Operational Risk Management Flashcards
7 cards from real APRP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Operational Risk Management flashcards as text
A payments processor experiences a surge in chargebacks due to a compromised merchant. Which operational risk control should be triggered FIRST?
Answer: Suspend the merchant account pending investigation
Suspending the merchant account is the immediate containment action to stop further fraud exposure before escalating to networks or regulators.
Under the Basel II operational risk framework, which loss event type category covers payment processing errors caused by system failures?
Answer: Business disruption and system failures
Basel II classifies system outages and technology failures under 'Business Disruption and System Failures,' distinct from process errors.
A payment firm's key risk indicator (KRI) for failed settlement transactions exceeds its threshold. What is the primary purpose of a KRI threshold breach?
Answer: To signal that a risk may be approaching unacceptable levels requiring management action
KRI thresholds serve as early-warning signals prompting management review and corrective action before losses materialize.
Which method for calculating operational risk capital under Basel II/III uses a fixed percentage of gross income averaged over three years?
Answer: Basic Indicator Approach (BIA)
The Basic Indicator Approach applies a 15% alpha factor to average positive annual gross income over the preceding three years.
A payments company wants to transfer operational risk exposure for large-scale data breaches to a third party. The BEST mechanism to accomplish this is:
Answer: Purchasing cyber liability insurance
Cyber liability insurance is a risk transfer mechanism that shifts financial consequences of data breaches to an insurer.
In a payments operational risk context, 'tail risk' BEST refers to:
Answer: Low-probability, high-severity loss events that fall in the extreme tail of a loss distribution
Tail risk describes rare but catastrophic events in the far end of a statistical loss distribution, such as a major system outage affecting billions in transactions.
An APRP candidate reviewing a vendor contract notices the agreement lacks provisions for audit rights and incident notification timelines. This gap PRIMARILY creates which type of risk?
Answer: Third-party operational risk due to inadequate oversight controls
Missing audit rights and incident notification requirements are third-party operational risk gaps that reduce the firm's ability to monitor and respond to vendor failures.