I85PREP
⌘ K
PRMIA ORM study materials
PRMIA ORM study resources

PRMIA ORM practice questions

One question at a time. Build your PRMIA ORM understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Operational Resilience

A bank defines a severe but plausible disruption scenario and sets the maximum tolerable time for restoring a critical payment service. Which operational resilience metric does this describe?

  1. Maximum tolerable period of disruption Correct answer.
  2. Service level agreement
  3. Recovery point objective
  4. Recovery time objective

Explanation

The maximum tolerable period of disruption is the threshold set by the firm for how long a critical business service can be disrupted before harm to clients and markets becomes unacceptable. It is defined from impact tolerance, not from technical recovery capability, which is captured by the recovery time objective.

Question 2Operational Resilience

Which statement best describes the purpose of mapping important business services in an operational resilience framework?

  1. It lists every application in the technology estate for asset management purposes.
  2. It records regulatory reporting obligations for each legal entity.
  3. It identifies the services whose disruption would cause harm to clients or markets. Correct answer.
  4. It allocates budget across departments according to headcount.

Explanation

Important business services are those whose failure would cause intolerable harm to clients, markets, or the firm itself, so mapping starts from the outcome delivered rather than from the underlying systems. The mapping then traces the people, processes, technology, and third parties that support each service.

Question 3Operational Resilience

A firm's operational resilience programme requires it to test its ability to remain within impact tolerances under severe but plausible scenarios. What is the primary purpose of this testing?

  1. To reveal actual capability gaps so that remediation can be prioritised. Correct answer.
  2. To demonstrate to auditors that backup tapes are stored offsite.
  3. To benchmark staff performance for annual appraisal purposes.
  4. To confirm that documented procedures exist and are version controlled.

Explanation

Scenario testing of severe but plausible disruptions is designed to expose where actual response capability falls short of the impact tolerance, so that investment and remediation can be directed at the weakest points. Document existence and backup storage are inputs to resilience, but they do not demonstrate that the firm can stay within tolerance.

Question 4Operational Resilience

Which of the following is the clearest example of a concentration risk within operational resilience?

  1. A firm uses four unrelated cloud providers across different regions.
  2. A single third-party provider hosts the only instance of a critical settlement platform. Correct answer.
  3. A firm rotates its incident response leads every quarter.
  4. A firm holds weekly resilience committee meetings.

Explanation

Concentration risk arises where a single point of failure, such as one provider hosting the sole instance of a critical platform, could disrupt an important business service. Diversification and rotation reduce concentration rather than create it.

Question 5Operational Resilience

During an incident, a firm invokes its crisis management team and begins communicating with regulators and affected clients. Which phase of the incident management lifecycle does this represent?

  1. Detection and analysis
  2. Preventive controls design
  3. Response and containment Correct answer.
  4. Post-incident review

Explanation

Activating crisis management and communicating with regulators and clients are response and containment activities that follow detection. The post-incident review comes later, once the event is stabilised and lessons can be captured.

Question 6Operational Resilience

A firm outsources a critical service to a vendor and retains no ability to perform the function internally. Which resilience consideration is most directly raised?

  1. Whether an exit plan and substitutability options exist Correct answer.
  2. Whether the vendor uses the same payroll provider
  3. Whether the vendor's marketing materials are current
  4. Whether the vendor's office lease is long enough

Explanation

Where a critical function cannot be performed in-house, the firm must understand substitutability and maintain a credible exit or transition plan so it is not locked into a failing provider. Exit planning and substitutability are core third-party resilience requirements.

Question 7Operational Resilience

Which activity best demonstrates a firm building organisational resilience through its people and culture?

  1. Storing a printed copy of the business continuity plan in a safe.
  2. Running regular cross-training so staff can cover critical roles during absence. Correct answer.
  3. Extending the duration of the annual internal audit.
  4. Purchasing additional server capacity for peak trading.

Explanation

Organisational resilience depends on people being able to absorb disruption, so cross-training and succession coverage for critical roles reduce key-person dependency. Physical plan copies and extra capacity address other dimensions of resilience but not workforce depth.

Question 8Operational Resilience

A firm sets an impact tolerance for a critical service and then discovers that its longest tested recovery time exceeds that tolerance. What is the most appropriate conclusion?

