FRM Exam Part II · Case Study: Investor Protection and Compliance Risks in Investment Activities

Investor Protection Case Study Lessons: Failures, Fines and Remediation

Updated 11 October 2026 · Fact-checked

A case study question gives you a firm that harmed investors, then asks why, what the penalty was and how to fix it. Trace the failure to its root cause in governance, culture, incentives or controls. Separate symptoms from causes. Then match the remedy to the cause, covering customer redress, control redesign and accountability.

Understand Case Study Lessons: Failures, Fines and Remediation

An investor-protection failure is a case where a firm's conduct left clients worse off than they were entitled to expect. Typical examples are mis-selling unsuitable products, hidden or conflicted fees, poor disclosure, and weak oversight of advisers. For FRM Part II, you treat these as compliance and operational risk events, not just bad luck.

Every case has a trigger, a root cause and a consequence. The trigger is what happened, such as advisers selling a complex product to retirees. The root cause is why it was allowed. Root causes usually sit in four places: governance (board and senior management did not challenge or oversee), culture (sales targets mattered more than client outcomes), incentives (pay rewarded volume, not suitability) and controls (monitoring, complaints data and product approval were weak or ignored).

The consequences come in layers. Regulators impose fines, order customer redress (refunds and compensation), restrict business, or require changes to management. The firm also bears legal costs, reputational damage and lost clients. Fines are often smaller than redress plus indirect costs, so do not judge severity by the fine alone.

Remediation is the fix. Good remediation addresses the cause, not just the symptom. It includes a look-back review of affected clients, compensation, redesigned product governance, changed incentive schemes, stronger second-line challenge and internal audit follow-up, and clear individual accountability. Weak remediation only pays the fine and leaves the culture unchanged, so the failure repeats.

The exam tests whether you can read a short scenario and name the failed element precisely: which line of defense failed, which control was missing, and which fix matches it. Stay with the facts given and avoid importing details of real cases that you are not sure about.

Key formulas to remember

Failure chain: Trigger → Root cause → Control failure → Harm → Penalty → Remediation; Use this order to structure any case answer. The fix must match the root cause.
Root-cause categories: Governance + Culture + Incentives + Controls; Most cases involve more than one. Pick the one the scenario emphasises.
Total cost of a failure: Total cost = Fines + Customer redress + Remediation cost + Legal cost + Lost business; Fines are only one part. Redress is often larger.
Redress estimate: Redress = Σ (Client loss + Interest) over affected clients; Compensation aims to put clients back where they would have been had the sale been suitable.
Three lines of defense: 1st line: business owns risk | 2nd line: risk and compliance oversee | 3rd line: internal audit assures; Identify which line failed when answering.

How to solve Case Study Lessons: Failures, Fines and Remediation questions

Use the same sequence for any case-style question on investor-protection failures.

1Read the last sentence first to see whether the question asks for cause, penalty, control failure or remediation.
2Identify the trigger: what conduct harmed clients (mis-selling, conflict, poor disclosure, weak supervision).
3Find the root cause by asking why the firm allowed it. Look for sales targets, pay linked to volume, ignored complaints or a passive board.
4Name the control that failed, and the line of defense responsible.
5Separate symptoms (complaints, losses) from causes (incentives, culture, governance).
6Match the remedy to the cause: incentive redesign for pay problems, product governance for unsuitable products, board accountability for oversight gaps.
7Check that the remedy includes customer redress and follow-up testing, not just a fine.
8Eliminate options that fix only the symptom or that blame a single employee.

Quickest way: Cause-to-fix matching

When to use it: Use for multiple-choice questions when time is short and the options mix causes, penalties and fixes.

Underline the one clue about pay, targets, oversight or data in the stem.
Map it to a root cause: pay or targets = incentives; leadership tone = culture; no challenge = governance; missed alerts = controls.
Pick the option that fixes that cause directly.
Reject options that only mention a fine or retraining the individual.
Prefer answers that include redress for clients and independent verification.

