I85PREP
⌘ K
ORM Designation study materials
ORM Designation study resources

ORM Designation practice questions

One question at a time. Build your ORM Designation understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Operational Risk Management (CORM syllabus content)

In operational risk management, which statement best captures the Basel Committee's definition of operational risk?

  1. The risk of loss resulting from inadequate or failed internal processes, people, and systems, or from external events Correct answer.
  2. The risk of loss arising from movements in market prices and interest rates
  3. The risk of loss caused solely by deliberate employee fraud
  4. The risk that a counterparty will fail to meet its contractual obligations

Explanation

The Basel definition covers four drivers: internal processes, people, systems, and external events. It deliberately excludes strategic and reputational risk, and legal risk is explicitly included within it. Market, credit, and pure fraud risk are separate categories or only partial subsets.

Question 2Operational Risk Management (CORM syllabus content)

A firm's operational risk framework is built around the 'three lines of defence' model. Which group constitutes the second line?

  1. The independent risk and compliance function that sets frameworks and monitors the first line Correct answer.
  2. External regulators who examine the firm
  3. Front-office staff who originate and process transactions daily
  4. Internal audit, which provides independent assurance to the board

Explanation

The second line is the independent risk and compliance oversight function that designs frameworks and challenges the business. The first line owns and manages risk in day-to-day activity, while internal audit forms the third line. Regulators sit outside the internal model entirely.

Question 3Operational Risk Management (CORM syllabus content)

Which operational risk event type would typically capture unauthorised trading that exceeded approved position limits?

  1. Clients, products, and business practices Correct answer.
  2. Execution, delivery, and process management
  3. Damage to physical assets
  4. Business disruption and system failures

Explanation

Unauthorised trading and limit breaches are classified under clients, products, and business practices because they involve improper business conduct and market practice failures. Execution errors concern transaction processing and settlement. Physical damage and system failures are separate event categories.

Question 4Operational Risk Management (CORM syllabus content)

In the risk and control self-assessment (RCSA) process, what is the primary purpose of identifying key controls?

  1. To calculate regulatory capital under the standardised approach
  2. To replace the need for internal audit testing entirely
  3. To document the firm's marketing strategy
  4. To confirm that every identified risk has a control that mitigates it to an acceptable residual level Correct answer.

Explanation

RCSA links risks to the controls that mitigate them and assesses whether residual risk sits within appetite. It supports but never replaces independent audit testing. Capital calculation and strategy are unrelated to the control-mapping purpose.

Question 5Operational Risk Management (CORM syllabus content)

Which of the following is the clearest example of an external operational risk event?

  1. A flood that closes a branch and destroys paper records Correct answer.
  2. A clerk keying the wrong account number
  3. A failed overnight batch job in the settlement system
  4. A trader deliberately mis-marking positions

Explanation

A natural disaster is an external event outside the firm's control, and it fits the damage-to-physical-assets category. Mis-marking, system failure, and keying errors are internal people, system, or process failures.

Question 6Operational Risk Management (CORM syllabus content)

What does 'risk appetite' mean in an operational risk framework?

  1. The total value of assets held on the balance sheet
  2. The expected return on the firm's trading book
  3. The number of staff employed in the risk function
  4. The maximum loss the firm is willing to accept in pursuit of its objectives Correct answer.

Explanation

Risk appetite expresses the amount and type of risk the firm is prepared to accept to meet its objectives. It is usually articulated through qualitative statements and quantitative tolerances. Balance sheet size, expected return, and headcount are unrelated measures.

Question 7Operational Risk Management (CORM syllabus content)

Which loss data element is essential for building an internal operational risk loss distribution?

  1. The credit rating of the counterparty
  2. The gross loss amount and the recovery amount for each event Correct answer.
  3. The marketing channel used to acquire the client
  4. The name of the client involved in the event

Explanation

Loss distribution modelling requires gross loss and recovery data to derive net severity, alongside frequency information. Client names, marketing channels, and counterparty ratings do not drive the operational loss distribution.

Question 8Operational Risk Management (CORM syllabus content)

A bank sets a key risk indicator (KRI) with a green, amber, and red threshold. What is the main function of the amber band?