  1. The service should be reclassified as non-critical to remove the gap.
  2. The testing scenario should be softened so the gap disappears.
  3. A remediation plan should be created to close the gap within a defined timeframe. Correct answer.
  4. The impact tolerance should be raised to match the tested recovery time.

Explanation

A gap between tested recovery capability and the impact tolerance is precisely the output that resilience testing is meant to surface, and it should drive a time-bound remediation plan. Adjusting the tolerance, classification, or scenario to hide the gap defeats the purpose of the framework.

Question 9Operational Resilience

A firm maps a critical service and finds it depends on a single data centre, one network provider, and three key individuals. How should this dependency map be used?

  1. It should replace the firm's risk register entirely.
  2. It should be used to reduce the number of staff supporting the service.
  3. It should inform scenario design, testing, and remediation of single points of failure. Correct answer.
  4. It should be filed for the next regulatory examination and left unchanged.

Explanation

A dependency map is a working tool that identifies single points of failure and feeds directly into scenario selection, testing, and remediation prioritisation. Treating it as a static filing artefact or using it to cut staff would undermine its purpose.

Question 10Operational Resilience

A firm wants to test its ability to recover a critical service without disrupting live client activity. Which testing approach is most suitable?

  1. A full live failover of production systems during peak trading hours.
  2. Waiting for a real incident to occur and observing the response.
  3. Removing the impact tolerance for the duration of the test.
  4. A simulation or tabletop exercise using a severe but plausible scenario. Correct answer.

Explanation

Simulation and tabletop exercises allow the firm to explore response capability under severe but plausible scenarios without risking live client activity. Live production failover during peak hours and reliance on real incidents both create unacceptable risk or are not controlled tests.

Question 11Operational Resilience

A firm's incident response plan requires that severity classification be agreed within the first hour of detection. Why is early severity classification important for operational resilience?

  1. It fixes the final root cause of the incident.
  2. It removes the need for a post-incident review.
  3. It determines the colour scheme used in the incident report.
  4. It triggers the appropriate escalation, resources, and communication paths. Correct answer.

Explanation

Early severity classification drives escalation to the right governance level, mobilisation of resources, and timely communication to clients and regulators. It does not determine root cause, which is established later, nor does it eliminate the need for a review.

Question 12Operational Resilience

A firm identifies that a critical service relies on a fourth-party provider used by one of its outsourced vendors. What is the most appropriate resilience action?

  1. Terminate the outsourcing contract immediately in all cases.
  2. Require visibility of the fourth-party dependency and include it in testing and contingency planning. Correct answer.
  3. Assume the fourth party has the same resilience standards as the firm.
  4. Ignore the dependency because the firm has no direct contract with the fourth party.

Explanation

Fourth-party dependencies can transmit disruption through the supply chain even without a direct contract, so the firm should obtain visibility and incorporate the dependency into testing and contingency planning. Assuming equivalent standards or ignoring the dependency leaves the firm exposed.

Question 13Operational Resilience

Which measure most directly reduces the risk that a cyber incident disrupts a critical service beyond its impact tolerance?

  1. Segmenting networks and maintaining tested offline backups for critical systems. Correct answer.
  2. Increasing the marketing budget for the service.
  3. Outsourcing the service to a provider with no tested recovery plan.
  4. Holding more frequent client satisfaction surveys.

Explanation

Network segmentation limits lateral movement, and tested offline backups support recovery of critical systems without paying a ransom or relying on compromised infrastructure. Both directly reduce the likelihood and impact of cyber disruption to a critical service.

Question 14Operational Resilience

A firm's board wants assurance that the operational resilience programme is effective. Which reporting approach best supports this?

  1. Reporting only the number of incidents that were successfully hidden from clients.
  2. A one-off presentation at the start of the programme only.
  3. Regular reporting of impact tolerance breaches, test results, and open remediation actions. Correct answer.
  4. Reporting the total number of staff employed in the resilience team.

Explanation

Effective board assurance requires ongoing visibility of whether services remain within impact tolerance, what testing has revealed, and how remediation is progressing. A one-off presentation or headcount metrics do not demonstrate resilience outcomes.

Question 15Operational Resilience

A firm's business continuity plan assumes that staff can work from home, but a severe scenario involves a prolonged nationwide power outage affecting the home-working regions. What does this reveal?

