preventive controls stop an error or unauthorized action before it occurs, such as a system rule that blocks an over-limit payment. Detective controls identify issues after the fact, including reconciliations, exception reviews, and access audits.

Question 44Unverified - official IC-83 syllabus not available in retrieved source

A firm is using an IC-83 risk register and wants to capture the 'velocity' of a risk. What does velocity refer to in this context?

  1. The number of controls linked to the risk
  2. The speed at which a risk can materialize and cause impact Correct answer.
  3. The financial budget allocated to risk mitigation
  4. The seniority of the risk owner

Explanation

Risk velocity describes how quickly a risk event could occur and affect the organization. It helps prioritize risks that may escalate rapidly even if their likelihood is moderate. It is distinct from the number of controls, the mitigation budget, or the owner's seniority.

Question 45Unverified - official IC-83 syllabus not available in retrieved source

In an IC-83 operational risk framework, what is the purpose of a loss data collection programme?

  1. To record only losses that exceed the annual budget
  2. To calculate employee performance bonuses
  3. To systematically capture operational loss events for analysis, modelling, and control improvement Correct answer.
  4. To replace the incident log with financial journal entries

Explanation

A loss data collection programme gathers operational loss events in a structured way to support root cause analysis, trend monitoring, capital modelling, and control enhancements. It is broader than budget thresholds, does not replace incident logging, and is unrelated to bonus calculation.

Question 46Unverified - official IC-83 syllabus not available in retrieved source

An IC-83 risk assessment identifies that a key system has no tested disaster recovery arrangement. Which risk treatment is most appropriate?

  1. Implement and test a disaster recovery plan for the system Correct answer.
  2. Accept the risk because disasters are rare
  3. Transfer the risk by purchasing office supplies insurance
  4. Avoid the risk by ignoring the system

Explanation

The appropriate treatment for an untested recovery capability is to implement and regularly test a disaster recovery plan. This reduces the impact of disruption. Acceptance without analysis, irrelevant insurance, or ignoring the system does not address the identified weakness.

Question 47Unverified - official IC-83 syllabus not available in retrieved source

A firm applies an IC-83 operational risk capital model. Which statement best describes the role of insurance in that model?

  1. Insurance may reduce the net loss exposure but does not eliminate the underlying operational risk Correct answer.
  2. Insurance is a preventive control that stops events from occurring
  3. Insurance removes the need to hold any operational risk capital
  4. Insurance is irrelevant to operational risk management

Explanation

Insurance is a risk transfer mechanism that can reduce the financial impact of certain losses, but it does not prevent events or eliminate the need for capital and controls. It may be recognized in capital modelling subject to conditions, but the underlying risk remains.

Question 48Unverified - official IC-83 syllabus not available in retrieved source

An IC-83 risk manager is reviewing an outsourcing arrangement for a critical activity. Which factor most increases the operational risk of the arrangement?

  1. The supplier uses a well-known software platform
  2. The supplier has a large number of unrelated clients
  3. The supplier's headquarters is in a different city
  4. The supplier has no tested business continuity plan for the outsourced service Correct answer.

Explanation

The absence of a tested business continuity plan at a supplier of a critical activity directly increases the risk of service disruption and inability to recover. Client count, location, and software brand are not inherently risk-increasing without further context.

Question 49Unverified - official IC-83 syllabus not available in retrieved source

A firm's IC-83 operational risk profile shows a rising trend in small process errors across multiple business units. Which response best reflects a mature risk management approach?

  1. Discipline the individuals involved in each error
  2. Close the incident log to avoid reputational damage
  3. Analyze the common root causes across units and address the underlying process design Correct answer.
  4. Wait for a large loss before taking action

Explanation

A rising trend of small errors across units often signals a systemic or process design issue rather than isolated individual failures. A mature approach investigates common root causes and improves the process. Waiting, blaming individuals, or suppressing records does not address the underlying risk.

Question 50Unverified - official IC-83 syllabus not available in retrieved source

An IC-83 operational risk team is assessing the residual risk of a manual trade capture process after implementing a secondary review. Which statement best reflects the analysis?

  1. Residual risk is higher than inherent risk because a control was added
  2. Residual risk remains because manual entry is inherently error-prone and the review may not catch every error Correct answer.
  3. Residual risk cannot be assessed without a financial audit
  4. Residual risk is zero because a secondary review has been added

Explanation

Residual risk reflects the exposure remaining after controls. A secondary review reduces but does not eliminate the risk of manual entry errors. Residual risk cannot be zero when human error remains possible, and it is normally lower than inherent risk, not higher.