  1. To replace the need for loss data collection
  2. To confirm that the risk is fully eliminated
  3. To set the regulatory capital requirement
  4. To trigger escalation and remedial action before the risk breaches tolerance Correct answer.

Explanation

Amber acts as an early-warning trigger that prompts management attention before the red tolerance is breached. It does not eliminate risk, substitute for loss data, or determine capital. KRIs are forward-looking monitoring tools.

Question 9Operational Risk Management (CORM syllabus content)

Under the Basel operational risk standardised approach, the business indicator (BI) is used to derive the capital charge. Which component is included in the business indicator?

  1. Only net profit after tax
  2. Only interest expense paid to depositors
  3. Interest income, services income, and financial income from the trading book Correct answer.
  4. Only fee income from wealth management

Explanation

The business indicator aggregates three components: the interest, leases and dividend component; the services component; and the financial component. Net profit, isolated fee income, and interest expense alone do not represent the full measure.

Question 10Operational Risk Management (CORM syllabus content)

A firm discovers that a single rogue employee processed fictitious expense claims over three years. Which loss data challenge does this most directly illustrate?

  1. The difficulty of pricing market risk
  2. The problem of measuring interest rate sensitivity
  3. The need to capture losses that are detected long after the events occurred Correct answer.
  4. The challenge of forecasting credit defaults

Explanation

Long detection lags mean losses accumulate before discovery, so loss databases must record the event date, discovery date, and accounting date separately. This is a data capture and timing issue, not a market, interest rate, or credit risk problem.

Question 11Operational Risk Management (CORM syllabus content)

Which scenario best demonstrates the operational risk driver known as 'process' failure?

  1. A counterparty defaults on a bond payment
  2. A hurricane damages a data centre
  3. Interest rates rise sharply overnight
  4. A settlement instruction is confirmed manually without a second check and the trade fails to settle Correct answer.

Explanation

Process failure arises when a designed procedure lacks adequate controls, such as a missing second-person check. The other options describe external events, credit risk, and market risk respectively.

Question 12Operational Risk Management (CORM syllabus content)

When aggregating operational risk losses across business units, why is a consistent event taxonomy important?

  1. It automatically sets the firm's risk appetite
  2. It guarantees that no future losses will occur
  3. It removes the need for scenario analysis
  4. It allows losses to be compared and combined reliably across units and time periods Correct answer.

Explanation

A common taxonomy provides a shared language so that losses can be aggregated and benchmarked consistently. It does not prevent losses, replace scenario analysis, or determine appetite, which are separate framework elements.

Question 13Operational Risk Management (CORM syllabus content)

Scenario analysis is used in operational risk management primarily to address which weakness of historical loss data?

  1. Its excessive coverage of routine high-frequency events
  2. Its tendency to under-represent severe, low-frequency tail events Correct answer.
  3. Its reliance on external auditors
  4. Its inability to record any loss amounts

Explanation

Historical data is thin for rare but severe events, so scenario analysis fills that tail gap by drawing on expert judgement. Loss data does capture routine events and does record amounts; auditor reliance is not the issue.

Question 14Operational Risk Management (CORM syllabus content)

A firm outsources its payment processing to a third-party vendor. Which control is most appropriate for managing the resulting operational risk?

  1. Transferring all risk to the vendor so no monitoring is needed
  2. Removing the process from the firm's risk register
  3. Relying on the vendor's own internal audit report alone
  4. Ongoing due diligence and contractual service-level monitoring of the vendor Correct answer.

Explanation

Outsourcing transfers activity but not accountability, so the firm must perform due diligence and monitor service levels continuously. Risk cannot be fully transferred away, and a single vendor report or register removal is insufficient.

Question 15Operational Risk Management (CORM syllabus content)

In a bow-tie risk analysis, what do the controls on the left side of the event represent?

  1. Key risk indicators that measure exposure
  2. Recovery controls that limit the consequences after the event
  3. Insurance policies that reimburse losses
  4. Preventive controls that reduce the likelihood of the event occurring Correct answer.