  1. The plan contains an untested assumption that undermines its effectiveness in a severe scenario. Correct answer.
  2. The scenario should be disregarded because it is too unlikely.
  3. The plan is fully robust because home-working is always available.
  4. The firm should reduce the number of documented recovery procedures.

Explanation

Plans that rely on untested assumptions, such as continuous home-working capability, can fail when a severe scenario invalidates those assumptions. Severe but plausible scenarios are specifically designed to challenge such assumptions and expose weaknesses.

Question 16Operational Resilience

A firm has a recovery time objective of four hours for a critical service but its impact tolerance is two hours. What does this indicate?

  1. The recovery capability is insufficient and remediation is required. Correct answer.
  2. The impact tolerance should be ignored because it is lower.
  3. The recovery point objective must also be two hours.
  4. The recovery capability is aligned with the impact tolerance.

Explanation

The recovery time objective should be set so that recovery occurs within the impact tolerance. A four-hour objective against a two-hour tolerance means the firm could breach its tolerance before recovery is complete, so remediation is needed.

Question 17Operational Resilience

Which of the following best illustrates the concept of a 'severe but plausible' scenario in operational resilience testing?

  1. A planned office relocation over a weekend.
  2. A minor printer failure in a single back-office team.
  3. A simultaneous loss of a primary data centre and the main third-party network provider for several days. Correct answer.
  4. A routine software patch applied during a maintenance window.

Explanation

A severe but plausible scenario is extreme yet credible enough to warrant preparation, such as losing multiple interdependent components at once for an extended period. Routine events and planned changes do not test resilience at the limits of impact tolerance.

Question 18Operational Resilience

A firm's resilience framework requires that lessons learned from incidents and tests be tracked to closure. Which governance mechanism best supports this?

  1. An annual email reminding staff to be careful.
  2. A policy statement that remediation is important.
  3. A shared spreadsheet with no owner or due dates.
  4. A remediation log with named owners, due dates, and escalation for overdue items. Correct answer.

Explanation

Tracking remediation to closure requires clear ownership, deadlines, and escalation for overdue actions so that identified gaps are actually fixed. A log without owners or dates, or a policy statement alone, provides no accountability.

Question 19Operational Resilience

A firm relies on a single payment processor that serves 80 percent of its transaction volume. A disruption at the processor would breach the impact tolerance for a critical service. What resilience response is most appropriate?

  1. Increase the impact tolerance so the breach no longer occurs.
  2. Establish a secondary processing route or contingency arrangement and test it. Correct answer.
  3. Accept the risk without further action because the processor is reputable.
  4. Reduce the number of staff trained to operate the payment service.

Explanation

Where a single provider represents a concentration that could breach impact tolerance, the firm should establish and test a credible contingency or secondary route. Accepting the risk unmanaged or adjusting the tolerance hides rather than addresses the exposure.

Question 20Operational Resilience

A firm's testing programme finds that its incident communications to clients would be delayed because contact data is held only in a system hosted by the affected provider. What is the most insightful conclusion?

  1. A dependency in the communications process creates a single point of failure that undermines response. Correct answer.
  2. The communications plan is effective because it is documented.
  3. Client communications are not part of operational resilience.
  4. The firm should stop communicating with clients during incidents.

Explanation

Testing exposes that the communications process itself depends on the affected provider, creating a single point of failure that would delay client notification during an incident. Resilience requires redundant access to contact data and alternative communication channels.

Question 21Operational Resilience

A firm's board sets impact tolerances, but business units set recovery objectives independently without reference to those tolerances. What is the most likely consequence?

  1. Third-party risk will be eliminated.
  2. Impact tolerances will become more stringent over time.
  3. Recovery objectives will automatically align with impact tolerances.
  4. Recovery capability may be designed to a standard that does not meet the firm's impact tolerances. Correct answer.

Explanation

Recovery objectives must be derived from and sit inside the impact tolerances set for each important business service. Setting them independently risks designing recovery capability that cannot meet the tolerance, leaving the firm exposed to unacceptable harm.

Question 22Operational Resilience

A firm discovers that a critical service depends on an application that is no longer supported by its vendor and for which no internal expertise remains. Which combination of resilience weaknesses does this represent?

  1. Legacy technology risk and key-person dependency. Correct answer.
  2. Marketing concentration and brand dilution.
  3. Regulatory reporting error and accounting misstatement.
  4. Excess capacity and over-diversification.

