Skip to content

FRM Exam Part II · Digital Resilience and Financial Stability: The Quest for Policy Tools in the Financial Sector

Operational and Cyber Risk as Systemic Threats

Updated 11 October 2026 · Fact-checked

Operational and cyber risk become systemic when one incident, such as an attack on a shared provider or market infrastructure, disrupts many institutions at once. Spread happens through common technology, payment links, and loss of trust. To solve questions, identify the shock, the channel, the amplifier, and the policy tool.

Understand Operational and Cyber Risk as Systemic Threats

Operational risk is the risk of loss from failed processes, people, systems or external events. Cyber risk is a subset: loss from malicious or accidental compromise of digital systems and data. Not every operational failure is cyber (a flood or a staff error is not), and not every cyber event is a financial loss at first (a data breach may cost reputation before cash).

A risk is systemic when it can impair the financial system as a whole, not just one firm. For cyber, the key point is that firms in the same system share technology, vendors and networks. A failure in one place can therefore become a failure everywhere.

There are three main spread channels. First, common dependencies: many banks use the same cloud provider, software vendor or messaging network, so one outage or compromise hits all of them. Second, financial interconnectedness: if a bank cannot send payments, its counterparties do not receive funds and in turn cannot pay others. Third, confidence and information: if data is corrupted or users doubt it, they may withdraw funds, pull back lending or stop trading, even at firms not directly hit.

Amplifiers make a shock larger. These include concentration in a few providers, tight timing in settlement, limited substitutes, slow recovery, and opacity about who is affected. A cyber event can turn into liquidity stress, market stress or a solvency problem. A single incident can show up as operational, liquidity and market risk together.

The policy angle in this chapter is that standard capital buffers address cyber risk only partly. Capital absorbs losses, but it cannot restore a system that is down. So the tools focus on resilience: impact tolerances, recovery targets, oversight of critical third parties, testing, information sharing and crisis coordination.

Key formulas to remember

Systemic cyber event chain
Shock → Channel → Amplifier → Impact on stability
A framework, not a calculation. Use it to structure any scenario question.
Cyber risk vs operational risk
Cyber risk ⊂ Operational risk
Cyber is a subset. Operational risk also covers fraud, process failure, people and physical events.
Individual vs systemic test
Systemic if impact spreads beyond the firm through shared dependencies, links or confidence
Size of the firm alone does not make an event systemic.
Resilience objective
Recovery time ≤ Impact tolerance
Impact tolerance is the maximum disruption to a critical service you can accept before intolerable harm.

How to solve Operational and Cyber Risk as Systemic Threats questions

Use this method for any scenario or concept question on cyber or operational risk and stability.

  1. 1Read the stem and name the shock: attack, outage, data corruption or error. Note whether it is malicious.
  2. 2Identify what is hit: a single firm, a shared provider, or a market infrastructure.
  3. 3Name the transmission channel: common dependency, payment and counterparty links, or loss of confidence.
  4. 4Find the amplifier: concentration, timing pressure, no substitute, slow recovery or opacity.
  5. 5Decide the type of impact: operational, liquidity, market or credit. Often more than one.
  6. 6Match the policy response: resilience testing, third-party oversight, information sharing, crisis coordination, or capital.
  7. 7Check each option for overstatements such as always, only or eliminates, and pick the one that fits the scenario exactly.

Quickest way: Shock, channel, amplifier

When to use it: When you have about two minutes for a multiple-choice scenario question.

  1. Ask: is the failure shared or local? Shared points to systemic.
  2. Ask: what is the link, technology, payments or trust?
  3. Eliminate options that say capital alone solves it.
  4. Eliminate options that treat cyber as separate from operational risk.
  5. Choose the option that mentions resilience or recovery, not only prevention.

Common mistakes in Operational and Cyber Risk as Systemic Threats

  • Treating cyber risk and operational risk as separate, unrelated categories.

    Cyber is often managed by a separate team, so it looks like a different risk.

    Fix: Remember that cyber is a subset of operational risk by cause, though its systemic reach can be larger.

