Skip to content

FRM Part II · FRM Exam Part II

Risk Measurement and Assessment for FRM Part II

Risk Measurement and Assessment is the part of operational risk that turns risk into evidence you can act on. You identify risks with a taxonomy, assess them with RCSA, monitor them with KRIs and scenarios, quantify them with loss data and capital models, and test the limits of those numbers.

What this chapter covers

This chapter sits inside the Operational Risk and Resilience topic of FRM Part II. It covers how a bank finds operational risks, scores them, tracks them and puts a number on them. The five topics follow one logic: name the risk, assess it, monitor it, quantify it, then challenge the quantification.

The tools split into two groups. Qualitative and forward-looking tools are the taxonomy, RCSA, KRIs and scenario analysis. They rely on judgement and tell you where risk is heading. Quantitative and backward-looking tools are loss data and capital models. They rely on history and tell you how big losses have been. A good answer shows how the two groups check each other.

The chapter links to the rest of the paper. Operational resilience, third-party risk and digital resilience depend on the same identification and assessment tools. Model risk and data quality also appear in market and credit risk, and in the Current Issues readings on artificial intelligence and digital resilience. Learn the ideas here once and you can reuse them across the paper.

The exam is 80 multiple-choice questions in 4 hours. Expect applied, case-like questions. You will be asked to pick the right tool for a situation, read an indicator or a loss distribution, or spot the weakness in a measurement approach.

Operational risk questions are often conceptual and scenario-based, so they reward clear understanding more than heavy calculation. That makes this chapter a good place to secure marks if you learn the logic rather than lists. The same ideas about data, judgement and model limits help you in other Part II topics. Weak candidates memorise definitions and then miss questions that ask which tool fits a case. Strong candidates know what each tool is for, what it cannot do, and how it connects to capital and governance.

Risk Measurement and Assessment: topics in the order to study them

  1. 1Operational Risk Identification and TaxonomyStart here because every later tool needs a common language for risk types, causes, events and impacts.
  2. 2Risk and Control Self-Assessment (RCSA)It builds on the taxonomy and shows how business units score inherent risk, controls and residual risk.
  3. 3Key Risk Indicators and Scenario AnalysisThese extend RCSA by adding ongoing monitoring with thresholds and forward-looking views of severe but plausible events.
  4. 4Loss Data Collection and Operational Risk Capital ModelsStudy this once you know the qualitative tools, because capital models combine loss data with scenario and control information.
  5. 5Model Risk, Data Quality and Measurement ChallengesFinish here because it tests every earlier method: it asks where the numbers can mislead you.

How to prepare Risk Measurement and Assessment

Treat this chapter as one connected process, not five separate lists. Aim to explain what each tool does, who uses it and what its weakness is.

  1. Read the five topics in the order above and write a one-line purpose for each tool: what question does it answer?
  2. Build a simple map of the risk process: identify, assess, monitor, quantify, challenge. Place every term you meet on that map.
  3. For RCSA, practise the sequence from inherent risk to controls to residual risk. Check you can say what changes at each step.
  4. For KRIs, learn what makes a good indicator: measurable, predictive, timely and tied to a threshold. Practise reading a rising or breached indicator and naming the action.
  5. For loss data and capital models, focus on interpretation: frequency, severity, tail losses, data gaps and bias. Do a few worked questions so the logic is familiar.
  6. Finish by comparing tools in pairs, such as RCSA versus KRI or loss data versus scenarios, and note when each is better.
  7. Do timed mixed sets of applied multiple-choice questions. For each miss, write which tool you should have picked and why.

Common mistakes in Risk Measurement and Assessment

  • Mixing up cause, event and impact when classifying an operational risk.

    Fix: Ask three questions in order: what went wrong (cause), what happened (event), what was the result (impact). Classify by the event.

  • Treating RCSA results as objective facts.

    Fix: Remember the bias and consistency limits. Look for challenge, calibration and validation against KRIs and loss data.

  • Choosing a KRI that only reports past losses.

    Fix: Pick indicators that move before losses happen, such as staff turnover, failed reconciliations or system downtime, with set thresholds.

  • Relying on loss history alone to judge tail risk.

    Fix: Note that history may omit rare severe events. Pair loss data with scenario analysis and external data.

  • Ignoring data quality when interpreting a capital figure.

    Fix: Check collection thresholds, completeness, classification and bias first. Poor inputs make a sophisticated model unreliable.

  • Memorising definitions without knowing which tool fits a case.

    Fix: Practise scenario questions and state, in one line, why the chosen tool fits and why the alternatives do not.

Last-day revision: Risk Measurement and Assessment

  • A taxonomy gives one consistent set of risk categories, so data and reports can be compared across the firm.
  • Separate cause, event and impact when classifying; they are not the same thing.
  • RCSA moves from inherent risk, through control effectiveness, to residual risk.
  • RCSA is self-assessed and forward-looking, so it can suffer from bias and optimism.
  • A good KRI is measurable, predictive, timely and has thresholds that trigger action.
  • KRIs are early-warning signals; losses are lagging evidence.
  • Scenario analysis explores severe but plausible events that history may not contain.
  • Loss data is backward-looking and may miss rare, extreme events.
  • Capital models usually combine frequency and severity to describe the loss distribution, with focus on the tail.
  • Incomplete or inconsistent loss data biases capital estimates.
  • Model risk comes from wrong assumptions, poor data or misuse of a model, so validation and governance matter.
  • No single tool is enough; use them together and challenge the results.

Risk Measurement and Assessment practice questions

Risk Measurement and Assessment in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Risk Measurement and Assessment: frequently asked questions

Which topics make up Risk Measurement and Assessment?

The chapter has five topics: Operational Risk Identification and Taxonomy; Risk and Control Self-Assessment (RCSA); Key Risk Indicators and Scenario Analysis; Loss Data Collection and Operational Risk Capital Models; and Model Risk, Data Quality and Measurement Challenges. They fall under Operational Risk and Resilience in FRM Part II.

Is this chapter calculation-heavy?

Mostly it is conceptual and applied. You should understand frequency, severity and tail ideas well enough to interpret results. Focus on choosing the right tool and reading what it tells you, rather than long calculations.

How should I study if I read on my phone?

Use short sessions on one topic at a time. Keep a one-line purpose and one weakness for each tool in your notes, then test yourself with applied questions. Review the quick revision points often.

How many questions will the exam have on this chapter?

GARP does not publish a question count for this chapter in the way we can state here. FRM Part II has 80 equally weighted multiple-choice questions in 4 hours, so prepare every topic well and expect applied questions.