Explanation

An unsupported application with no internal expertise combines legacy technology risk, where the system may fail without vendor support, with key-person dependency, where no one can maintain it. Both directly threaten the continuity of the critical service.

Question 23Operational Resilience

A firm's resilience testing shows it can recover its critical service within tolerance when a single component fails, but not when two interdependent components fail together. How should this result be interpreted?

  1. The service is fully resilient because single failures are covered.
  2. The result should be suppressed because it is inconvenient.
  3. The firm should reduce testing to single-component failures only.
  4. The testing has revealed a correlated failure mode that requires remediation. Correct answer.

Explanation

Resilience must hold under severe but plausible scenarios, which often involve correlated or simultaneous failures of interdependent components. A capability that only covers single failures leaves the firm exposed to realistic compound events and should drive remediation.

Question 24Operational Resilience

A firm's operational resilience framework is being reviewed. Which set of elements most completely reflects a mature framework?

  1. An annual risk workshop and a staff newsletter.
  2. Identification of important business services, impact tolerances, dependency mapping, scenario testing, and remediation governance. Correct answer.
  3. A business continuity plan and an insurance policy only.
  4. A list of IT assets and a disaster recovery runbook only.

Explanation

A mature framework connects the identification of important business services to impact tolerances, dependency mapping, severe but plausible scenario testing, and governance that tracks remediation to closure. Narrow documents such as a continuity plan or asset list cover only part of the lifecycle.

Question 25Operational Resilience

A firm is defining the scope of its operational resilience programme. Which set of services should the programme cover first?

  1. All services the firm offers to any client, regardless of size or substitutability
  2. Services whose disruption would harm clients, markets, or the firm's viability Correct answer.
  3. Only services delivered by external providers under formal contracts
  4. Only services that generate the largest share of annual revenue

Explanation

Operational resilience scopes its work around important business services, meaning those whose disruption could cause harm to clients, counterparties, markets, or the firm's own viability. Revenue size and outsourcing status are indicators that may inform the assessment but are not the defining test.

Question 26Operational Resilience

A firm has identified its important business services. What is the immediate next step in setting impact tolerances?

  1. Purchase additional insurance cover for the identified service failures
  2. Set the maximum tolerable level of disruption for each service, expressed in concrete terms Correct answer.
  3. Calculate the total cost of downtime for each service over a five-year horizon
  4. Commission an external audit of the resilience programme's governance structure

Explanation

Impact tolerance is the maximum tolerable level of disruption to an important business service, and it must be expressed concretely, for example as a duration or a volume of affected transactions. It is set before recovery objectives and testing, so that later work can be measured against it.

Question 27Operational Resilience

A firm is building a register of the resources that support an important business service. Which entry belongs in that register?

  1. The historical share price volatility of the firm's listed securities
  2. The list of competitors offering similar services to the same clients
  3. The key staff, technology, facilities, and third parties the service depends on Correct answer.
  4. The firm's marketing budget for the coming financial year

Explanation

A resource map identifies the people, processes, technology, facilities, and third-party dependencies that a service relies on to deliver its output. Mapping these dependencies is what allows the firm to see where a disruption could originate.

Question 28Operational Resilience

A firm wants its scenario testing to be meaningful. Which characteristic must a scenario have to qualify as severe but plausible?

  1. It must be limited to a single component failure so that results are easy to interpret
  2. It must be extreme enough to threaten the service while remaining credible for the firm's operating environment Correct answer.
  3. It must be approved by the external auditor before testing is permitted to begin
  4. It must be drawn from an event the firm has already experienced and recovered from

Explanation

A severe but plausible scenario stresses the service close to or beyond its impact tolerance while remaining credible given the firm's actual dependencies and threat environment. Scenarios that are impossible or trivially survivable provide no useful evidence about resilience.

Question 29Operational Resilience

A firm's board asks who owns the operational resilience framework. Which arrangement is most consistent with sound governance?

  1. The internal audit function owns and operates the resilience programme
  2. Each business line owns its own framework with no central coordination
  3. Ownership rotates annually among front-office desks to spread awareness
  4. A named executive is accountable for resilience, with clear escalation to the board Correct answer.

Explanation

Resilience governance requires clear accountability at senior executive level, with a defined reporting line to the board so that tolerances, testing results, and remediation are overseen. Diffuse or rotating ownership leaves no one answerable for the framework.