Explanation

The bow-tie diagram places preventive (likelihood-reducing) controls on the causes side and mitigative (consequence-reducing) controls on the effects side. Insurance and indicators are separate tools, not the left-hand controls.

Question 16Operational Risk Management (CORM syllabus content)

Which statement correctly distinguishes inherent risk from residual risk?

  1. Inherent risk is the exposure before controls, while residual risk is what remains after controls operate Correct answer.
  2. Inherent risk applies only to credit risk, while residual risk applies only to operational risk
  3. Both terms describe the same exposure and are interchangeable
  4. Residual risk is the exposure before controls, while inherent risk is what remains after controls

Explanation

Inherent risk is measured assuming no controls are in place, and residual risk reflects the effect of existing controls. The two are distinct concepts and apply across risk types.

Question 17Operational Risk Management (CORM syllabus content)

A firm's loss data shows a rising trend in small processing errors. Which response is most consistent with a strong operational risk culture?

  1. Wait for a large loss before taking any action
  2. Reclassify the errors as market risk to avoid reporting
  3. Ignore the trend because individual losses fall below the reporting threshold
  4. Investigate root causes and strengthen first-line controls even though each loss is small Correct answer.

Explanation

High-frequency, low-severity events often signal control weaknesses that can escalate, so root-cause analysis and control enhancement are appropriate. Ignoring, waiting, or misclassifying losses undermines the risk framework.

Question 18Operational Risk Management (CORM syllabus content)

Which element is central to an operational risk governance structure at board level?

  1. Outsourcing the risk appetite statement to a vendor
  2. Delegation of all risk oversight to the front office
  3. A board risk committee that approves the framework and oversees the risk profile Correct answer.
  4. Elimination of the internal audit function

Explanation

Effective governance requires board-level oversight through a dedicated risk committee that approves the framework and monitors the profile. Delegating oversight to the front office or removing audit weakens independence.

Question 19Operational Risk Management (CORM syllabus content)

A firm applies a loss distribution approach and finds that its 99.9% operational risk capital is dominated by a single extreme scenario. What is the most appropriate analytical response?

  1. Remove the scenario so that capital falls immediately
  2. Assume the scenario can never occur because it has not yet happened
  3. Increase the loss frequency assumption without justification
  4. Review the scenario's assumptions and validate them against external data and expert judgement Correct answer.

Explanation

When capital is driven by one tail scenario, the assumptions behind it should be challenged and validated with external benchmarks and expert input. Removing the scenario or arbitrarily adjusting assumptions undermines model integrity, and absence of past occurrence does not mean impossibility.

Question 20Operational Risk Management (CORM syllabus content)

Which statement best explains the purpose of capturing 'near misses' in operational risk reporting?

  1. They replace the need to record actual losses
  2. They are used only to calculate credit risk capital
  3. They are irrelevant because no financial loss occurred
  4. They reveal control weaknesses before an actual loss is incurred Correct answer.

Explanation

Near misses are events that could have caused loss but did not, so they provide early evidence of failing controls. They complement rather than replace loss data and have no role in credit capital.

Question 21Operational Risk Management (CORM syllabus content)

Under the Basel III final operational risk framework, which approach replaced the advanced measurement approaches (AMA)?

  1. A single standardised approach based on the business indicator Correct answer.
  2. The leverage ratio framework
  3. The internal ratings-based approach
  4. A return to the basic indicator approach only

Explanation

The Basel III reforms replaced all existing operational risk approaches, including AMA, with a single standardised approach driven by the business indicator. The basic indicator and internal ratings-based approaches are not the replacement, and the leverage ratio is a separate capital measure.

Question 22Operational Risk Management (CORM syllabus content)

A firm uses external loss data to supplement its internal database. Which adjustment is most important before using that data in capital modelling?

  1. Excluding all external data because it comes from other firms
  2. Applying the external losses only to credit risk models
  3. Scaling the data to reflect differences in the firm's size and business mix Correct answer.
  4. Assuming the external data is directly applicable without adjustment

Explanation

External data comes from institutions of different scale and activity, so it must be scaled and filtered for relevance before use. Direct application is inappropriate, and discarding external data loses valuable tail information.

