FRM P2 Operational Risk and Resilience: practice questions with answers

Answer: C. The BIC uses marginal coefficients, like income tax bands: 12% on BI up to €1bn, 15% on BI from €1bn to €30bn, and 18% on BI above €30bn.

BIC = 1 × 12% + (30 − 1) × 15% + (42 − 30) × 18% = 0.12 + 4.35 + 2.16 = €6.63 billion.

Answer: B. Key Basel III loss-data rules for the standardised approach: losses are included using the date of accounting; losses are recorded net of recoveries, including insurance recoveries, but a recovery can reduce a loss only after the payment is received; boundary losses related to credit risk that are already in credit RWA are excluded; operational losses related to market risk (such as booking errors that create trading losses) are included. The general collection threshold is €20,000 (which supervisors may raise to €100,000 for buckets 2 and 3), and the LC is based on 10 years of high-quality data.

Answer: C. The BCBS report (December 2018) compared cyber-resilience regulation and supervision across member jurisdictions. Its main findings included:

- High-level expectations were converging, but technical specifications and supervisory practices were fragmented.
- Specific cyber strategies were generally not required; cyber risk was managed mostly through existing IT and operational risk frameworks, with the three lines of defence widely used.
- Skills shortages were a common problem.
- Testing: protection and detection testing was widespread and evolving; response and recovery testing was less common.
- Incident response plans were required, but no standard set of metrics existed.
- Information sharing varied widely.
- Outsourcing frameworks were established, but banks must manage third-party dependencies and concentration beyond formal outsourcing.

The testing gap matters because cyber resilience assumes that some attacks will succeed: the ability to respond and recover is what keeps critical services running.

Answer: A. ILM = ln(e − 1 + (LC/BIC)^0.8). It equals ln(e) = 1 exactly when LC = BIC, is above one when LC > BIC and below one when LC < BIC.

- BIC (marginal coefficients) = 1 × 12% + (18 − 1) × 15% = 0.12 + 2.55 = €2.67bn.
- LC = 15 × average annual losses, so LC = BIC when average losses = 2.67 / 15 = €178 million.

Above this level of historical losses the bank's own loss experience pushes operational risk capital above the BIC.

Answer: C. The FSB's risk culture indicators are tone from the top, accountability, effective communication and challenge, and incentives. When the misconduct is widespread rather than isolated, the cause is usually systemic: here, a compensation scheme that rewards sales volume with no adjustment for risk or conduct, combined with failure to escalate early warning signs such as rising complaints.

Effective remediation aligns incentives with risk appetite (balanced scorecards, conduct and risk metrics, malus and clawback), protects whistle-blowing and challenge, and makes senior managers accountable. Training, dismissals and more KRIs are supporting measures but do not change the behaviour the bank pays for.

Answer: B. Total capital = √(300² + 200² + 2 × 0.25 × 300 × 200) = √(90,000 + 40,000 + 30,000) = √160,000 = $400m. The diversification benefit is 500 − 400 = $100m.

Euler (covariance) allocation: EC_i = EC_total × Cov(L_i, L) / Var(L). With capital proportional to standard deviation this gives EC_i = (EC_i² + ρ × EC_bank × EC_AM) / EC_total:

- Banking: (300² + 0.25 × 300 × 200) / 400 = $262.5m
- Asset management: (200² + 0.25 × 300 × 200) / 400 = $137.5m

The allocations add up to the $400m total, and each unit is charged for its contribution to group risk. Incremental capital (banking 400 − 200 = 200; asset management 400 − 300 = 100) adds up to only $300m.