Question 30Operational Resilience

A firm's incident response plan has no defined procedure for deciding when an incident becomes a formal resilience event requiring board notification. What is the most direct consequence?

  1. Escalation will be inconsistent and some serious events may reach the board too late Correct answer.
  2. The firm will be unable to calculate the financial cost of the incident afterwards
  3. The firm's insurance premiums will automatically rise after the next incident
  4. Third-party providers will stop reporting incidents to the firm

Explanation

Without defined escalation triggers and thresholds, decisions about notifying senior management and the board depend on individual judgement and are likely to be late or inconsistent. Clear severity criteria and named decision-makers make escalation predictable.

Question 31Operational Resilience

A firm's critical service depends on a vendor whose contract contains no requirement to notify the firm of a cyber incident. What is the most effective remediation?

  1. Rely on public news reports to learn about incidents affecting the vendor
  2. Increase the volume of transactions routed to the vendor to strengthen the relationship
  3. Ask the vendor verbally to keep the firm informed of any problems
  4. Amend the contract to require timely incident notification and defined service levels Correct answer.

Explanation

Third-party resilience depends on contractual levers that require notification, service levels, and cooperation during disruption. Formal contractual obligations give the firm enforceable rights and a defined channel for information when an incident occurs.

Question 32Operational Resilience

A firm's testing shows that a critical service can be recovered within tolerance only if a specific backup site is available, but that site is shared with another business line that would also need it in the same scenario. What does this finding most likely indicate?

  1. There is a concentration risk in recovery resources that must be addressed Correct answer.
  2. The firm should stop testing this service because the result is inconclusive
  3. The impact tolerance is set too low and should be raised to match the recovery time
  4. The recovery plan is sound because a backup site exists and has been documented

Explanation

When two critical activities depend on the same recovery resource, the resource becomes a single point of failure under a severe scenario, which is a concentration risk. The firm must either separate the dependencies or demonstrate that the shared resource can serve both.

Question 33Operational Resilience

A firm wants to test a severe but plausible scenario without any risk to live client services. Which approach best fits that objective?

  1. Run the scenario against production during peak trading hours with real client transactions
  2. Simulate the scenario in a segregated environment using replicated systems and synthetic data Correct answer.
  3. Review the vendor's published business continuity certificate and file it as evidence
  4. Ask each business unit to complete a written questionnaire about its recovery arrangements

Explanation

Synthetic or segregated-environment simulation allows the firm to exercise recovery steps and decision-making without exposing live clients to disruption. It produces evidence about capability while containing the risk of the test itself.

Question 34Operational Resilience

A firm suffers a disruption that stays within its impact tolerance, but the post-incident review finds that staff improvised a workaround that was never documented. What is the most valuable follow-up action?

  1. Conclude that no action is needed because the tolerance was not breached
  2. Remove the affected service from the resilience programme scope
  3. Record the workaround, validate it, and incorporate it into the recovery plans Correct answer.
  4. Discipline the staff for deviating from the documented procedures

Explanation

Lessons learned must feed back into plans, and a workaround that worked under pressure is valuable operational knowledge. Capturing, validating, and embedding it improves future response, whereas punishing improvisation discourages the candour that makes reviews useful.

Question 35Operational Resilience

A firm's recovery objective for an important business service is six hours, but its impact tolerance is three hours. What is the correct interpretation?

  1. The impact tolerance should be revised upward to six hours
  2. The gap is immaterial because both figures are measured in hours
  3. The recovery capability is insufficient and remediation is required Correct answer.
  4. The service is resilient because recovery will occur within a normal working day

Explanation

Recovery capability must be at least as fast as the impact tolerance allows; a six-hour recovery against a three-hour tolerance means the firm would breach its tolerance in a severe event. The gap is a resilience deficiency requiring investment, redesign, or reduced dependency.

Question 36Operational Resilience

A firm's board report on operational resilience contains only a list of completed tests. Which addition would most improve the report's usefulness for oversight?

  1. A comparison of the firm's testing budget with peer institutions
  2. A statement that all tests were completed on schedule
  3. A longer narrative describing each test scenario in full technical detail
  4. A summary of open remediation actions with owners and target dates Correct answer.

Explanation

Boards need to see whether identified weaknesses are being fixed, by whom, and by when, alongside the testing evidence. Tracking remediation to closure converts test results into accountable management action.