Question 23Operational Risk Management (CORM syllabus content)

An operational risk model combines frequency and severity distributions. Which assumption most directly affects the modelled frequency of losses?

  1. The expected number of events per period Correct answer.
  2. The discount rate applied to future losses
  3. The recovery rate after each event
  4. The average loss amount per event

Explanation

Frequency modelling concerns how often events occur, captured by the expected event count per period. Severity relates to loss amount, while recoveries and discounting affect the monetary value rather than the count.

Question 24Operational Risk Management (CORM syllabus content)

A firm's operational risk capital exceeds its regulatory minimum, and management proposes reducing the buffer to boost return on equity. Which consideration is most relevant to the board's decision?

  1. Whether the internal capital buffer adequately covers tail scenarios and the firm's risk appetite Correct answer.
  2. Whether reducing capital will improve the firm's marketing reach
  3. Whether the reduction will lower staff training costs
  4. Whether the buffer can be replaced by increasing credit risk limits

Explanation

The board must judge whether the buffer reflects tail exposure and appetite, since capital is a cushion against severe operational losses. Marketing reach, credit limits, and training costs are not valid substitutes for operational risk capital adequacy.

Question 25Operational Risk Management (CORM syllabus content)

A firm's control self-assessment rates a control as 'effective', but internal audit finds repeated failures of the same control. What does this most likely indicate?

  1. The control should be removed from the risk register
  2. The self-assessment lacks objective evidence and may reflect optimistic bias Correct answer.
  3. The control failure is a market risk event
  4. The audit finding must be wrong because self-assessment is authoritative

Explanation

Divergence between self-assessment and audit evidence typically signals optimism bias or weak assessment design in the first line. Audit findings are independent evidence, so dismissing them or removing the control is inappropriate, and control failure is operational risk.

Question 26Operational Risk Management (CORM syllabus content)

Which term describes the maximum level of operational risk a firm is willing to accept in pursuit of its strategic objectives, expressed in quantitative and qualitative terms?

  1. Risk appetite Correct answer.
  2. Risk tolerance
  3. Risk capacity
  4. Risk limit

Explanation

Risk appetite is the amount and type of risk an organisation is willing to accept to pursue its objectives, and it is expressed through both qualitative statements and quantitative boundaries. Limits and tolerances are the operational mechanisms that translate appetite into day-to-day constraints.

Question 27Operational Risk Management (CORM syllabus content)

Which three elements together typically define an operational risk event record in a loss database?

  1. Frequency, severity, and correlation
  2. Cause, event, and impact Correct answer.
  3. Indicator, threshold, and escalation
  4. Control, owner, and test result

Explanation

Operational risk events are conventionally described through cause, event, and impact, which allows root-cause analysis as well as quantification of the loss. Frequency and severity are modelling parameters derived later, and controls and indicators are separate risk-management objects.

Question 28Operational Risk Management (CORM syllabus content)

Which statement best describes the role of the three lines model in operational risk governance?

  1. The first line sets capital, the second line audits, and the third line manages risk
  2. The model requires external auditors to sit on the risk committee
  3. The first line owns and manages risk, the second provides oversight and challenge, and the third provides independent assurance Correct answer.
  4. All three lines report to the same business head to ensure consistency

Explanation

The three lines model separates risk ownership in the business from independent risk oversight and from internal audit assurance. This separation prevents the function that takes risk from also being the sole judge of whether it is controlled.

Question 29Operational Risk Management (CORM syllabus content)

A firm's operational risk policy states that any single loss above a defined amount must be escalated to the operational risk committee within 48 hours. What is this threshold an example of?

  1. A risk appetite statement
  2. A reporting escalation trigger Correct answer.
  3. A control self-assessment rating
  4. A key risk indicator

Explanation

A defined loss amount that mandates escalation to a governance forum is an escalation trigger embedded in the reporting process. It is not in itself an appetite statement, an indicator of future risk, or a control rating.

Question 30Operational Risk Management (CORM syllabus content)

Which statement best captures the difference between a key risk indicator and a key performance indicator in an operational risk context?

