Operational Risk & Resilience

FRM® Part II, published weight 20%. RCSA and loss data, model risk, cyber, third parties, financial crime, Basel.

What the outline covers

Operational risk taxonomy, RCSA and loss data collection
Modelling operational risk loss distributions; capital approaches
Risk governance, risk appetite and the three lines of defence
Model risk management and validation
Cyber risk and information security; third-party and outsourcing risk
Business continuity and operational resilience
Financial crime: money laundering, sanctions and fraud
Basel operational risk framework; regulation and supervision
Stress testing and enterprise risk management

Sample questions

These 5 questions are free in the app too. Try each one before opening the answer.

Question 1

In a loss distribution approach, operational loss frequency is most commonly modelled with:

A. A lognormal distribution
B. A Poisson distribution
C. A generalised Pareto distribution
D. A Student t distribution

Show the answer

B. Frequency is a count over a fixed period, which the Poisson distribution describes. Severity is typically lognormal, with a Pareto tail.

Reading: Operational Risk — Modelling Loss Distributions

Question 2

A firm’s risk management function both designs the control framework and performs the independent assurance review of it. This most directly compromises:

A. The first line of defence
B. The separation of the second and third lines of defence
C. The board’s risk appetite statement
D. The RCSA process only

Show the answer

B. Independent assurance belongs to internal audit, the third line. A function cannot independently assure the controls it designed.

Reading: Operational Risk — Three Lines of Defence

Question 3

A model validated successfully on historical data fails badly in a new market regime. This is best classified as a failure of:

A. Implementation accuracy
B. Conceptual soundness
C. Data quality controls
D. Change management

Show the answer

B. The model was built and coded correctly but rests on assumptions that do not hold in the new regime — a conceptual soundness failure.

Reading: Operational Risk — Model Risk Management

Question 4

A firm outsources a critical process to a third party that suffers an outage. Regulatory accountability for the disruption rests with:

A. The third party alone
B. The firm, which cannot outsource accountability
C. Both parties equally by default
D. Neither, if the contract contains a force majeure clause

Show the answer

B. Outsourcing an activity never outsources the accountability. The firm remains responsible for the resilience of its critical services.

Reading: Operational Risk — Third-Party and Outsourcing Risk

Question 5

Internal loss data alone is generally insufficient for operational risk capital because it:

A. Is not audited
B. Is too sparse in the tail to estimate extreme severity
C. Overstates high-frequency low-severity events
D. Cannot be used under Basel rules

Show the answer

B. A single firm rarely experiences enough extreme events to estimate the tail, so external data and scenario analysis supplement internal data.

Reading: Operational Risk — Loss Data Collection

Practise more

The app adds snapshot cards, timed question sessions and a spaced-repetition review queue for this topic area, and works offline.

Get Cornerstone on Google Play (Android)

Follow the daily questions on WhatsApp

All FRM topic areas · FRM glossary

Cornerstone is an independent study aid. It is not affiliated with, authorised by, endorsed by or sponsored by GARP.