Question 37Operational Resilience

A firm's important business service relies on a legacy application supported by a single engineer who is due to retire within a year. Which resilience action addresses the most direct vulnerability?

  1. Add the engineer to the firm's key person insurance policy
  2. Document the application's architecture and cross-train additional staff to support it Correct answer.
  3. Increase the application's transaction throughput capacity
  4. Schedule the application for decommissioning without a replacement plan

Explanation

Single-person dependency on knowledge is a key-person risk; documenting the system and building a wider support capability removes the dependency. Insurance compensates financially but does not restore the capability to run the service.

Question 38Operational Resilience

A firm's resilience testing has only ever covered the failure of individual components one at a time. A regulator asks the firm to demonstrate resilience to a severe but plausible event. What is the principal limitation of the existing programme?

  1. It relies on external providers rather than internal systems
  2. It cannot show how the service performs when several correlated failures occur together Correct answer.
  3. It measures recovery time but not recovery cost
  4. It uses too many scenarios, making the results difficult to summarise

Explanation

Component-by-component testing assumes failures occur in isolation, whereas severe events typically combine causes such as a cyber attack coinciding with a provider outage. Without testing correlated and compounding failures, the firm cannot demonstrate that tolerances hold in the scenarios that matter most.

Question 39Operational Resilience

A firm's critical service depends on a cloud provider that in turn relies on a smaller hosting company for a core function. The hosting company suffers a prolonged outage. Which statement best describes the firm's position?

  1. The firm has no exposure because it holds no contract with the hosting company
  2. The firm's regulator is responsible for managing the hosting company's recovery
  3. The firm faces fourth-party risk that should have been identified through due diligence on the provider's own dependencies Correct answer.
  4. The firm's exposure is limited to the fees it pays the cloud provider

Explanation

Fourth-party risk arises from the dependencies of the firm's direct providers, and it can disrupt the firm's service just as severely as a direct failure. Effective third-party risk management looks through to subcontractors and requires the direct provider to manage and disclose them.

Question 40Operational Resilience

A firm's board wants assurance that resilience investments are proportionate. Which approach best supports that judgement?

  1. Fund every remediation action identified in testing to the full amount requested
  2. Set a uniform spending cap per business service regardless of its importance
  3. Rank services by the severity of harm from disruption and compare remediation cost against the reduction in that harm Correct answer.
  4. Defer all remediation until the next annual testing cycle is complete

Explanation

Proportionate investment requires comparing the harm a disruption would cause with the cost of reducing it, so that the largest gaps against impact tolerance are addressed first. This harm-based prioritisation is how boards allocate finite resources across competing remediation demands.

Question 41Risk Management Frameworks

Under the three-lines-of-defense model used in operational risk governance, which group provides independent oversight and challenge of the risk-taking units?

  1. The external auditor engaged for the financial statements
  2. The business line that owns and manages the risk
  3. The independent risk management and compliance function Correct answer.
  4. The internal audit function reporting to the board

Explanation

In the three-lines model the first line is the business that owns and manages risk, the second line is an independent risk and compliance function that sets frameworks and challenges the first line, and the third line is internal audit, which provides independent assurance to the board. The second line is therefore the body charged with independent oversight and challenge rather than with owning the risk.

Question 42Risk Management Frameworks

A bank's board delegates day-to-day operational risk oversight to a board risk committee. Which arrangement best preserves effective governance?

  1. The committee is chaired by the head of internal audit
  2. The committee meets only when a loss event exceeds a threshold
  3. The committee approves the operational risk appetite and reports to the full board Correct answer.
  4. The committee delegates all decisions back to the business units

Explanation

A board risk committee adds value when it has a clear mandate, approves the risk appetite framework, monitors it, and reports upward to the full board so ultimate accountability stays with the board. Delegating decisions entirely back to the business, meeting only reactively, or having the audit head chair the committee would weaken independence and oversight.

Question 43Risk Management Frameworks

In an operational risk framework, what is the primary purpose of the risk appetite statement?

  1. To record losses that have already been realized
  2. To document the audit plan for the coming year
  3. To articulate the amount and type of risk the firm is willing to accept Correct answer.
  4. To list every identified operational risk in the inventory

Explanation

The risk appetite statement expresses, in qualitative and quantitative terms, how much and what kinds of risk the firm is prepared to accept in pursuit of its objectives. It guides limits, tolerances, and escalation, and is distinct from a risk register, a loss database, or an audit plan.