  1. A KRI measures risk exposure and control health, whereas a KPI measures business performance against objectives Correct answer.
  2. A KRI is always quantitative, whereas a KPI is always qualitative
  3. A KRI is only used by internal audit, whereas a KPI is used by the business
  4. A KRI is reported annually, whereas a KPI is reported daily

Explanation

KRIs are designed to give early warning on risk levels and control effectiveness, while KPIs track progress toward business goals. The two may share data sources but serve different governance purposes.

Question 31Operational Risk Management (CORM syllabus content)

In operational risk capital modelling, which pair of distributions is conventionally combined to build the loss distribution approach?

  1. A transition matrix and a recovery rate distribution
  2. A frequency distribution and a severity distribution Correct answer.
  3. A normal distribution and a uniform distribution
  4. A yield curve and a default probability distribution

Explanation

The loss distribution approach models the number of events with a frequency distribution and the size of each event with a severity distribution, then aggregates them by convolution or simulation. The other pairs belong to credit or market risk modelling.

Question 32Operational Risk Management (CORM syllabus content)

Which document typically records the detailed design of a control, its owner, the risk it mitigates, and the evidence of its operation?

  1. The control inventory or control library Correct answer.
  2. The risk register entry only
  3. The capital model validation report
  4. The board risk appetite statement

Explanation

A control inventory or library holds the structured description of each control, including ownership, design, and linkage to risks and evidence. The risk register records risks and their ratings, while capital and appetite documents serve different purposes.

Question 33Operational Risk Management (CORM syllabus content)

Which statement best explains why operational risk is described as inherent in all banking activities rather than confined to a single function?

  1. Because operational risk is only relevant to back-office processing units
  2. Because operational risk arises from people, processes, systems, and external events across every business line Correct answer.
  3. Because operational risk is a subset of credit risk in lending activities
  4. Because operational risk can be fully eliminated through insurance

Explanation

Operational risk is generated by the four driver categories of people, process, systems, and external events, which exist in every business activity. It therefore cannot be isolated to one function and cannot be fully transferred away.

Question 34Operational Risk Management (CORM syllabus content)

A firm wants to compare its operational loss experience against peers after adjusting for scale differences. Which approach is most appropriate?

  1. Compare only the largest single loss in each firm
  2. Normalise losses by a scale proxy such as gross income or transaction volume Correct answer.
  3. Compare absolute loss totals without adjustment
  4. Convert all losses to a common currency without further adjustment

Explanation

Peer benchmarking requires normalising losses by a measure of business scale, such as income or transaction counts, so that differences in size do not distort the comparison. Absolute totals, single largest losses, and currency conversion alone do not achieve comparability.

Question 35Operational Risk Management (CORM syllabus content)

A risk assessment finds that a payment process has a high inherent risk rating but strong automated controls reduce the exposure substantially. Which rating should be recorded as the residual risk?

  1. The average of the inherent rating and the control rating
  2. The lowest possible rating, because automated controls are considered infallible
  3. The inherent rating, because controls may fail
  4. A rating reflecting the risk remaining after the controls operate as designed Correct answer.

Explanation

Residual risk is the exposure that remains once controls are applied and are operating as intended. It is not simply the inherent rating, nor an assumption of perfection, nor an arithmetic average of unrelated ratings.

Question 36Operational Risk Management (CORM syllabus content)

A firm is designing a scenario workshop for a low-frequency, high-severity cyber event. Which design choice most improves the usefulness of the output for capital estimation?

  1. Asking participants for a single point estimate to simplify aggregation
  2. Focusing only on events that have already occurred internally
  3. Restricting participants to the IT department to ensure technical accuracy
  4. Including business, risk, and technology experts and eliciting a plausible range of frequency and severity Correct answer.

Explanation

Scenario analysis is most valuable when multidisciplinary experts challenge assumptions and provide a range of frequency and severity estimates that reflect uncertainty. A single point estimate discards the uncertainty information needed for capital modelling.

