CBA Risk Management Auditing 2 — Questions and Answers
Question 1: When auditing a bank's credit concentration risk, which metric is most critical to evaluate?
- Net interest margin by loan type
- Single borrower exposures as a percentage of Tier 1 capital (Correct answer)
- Total non-interest income from lending fees
- Loan-to-deposit ratio across all branches
Correct answer: Single borrower exposures as a percentage of Tier 1 capital
Single borrower concentration relative to Tier 1 capital is the primary regulatory metric for measuring credit concentration risk.
Question 2: A bank's ALCO has approved a duration gap of +2.5 years. As an auditor, what is your primary concern?
- The bank is positioned to benefit from rising rates, which is always acceptable
- A positive duration gap exposes the bank to falling net interest income if rates rise (Correct answer)
- A positive duration gap means assets reprice faster than liabilities
- Duration gaps are only relevant for investment portfolio management
Correct answer: A positive duration gap exposes the bank to falling net interest income if rates rise
A positive duration gap means asset durations exceed liability durations, causing net interest income to decline when interest rates rise.
Question 3: Which of the following best describes residual risk in a bank's risk management framework?
- The total gross risk before any controls are applied
- The risk remaining after management controls and mitigants have been applied (Correct answer)
- Risk transferred to a third party through insurance or derivatives
- The risk assigned to the internal audit function for monitoring
Correct answer: The risk remaining after management controls and mitigants have been applied
Residual risk is the exposure that remains after inherent risk is reduced by the effectiveness of existing controls.
Question 4: An auditor reviewing operational risk finds that a bank has not updated its Business Continuity Plan (BCP) in three years. Which risk is most directly elevated?
- Credit risk from unrecovered loan portfolios
- Strategic risk from outdated product offerings
- Operational risk from untested recovery capabilities (Correct answer)
- Compliance risk from failure to file regulatory reports
Correct answer: Operational risk from untested recovery capabilities
An outdated and untested BCP leaves the bank vulnerable to operational disruptions it cannot recover from efficiently.
Question 5: Under Basel III, the Liquidity Coverage Ratio (LCR) requires banks to hold enough High-Quality Liquid Assets (HQLA) to cover what scenario?
- A 30-day stress period of significant liquidity outflows (Correct answer)
- A 90-day period of normal market operations
- A one-year horizon under Basel-defined macro stress
- A 10-day period matching Value-at-Risk calculations
Correct answer: A 30-day stress period of significant liquidity outflows
The LCR requires banks to hold HQLA sufficient to cover net cash outflows over a 30-day stressed scenario.
Question 6: When auditing model risk, which finding would represent the highest severity deficiency?
- Model documentation is stored in a shared drive rather than a dedicated repository
- A credit scoring model in production use has never been independently validated (Correct answer)
- Model validation reports are completed annually rather than semi-annually
- The model inventory spreadsheet has not been updated in two months
Correct answer: A credit scoring model in production use has never been independently validated
Using a production model without independent validation is a critical control failure that exposes the bank to undetected model errors affecting credit decisions.
Question 7: A bank's risk appetite statement sets a maximum tolerable loss from market risk at $5M per quarter. Current VaR estimates are $4.8M. What should the auditor recommend?
- No action is needed because actual loss has not exceeded the limit
- Escalate because VaR is approaching the risk appetite threshold with little buffer (Correct answer)
- Reduce the risk appetite limit to $4M to create a larger buffer
- Transfer market risk to off-balance-sheet entities to reduce reported VaR
Correct answer: Escalate because VaR is approaching the risk appetite threshold with little buffer
Proximity to appetite limits with minimal buffer warrants escalation so management can take proactive corrective action before a breach occurs.
CBA Risk Management Auditing 2
When auditing a bank's credit concentration risk, which metric is most critical to evaluate?