Question 44Risk Management Frameworks

A firm sets an operational risk appetite of no more than 15 major loss events per year, where major means above a defined threshold. Which element of a well-formed appetite does the threshold represent?

  1. The risk culture statement
  2. The risk capacity of the firm
  3. A key risk indicator trigger
  4. A quantitative tolerance or limit Correct answer.

Explanation

A quantified boundary such as a maximum number of events above a defined size is a tolerance or limit that makes the appetite measurable and monitorable. Risk capacity is the absolute maximum the firm could bear before failure, while indicators and culture statements are supporting tools rather than the limit itself.

Question 45Risk Management Frameworks

Which statement best describes the role of a risk register within an operational risk framework?

  1. It is a structured record of identified risks, their owners, controls, and ratings Correct answer.
  2. It captures only losses above the reporting threshold
  3. It is a regulatory capital calculation template
  4. It replaces the need for scenario analysis and control testing

Explanation

A risk register is the central inventory linking each identified risk to an owner, the controls in place, and an assessment of likelihood and impact. It complements rather than replaces scenario analysis, loss data, and control testing, and it is not itself a capital model.

Question 46Risk Management Frameworks

A firm uses a heat map plotting inherent risk likelihood against impact. A risk owner proposes moving a risk from high to medium by noting that existing controls are strong. What is the most appropriate treatment?

  1. Plot residual risk separately after control effectiveness is assessed Correct answer.
  2. Move the risk on the inherent heat map without further documentation
  3. Remove the risk from the register because controls are effective
  4. Reduce the impact score to reflect the control environment

Explanation

Inherent risk reflects exposure before controls, while residual risk reflects exposure after controls are assessed. The correct treatment is to keep the inherent position and plot a separate residual position supported by evidence of control effectiveness, rather than silently adjusting the inherent map or deleting the risk.

Question 47Risk Management Frameworks

According to the Basel Committee's principles on operational risk, which of the following is the most accurate description of operational risk?

  1. The risk of loss from movements in market prices and rates
  2. The risk that a counterparty fails to meet its contractual obligation
  3. The risk arising from changes in regulatory capital requirements
  4. The risk of loss resulting from inadequate or failed internal processes, people, and systems, or from external events Correct answer.

Explanation

The Basel definition frames operational risk as loss from inadequate or failed internal processes, people, and systems, or from external events. Market and credit risks are separate categories, and the definition is deliberately broad to capture legal, fraud, and systems failures.

Question 48Risk Management Frameworks

Which pair of event types is generally classified as operational risk rather than credit or market risk?

  1. A central bank rate rise and a fall in equity prices
  2. A ratings downgrade of a bond holding and a widening credit spread
  3. A rogue trader concealing positions and a system outage halting settlement Correct answer.
  4. A sovereign default and a counterparty bankruptcy

Explanation

Internal fraud such as a rogue trader and technology failures such as a system outage are classic operational risk events arising from people and systems. The other options describe credit events or market movements, which are managed under separate risk categories.

Question 49Risk Management Frameworks

A firm adopts the standardised approach for operational risk capital. Which statement about this framework is correct?

  1. It uses only historical operational losses with no reference to business size
  2. It requires the firm to model its own loss distribution internally
  3. It applies a business indicator or business-line based multiplier to derive the capital charge Correct answer.
  4. It is available only to firms using an internal models approach

Explanation

The standardised approach derives the operational risk capital charge from a business indicator or business-line measure multiplied by supervisory coefficients, so capital scales with business activity. It does not require the firm to build its own loss distribution model, which characterises internal-model approaches.

Question 50Risk Management Frameworks

Under the Basel operational risk capital framework, which component is used to scale the business indicator in the standardised approach?

  1. A supervisory marginal coefficient applied in bands to the business indicator Correct answer.
  2. The firm's external credit rating
  3. The firm's internal loss frequency over the last ten years
  4. The number of staff employed in the risk function

Explanation

The standardised approach applies supervisory marginal coefficients to bands of the business indicator to produce the capital charge, so larger business indicators attract progressively higher coefficients. Historical losses, headcount, and credit ratings are not the scaling mechanism in this framework.