Question 37Operational Risk Management (CORM syllabus content)

An operational risk manager is mapping a new product to the Basel business indicator components. Which set of components is used in the business indicator calculation?

  1. Retail, wholesale, and institutional component
  2. Credit, market, and liquidity component
  3. Interest, leases, and dividends component; services component; financial component Correct answer.
  4. Trading, hedging, and settlement component

Explanation

The business indicator combines an interest, leases, and dividends component, a services component, and a financial component, each derived from specified income statement lines. The other groupings are not the Basel business indicator components.

Question 38Operational Risk Management (CORM syllabus content)

A firm's operational risk loss data show that a high proportion of events are recorded with a cause category of 'process' but with no linked control. Which action most directly improves the usability of the data for control improvement?

  1. Removing the cause category field to simplify reporting
  2. Outsourcing the loss data collection to a vendor
  3. Increasing the loss reporting threshold to reduce volume
  4. Requiring root-cause and control linkage fields at event closure Correct answer.

Explanation

Linking each event to a root cause and the control that failed or was absent turns loss data into actionable control intelligence. Raising thresholds, outsourcing, or removing fields reduces analytical value rather than improving it.

Question 39Operational Risk Management (CORM syllabus content)

Which statement best explains why external loss data must be scaled before being combined with internal data in an operational risk model?

  1. External data are collected under a different accounting standard
  2. External data are only available in aggregate form
  3. The contributing institution's size and business mix differ from the firm's own profile Correct answer.
  4. External events are always larger in absolute terms than internal events

Explanation

External events come from institutions with different scale and business mix, so scaling adjusts the severity and frequency to the firm's own exposure. Absolute size comparisons, accounting differences, and aggregation level are not the core reason for scaling.

Question 40Operational Risk Management (CORM syllabus content)

A firm's KRI for failed trade settlements has breached its red threshold for two consecutive months. What is the most appropriate immediate governance response?

  1. Escalate to the responsible committee with a documented remediation plan and owner Correct answer.
  2. Wait for the next quarterly review before acting
  3. Suspend all trading activity until the indicator returns to green
  4. Reset the threshold to a level that the current data will not breach

Explanation

A red breach requires escalation with an accountable owner and a remediation plan so that the underlying control weakness is addressed. Resetting the threshold or waiting for a scheduled review defeats the purpose of the indicator.

Question 41Operational Risk Management (CORM syllabus content)

Which control is most effective at reducing the risk of a single employee both initiating and approving a payment?

  1. Increasing the transaction monitoring sample size
  2. Segregating the initiation and approval duties between different individuals Correct answer.
  3. Requiring a second signature only above a high monetary threshold
  4. Requiring annual leave for all staff

Explanation

Segregation of duties prevents one person from completing a transaction end to end, which is the direct preventive control against this fraud risk. Monitoring and threshold-based signatures are detective or partial controls.

Question 42Operational Risk Management (CORM syllabus content)

A firm is considering insurance as a mitigant for operational risk. Which statement best describes its effect?

  1. It eliminates the operational risk exposure entirely
  2. It reduces the frequency of operational loss events
  3. It transfers a defined portion of severity risk subject to policy terms, limits, and exclusions Correct answer.
  4. It replaces the need for internal controls

Explanation

Insurance transfers specified loss severity to the insurer within policy limits and subject to exclusions and claims conditions. It does not reduce event frequency, remove the underlying risk, or substitute for controls.

Question 43Operational Risk Management (CORM syllabus content)

In a risk and control self-assessment, which practice most improves the reliability of the results?

  1. Having business owners complete the assessment with independent challenge from the risk function Correct answer.
  2. Using identical ratings for every control to simplify trend analysis
  3. Completing the assessment solely by the internal audit team
  4. Restricting the assessment to controls with known failures

Explanation

Business ownership provides operational knowledge while independent challenge from the risk function counters optimism bias. Sole completion by audit or uniform ratings would undermine the assessment's credibility.

Question 44Operational Risk Management (CORM syllabus content)

A firm's operational risk capital model produces volatile year-on-year results driven by a small number of large historical losses. Which action best addresses this model weakness?