  • Assuming a cyber event is systemic only if a large bank is hit.

    Students link systemic risk to size alone.

    Fix: Look at shared dependencies. A small provider used by many firms can be a systemic point.

  • Believing more capital is the main fix for systemic cyber risk.

    Capital is the standard answer for credit and market risk.

    Fix: Capital absorbs losses but does not restore services. Choose resilience, recovery and oversight tools.

  • Ignoring the confidence channel.

    Students focus on technical spread and payment links only.

    Fix: Remember that doubt about data or access can trigger runs and withdrawals at unaffected firms.

  • Assuming strong prevention removes the need for recovery planning.

    Security is seen as protection, not as one part of resilience.

    Fix: Resilience assumes breaches will happen. Plan to continue critical services and recover within tolerance.

Worked examples

Example 1

Several banks rely on one cloud provider for payment processing. The provider suffers a ransomware attack and is unavailable for two days. Which statement best explains why this is a systemic concern?
A. The banks' capital ratios fall immediately by the same amount
B. A common dependency lets one failure disrupt many institutions simultaneously
C. Ransomware only affects the provider's own shareholders
D. Payment systems are unaffected if banks hold liquid assets

Show the solution
  1. Shock: ransomware attack, malicious cyber event.
  2. What is hit: a shared provider, not one bank.
  3. Channel: common dependency, since many banks use the same service.
  4. Check A: capital ratios do not change by a fixed equal amount automatically, so A is unsupported.
  5. Check C: the harm spreads to client banks and their customers, so C is wrong.
  6. Check D: liquid assets do not make payments flow if the processing service is down, so D is wrong.

Answer: B. The shared dependency spreads one failure across many institutions.

Example 2

A bank's payment system is down for a day after a cyber attack. Its counterparties do not receive expected funds and delay their own payments. Rumours of data corruption lead some depositors to withdraw. Identify the channels and the best policy focus.

Show the solution
  1. Shock: cyber attack on a bank's payment system.
  2. First channel: payment and counterparty links. Missed receipts cause counterparties to delay payments, spreading liquidity strain.
  3. Second channel: confidence. Rumours of corrupted data prompt withdrawals, adding funding liquidity pressure.
  4. Amplifier: time-critical settlement and opacity about the damage.
  5. Impact: an operational event becomes a liquidity event, and could widen if others lose trust.
  6. Policy focus: set impact tolerances for critical payment services, test recovery, communicate clearly and coordinate with authorities. Capital alone would not restore the service.

Answer: Payment-link and confidence channels turned an operational incident into liquidity stress. The best focus is resilience: recovery within impact tolerance, testing, and crisis communication and coordination.

Exam tips

  • Expect scenario stems. Write shock, channel, amplifier next to the question before reading options.
  • Watch for absolute words such as always, only or eliminates. They are usually wrong in this topic.
  • Questions often ask which risk types a single cyber event touches. Remember operational, liquidity and sometimes market impacts together.
  • When two options both mention controls, prefer the one about resilience and recovery over pure prevention if the question is about stability.

Practice questions from Digital Resilience and Financial Stability: The Quest for Policy Tools in the Financial Sector

Operational and Cyber Risk as Systemic Threats in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Operational and Cyber Risk as Systemic Threats: frequently asked questions

What is the difference between operational risk and cyber risk?

Operational risk is loss from failed processes, people, systems or external events. Cyber risk is the part of that driven by compromise of digital systems or data. Cyber events can also have wider systemic reach because of shared technology.

How do cyber attacks spread in the financial system?

They spread through shared providers and software, through payment and counterparty links, and through loss of confidence. Concentration and tight settlement timing make the spread faster and larger.

Why is capital not enough for cyber risk?

Capital absorbs financial losses after they occur. It cannot restore a payment system or corrupted data. Resilience tools such as recovery targets, testing and third-party oversight address continuity.

How is this topic tested in FRM Part II?

It appears as applied multiple-choice scenarios on the Digital Resilience reading. You are asked to identify channels, amplifiers and suitable policy responses, so practise structuring each scenario.