01. A bank has spent a year rebuilding the controls in the business line responsible for most of its recorded operational losses, and that line has since recorded far fewer events. Its head expects the operational risk capital requirement to fall in the current reporting period and is told it will not.
Which explanation of the requirement BEST accounts for that?
a) Control improvements are recognized in the requirement only where a bank holds supervisory approval to model its own operational risk.
b) The bank's own loss data plays no part in setting the requirement, which is built from industry-wide loss experience instead.
c) The measure's loss element is built from the loss experience the bank has accumulated, and better outcomes register only as they work through that record.
d) The requirement is fixed by the supervisor for each bank individually and does not respond to that bank's loss experience at all.
02. A business unit's risk register names an accountable owner for every risk. Several of the controls relied on are operated by a shared services team in another division, and the register records each of those controls without naming anyone accountable for operating it.
Which correction does the register need?
a) Each control should carry a named owner accountable for operating it, alongside the risk owner who remains accountable for the exposure.
b) The controls operated outside the unit should be removed from the register and tracked by the division that runs them.
c) The unit's risk owner should re-perform each of those controls locally, with the shared services output used as a check.
d) The shared services team should take ownership of the risks its controls address, since it performs the work on them.
03. A compliance team is setting its monitoring plan by working through the rulebook and mapping each obligation to an activity. One activity that generates significant revenue is not addressed by any specific rule, and the team proposes to leave it out of the plan on that basis.
Which response to that proposal is BEST supported?
a) The activity stays out, since monitoring without a written obligation has no standard to reach a finding against.
b) The activity stays in, because fairness and market-integrity expectations apply where no specific rule has been written.
c) The activity stays out until a rule is made, at which point the plan can be reopened and the activity brought in.
d) The activity stays in only while its revenue remains material, since monitoring effort should follow where the money is.
04. A firm appoints a chief risk officer who reports to the head of its largest business division and whose objectives are set by that head. The division accounts for most of the firm's operational risk exposure.
Which feature of this arrangement is the concern?
a) The CRO will be drawn into performing the division's control checks instead of setting the framework.
b) The CRO will lack the operating knowledge of the division that effective challenge of it requires.
c) The CRO's challenge is directed at the person who determines the CRO's own standing.
d) The CRO will have no route through which the division's exposures can be reported to the board at all.
05. A firm is a week from launching a savings product designed for a customer group it has not served before. The new product committee has approved the pricing, the legal terms and the marketing, and the operational risk team has been asked to comment before the launch date.
Which contribution is MOST valuable at this point?
a) Scheduling a risk and control self-assessment of the product and its servicing processes for the end of its first quarter.
b) Establishing whether the processes, systems and third parties that will service the product can support it, and which controls will be in place on the first day.
c) Confirming that the product's risks fall inside the categories that the firm's existing risk taxonomy already lists and reports.
d) Estimating the frequency, severity and likely cost of the operational losses the product may generate in its first year.
06. A firm relies on an external administrator to perform the daily reconciliation of client money balances. The firm's control register records this control as effective, on the strength of an annual letter from the administrator confirming that the reconciliation is performed.
Which weakness does that basis for the rating carry?
a) The frequency of the letter is the flaw here, and a letter arriving monthly in the same form would settle the point.
b) The control cannot be rated at all while it is performed outside the firm's own systems.
c) The reconciliation should be re-performed inside the firm, since a control over client money cannot be delegated at all.
d) The rating rests on the provider's own account of its work, with no evidence the reconciliation actually ran.
07. A firm treats climate risk as a matter for its lending and investment analysis, and its operational risk framework makes no reference to it. The operational risk team is asked whether anything is being missed.
Which exposure does that treatment MOST directly leave uncovered?
a) Nothing, because climate exposure reaches a lender through the assets it holds and is properly measured there.
b) Nothing, because climate exposure reaches a lender through the assets it holds and is properly measured there.
c) The cost of preparing and assuring the disclosures the firm publishes about its environmental exposure.
d) The reputational damage from an environmental incident at a site the firm occupies, and the cost of restoring the site to use.
08. A payments operation records a steady, predictable volume of small processing errors every month, and the cost of correcting them varies little from period to period. The head of the unit proposes holding operational risk capital against that cost.
Which treatment of the cost is correct?
a) It should be held as capital until the error rate falls, at which point the amount can be released back into the unit's budget.
b) It should be excluded from the operational risk framework entirely, since predictable errors are a matter of processing efficiency.
c) It should be held as operational risk capital, because the errors arise from the firm's own processes rather than outside events.
d) It belongs in provisions and in the price of the service, since it is a loss the firm expects to bear.
09. A small firm with a single business line and few staff adopts, unchanged, the operational risk governance structure of a large international bank: several committees, a layered set of policies, and a monthly reporting cycle for each of them.
Which criticism of that decision is well founded?
a) The governance a large bank uses is built for the credit and market exposures that dominate it, and leaves operational risk aside.
b) The structure should be proportionate to the firm's size and complexity, with the same accountabilities carried in fewer forums.
c) The firm should defer building governance until its size and complexity make a formal structure necessary for it.
d) A structure copied from a larger firm cannot be applied by a firm whose risks are of a different type.
10. An operational risk issue was raised when a reconciliation control was found not to be operating. The owner reports that a new procedure has been written and the team briefed on it, and asks for the issue to be closed at the next risk committee.
What should happen before the issue is closed?
a) Someone independent of the owner should confirm that the reconciliation control is now operating.
b) The committee should extend the due date and revisit the issue at the unit's next self-assessment.
c) The issue should be converted into a formal risk acceptance, since the procedure change has removed the original gap.
d) The meeting should record the owner's report and close the issue, with the new procedure attached as the evidence.