  1. Supplementing internal data with external data and scenario analysis, and applying a smoothing methodology Correct answer.
  2. Increasing the model's confidence level to 99.99%
  3. Reducing the number of simulations in the Monte Carlo engine
  4. Removing the large losses from the dataset

Explanation

Sparse internal data on severe events cause instability, so blending external data and scenarios with a documented smoothing approach improves stability. Removing losses biases the model, and changing the confidence level or simulation count does not address data sparsity.

Question 45Operational Risk Management (CORM syllabus content)

Which statement best explains why a firm should document the rationale for its operational risk scenario assumptions?

  1. To allow the scenario outputs to replace internal loss data entirely
  2. To satisfy the requirement that scenarios be identical across all firms
  3. To ensure the scenario results are never revised
  4. To provide an auditable basis for challenging and validating the estimates used in capital and risk management Correct answer.

Explanation

Documented rationale creates an audit trail that supports independent challenge, validation, and revision as conditions change. Scenarios are firm-specific and are meant to be updated, not frozen or treated as a substitute for loss data.

Question 46Operational Risk Management (CORM syllabus content)

A firm's operational risk framework includes a formal process for approving new products, activities, and systems. Which risk driver does this process most directly address?

  1. Sovereign risk
  2. Change and business process risk Correct answer.
  3. Model risk in credit scoring
  4. External fraud

Explanation

New product and change approval processes address the risk that new activities introduce uncontrolled processes, systems, or people dependencies. External fraud and sovereign risk are different risk categories.

Question 47Operational Risk Management (CORM syllabus content)

A firm calculates its operational risk capital using the standardised approach. Which statement correctly describes how the business indicator drives the capital charge?

  1. The business indicator is used only for disclosure purposes
  2. The business indicator is multiplied by a single fixed percentage for all firms
  3. The business indicator replaces the need for any capital calculation
  4. The business indicator is mapped into buckets that determine the marginal coefficients applied to the indicator Correct answer.

Explanation

Under the standardised approach the business indicator places a firm into a bucket, and marginal coefficients are applied to portions of the indicator to produce the capital charge. It does not replace the calculation or serve only for disclosure.

Question 48Operational Risk Management (CORM syllabus content)

A firm discovers that its operational risk losses are concentrated in one business line that represents a small share of revenue. Which conclusion is most defensible?

  1. The concentration is irrelevant because capital is calculated at firm level
  2. The business line should be closed immediately because concentration proves it is unprofitable
  3. The losses should be reallocated to a larger business line to reduce the ratio
  4. The concentration warrants targeted analysis of that line's processes, controls, and risk culture Correct answer.

Explanation

Concentration of losses in a small revenue line signals that the line's risk profile may be disproportionate and merits targeted investigation of its controls and culture. Immediate closure, dismissal as irrelevant, or reallocation are not evidence-based responses.

Question 49Operational Risk Management (CORM syllabus content)

A firm's internal audit report notes that the same control failure has recurred despite a prior management action marked as complete. Which conclusion about the framework is most warranted?

  1. The risk appetite statement must be rewritten
  2. The control self-assessment process is functioning well because the issue was detected
  3. The capital model should be recalibrated immediately
  4. The issue management process lacks effective validation of remediation before closure Correct answer.

Explanation

Recurrence after a remediation is closed indicates that the issue management process did not verify that the fix was effective and embedded. Detection alone does not demonstrate a healthy self-assessment, and neither appetite nor capital recalibration is the direct remedy.

Question 50Operational Risk Management (CORM syllabus content)

An operational risk manager is assessing the dependency between two loss event types for aggregation purposes. Which statement about correlation assumptions is most accurate?

  1. Assuming zero correlation is always conservative for capital purposes
  2. Underestimating positive dependence can understate aggregated tail losses Correct answer.
  3. Assuming perfect positive correlation always produces the highest capital estimate
  4. Correlation between operational loss types is directly observable from historical data

Explanation

Operational loss events often share common drivers, so failing to capture positive dependence can understate the tail of the aggregate loss distribution. Zero correlation is not automatically conservative, and correlation is difficult to estimate from sparse data.