CBA Auditing Risk Management 2 — Questions and Answers
Question 1: A bank's risk appetite statement should primarily be approved and owned by which group?
- Internal audit committee
- Board of directors (Correct answer)
- Chief Risk Officer alone
- External auditors
Correct answer: Board of directors
The board of directors is responsible for approving and owning the bank's risk appetite statement as part of its governance obligations.
Question 2: Which risk management framework component ensures that identified risks are continuously tracked and reported to management?
- Risk identification
- Risk monitoring and reporting (Correct answer)
- Risk appetite setting
- Risk transfer
Correct answer: Risk monitoring and reporting
Risk monitoring and reporting is the component that ensures ongoing tracking and escalation of identified risks to appropriate management levels.
Question 3: When auditing a bank's market risk framework, an auditor discovers that Value-at-Risk (VaR) back-testing results frequently exceed the confidence interval threshold. This indicates:
- The VaR model is overly conservative
- The VaR model may be understating actual risk exposure (Correct answer)
- Back-testing is being performed too frequently
- Market conditions are unusually stable
Correct answer: The VaR model may be understating actual risk exposure
Frequent breaches of VaR confidence thresholds during back-testing suggest the model is underestimating actual risk, a significant model risk concern.
Question 4: Under Basel III, the Liquidity Coverage Ratio (LCR) requires banks to maintain sufficient high-quality liquid assets (HQLA) to cover net cash outflows for how many days?
- 7 days
- 14 days
- 30 days (Correct answer)
- 60 days
Correct answer: 30 days
The LCR requires banks to hold enough HQLA to cover projected net cash outflows over a 30-day stressed liquidity scenario.
Question 5: An auditor reviewing a bank's credit risk controls finds that loan officers have authority to approve credits up to their delegated limit without secondary review. The key control to verify is:
- Loan pricing models are accurate
- Delegated authority limits are documented, enforced, and periodically reviewed (Correct answer)
- Collateral valuations are conducted internally
- Credit analysts report directly to the CFO
Correct answer: Delegated authority limits are documented, enforced, and periodically reviewed
Ensuring delegated lending authority limits are documented, properly enforced, and subject to periodic review is the critical control in managing credit approval risk.
Question 6: Which of the following best describes 'concentration risk' in a banking context?
- Risk arising from high employee turnover in the risk department
- Excessive exposure to a single borrower, sector, or geography (Correct answer)
- The risk that interest rates will change unexpectedly
- Risk from foreign currency transactions
Correct answer: Excessive exposure to a single borrower, sector, or geography
Concentration risk arises when a bank has excessive exposure to a single counterparty, industry, or geographic region, creating vulnerability to correlated losses.
Question 7: During an audit of a bank's stress testing program, the auditor should evaluate whether stress scenarios are:
- Limited to historical events only to ensure credibility
- Sufficiently severe, plausible, and cover multiple risk types simultaneously (Correct answer)
- Developed exclusively by external consultants
- Applied only to trading book exposures
Correct answer: Sufficiently severe, plausible, and cover multiple risk types simultaneously
Effective stress scenarios must be severe yet plausible and should capture interdependencies across multiple risk types to be meaningful for capital planning.
CBA Auditing Risk Management 2
A bank's risk appetite statement should primarily be approved and owned by which group?