Common mistakes in Case Study Lessons: Failures, Fines and Remediation

Naming the symptom as the root cause, such as saying the cause was high complaint numbers.
Complaints are visible in the case, so they feel like the answer.
Fix: Ask why complaints were not acted on. The cause is usually weak governance, culture or incentives.
Blaming one rogue employee.
It is the simplest story.
Fix: If the behaviour was widespread or rewarded, the failure is systemic. Look at incentives and oversight.
Judging severity by the size of the fine only.
The fine is the headline figure.
Fix: Add redress, remediation, legal and reputational costs before comparing.
Choosing remediation that does not match the cause, such as more training for an incentive problem.
Training is a familiar generic answer.
Fix: Change what is rewarded. Training alone does not remove a pay structure that encourages mis-selling.
Ignoring the second and third lines of defense.
Candidates focus on the sales desk.
Fix: Ask whether compliance challenged the business and whether internal audit followed up earlier findings.
Importing facts from real cases you only half remember.
Candidates try to show extra knowledge.
Fix: Answer only from the facts in the question.

Worked examples

Example 1

A bank's advisers sell a complex structured note to retired clients. Bonuses depend on note sales volume. Compliance flagged rising complaints for a year, but senior management took no action. Which is the best identification of the root cause and the matching remediation?
A) Root cause: adviser training gap; fix: more product training
B) Root cause: volume-based incentives and weak management response; fix: redesign incentives, review affected clients and compensate
C) Root cause: market volatility; fix: hedge the notes
D) Root cause: rogue adviser; fix: dismiss one adviser

Show the solution

Trigger: complex product sold to retirees, suggesting suitability failure.
Clue 1: bonuses depend on sales volume. This is an incentive root cause.
Clue 2: complaints flagged for a year with no action. This is a governance and culture failure.
Option A treats the issue as a knowledge gap, which the facts do not show.
Option C blames markets and ignores the sales conduct.
Option D treats a systemic pattern as one person's fault.
Option B addresses both causes and includes client redress.

Answer: B

Example 2

A firm is fined ₹40 crore for mis-selling. It must also refund 5,000 clients an average of ₹2,00,000 each. Remediation programme costs ₹25 crore. Ignoring other costs, what is the total direct cost, and what share is the fine?

Show the solution

Redress = 5,000 × ₹2,00,000 = ₹100,00,00,000 = ₹100 crore.
Total direct cost = fine + redress + remediation = ₹40 crore + ₹100 crore + ₹25 crore = ₹165 crore.
Fine share = 40 ÷ 165 = 0.2424, about 24.2%.
So the fine is under a quarter of the direct cost.

Answer: Total direct cost is ₹165 crore; the fine is about 24.2% of it.

Exam tips

Read for the clue word: bonus, target, ignored, escalated, override. Each points to a root cause.
When options include both a fine and a redesign of controls or incentives, the cause-based fix is usually the stronger answer.
Check which line of defense failed before choosing a remedy.
Do the arithmetic on total cost if numbers are given, and include redress.
Do not use outside facts about named real cases; the stem gives what you need.

Practice questions from Case Study: Investor Protection and Compliance Risks in Investment Activities

Case Study Lessons: Failures, Fines and Remediation: frequently asked questions

How do I answer an FRM Part II operational risk case study question?

Find the trigger, then the root cause, then the failed control, then the matching remedy. Check which option links the cause to the fix. Avoid options that only mention a fine or blame one person.

What are the common root causes of compliance failures in investment firms?

They sit in governance, culture, incentives and controls. Typical signs are sales-driven pay, weak challenge from second-line functions, and ignored complaints or alerts. Most cases involve several together.

Is the fine the main cost of a mis-selling failure?

Not usually. Customer redress, remediation work, legal costs and lost business can add up to more than the fine. Compare total cost, not the fine alone.

What does good remediation include?

It includes compensating affected clients, fixing the root cause such as incentives or product governance, strengthening second-line oversight, and having internal audit verify the fixes. It also sets clear accountability for senior managers.