Operational Risk Management Flashcards
7 cards from real CRA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Operational Risk Management flashcards as text
Under Basel III, which approach for calculating operational risk capital requires banks to use their own internal loss data combined with a business indicator component?
Answer: Standardized Measurement Approach
The Standardized Measurement Approach (SMA) introduced in Basel III combines the Business Indicator Component with Internal Loss Multiplier derived from a bank's own historical loss data.
A manufacturing firm experiences a cyberattack that disrupts production for 72 hours. Which operational risk loss event category best classifies this incident?
Answer: Business Disruption and System Failures
Business Disruption and System Failures covers losses from disruption of business or system failures, including cyberattacks that halt operations.
What is the primary purpose of a Risk Control Self-Assessment (RCSA) in operational risk management?
Answer: To identify, assess, and document operational risks and control effectiveness
RCSA enables business units to identify their operational risks, evaluate the design and effectiveness of controls, and document residual risk exposure.
An employee in the settlements department consistently bypasses dual-control procedures to meet end-of-day deadlines. This is best described as which type of operational risk?
Answer: Execution, Delivery and Process Management failure
Bypassing dual-control is a process management failure classified under Execution, Delivery and Process Management, one of the seven Basel II event types.
Which metric is most appropriate as a Key Risk Indicator (KRI) for monitoring IT operational risk?
Answer: Number of unplanned system outages per quarter
Number of unplanned system outages is a forward-looking KRI that signals increasing IT operational risk before a material loss event occurs.
In a loss distribution approach (LDA), what two distributions are typically combined to model aggregate operational risk losses?
Answer: Frequency and severity distributions
The LDA combines a frequency distribution (how often losses occur) and a severity distribution (how large each loss is) to derive an aggregate loss distribution.
Which of the following best describes 'tail risk' in the context of operational risk capital modeling?
Answer: Extreme low-frequency, high-severity losses beyond the 99th percentile
Tail risk in operational risk refers to extreme, rare loss events that fall in the far right tail of the loss distribution, typically beyond the 99th or 99.9th percentile.