CRA Operational Risk Management 2 — Questions and Answers
Question 1: Under Basel III, which approach for calculating operational risk capital requires banks to use their own internal loss data combined with a business indicator component?
- Basic Indicator Approach
- Standardized Approach
- Standardized Measurement Approach (Correct answer)
- Advanced Measurement Approach
Correct answer: Standardized Measurement Approach
The Standardized Measurement Approach (SMA) introduced in Basel III combines the Business Indicator Component with Internal Loss Multiplier derived from a bank's own historical loss data.
Question 2: A manufacturing firm experiences a cyberattack that disrupts production for 72 hours. Which operational risk loss event category best classifies this incident?
- Internal Fraud
- Clients, Products and Business Practices
- Business Disruption and System Failures (Correct answer)
- Damage to Physical Assets
Correct answer: Business Disruption and System Failures
Business Disruption and System Failures covers losses from disruption of business or system failures, including cyberattacks that halt operations.
Question 3: What is the primary purpose of a Risk Control Self-Assessment (RCSA) in operational risk management?
- To calculate regulatory capital requirements
- To identify, assess, and document operational risks and control effectiveness (Correct answer)
- To report losses to regulators
- To benchmark risk levels against industry peers
Correct answer: To identify, assess, and document operational risks and control effectiveness
RCSA enables business units to identify their operational risks, evaluate the design and effectiveness of controls, and document residual risk exposure.
Question 4: An employee in the settlements department consistently bypasses dual-control procedures to meet end-of-day deadlines. This is best described as which type of operational risk?
- External fraud
- Execution, Delivery and Process Management failure (Correct answer)
- Employment Practices violation
- Clients, Products and Business Practices breach
Correct answer: Execution, Delivery and Process Management failure
Bypassing dual-control is a process management failure classified under Execution, Delivery and Process Management, one of the seven Basel II event types.
Question 5: Which metric is most appropriate as a Key Risk Indicator (KRI) for monitoring IT operational risk?
- Return on equity
- Number of unplanned system outages per quarter (Correct answer)
- Net interest margin
- Loan-to-deposit ratio
Correct answer: Number of unplanned system outages per quarter
Number of unplanned system outages is a forward-looking KRI that signals increasing IT operational risk before a material loss event occurs.
Question 6: In a loss distribution approach (LDA), what two distributions are typically combined to model aggregate operational risk losses?
- Normal and log-normal distributions
- Frequency and severity distributions (Correct answer)
- Binomial and Poisson distributions
- Uniform and exponential distributions
Correct answer: Frequency and severity distributions
The LDA combines a frequency distribution (how often losses occur) and a severity distribution (how large each loss is) to derive an aggregate loss distribution.
Question 7: Which of the following best describes 'tail risk' in the context of operational risk capital modeling?
- The risk that interest rates will change unexpectedly
- Extreme low-frequency, high-severity losses beyond the 99th percentile (Correct answer)
- Losses from routine daily operational errors
- The risk of regulatory capital falling below minimum thresholds
Correct answer: Extreme low-frequency, high-severity losses beyond the 99th percentile
Tail risk in operational risk refers to extreme, rare loss events that fall in the far right tail of the loss distribution, typically beyond the 99th or 99.9th percentile.
CRA Operational Risk Management 2
Under Basel III, which approach for calculating operational risk capital requires banks to use their own internal loss data combined with a business indicator component?