Risk Mitigation for FRM Part II: Operational Risk Chapter Guide

What this chapter covers

Risk Mitigation: topics in the order to study them

1. 1Operational Risk Mitigation StrategiesIt gives the avoid, reduce, transfer and accept framework that every later topic builds on.
2. 2Internal Controls and Control FrameworksControls are the main way to reduce risk, so you need preventive, detective and corrective types and the three lines of defence first.
3. 3Insurance and Risk Transfer for Operational RiskOnce you know what controls leave behind, you can see what residual risk can be transferred and what cannot.
4. 4Outsourcing and Third-Party Risk ManagementOutsourcing is a form of transfer that keeps accountability with the firm, which builds on both controls and insurance.
5. 5Business Continuity and Operational ResilienceIt covers what happens when controls fail or a provider goes down, including impact tolerance and recovery planning.
6. 6Cyber Risk and Information Security MitigationIt applies all earlier ideas to one fast-moving risk, so it comes last and ties the chapter together.

How to prepare Risk Mitigation

1. Write a one-page map of avoid, reduce, transfer and accept, with an example of each for a bank.
2. Learn control types and the three lines of defence, then test yourself by classifying sample controls as preventive, detective or corrective.
3. List what insurance covers and what limits it has, such as deductibles, policy caps, exclusions, claim delays and counterparty risk.
4. For outsourcing, build a checklist: due diligence, contract terms, monitoring, exit plans and concentration risk. Remember the firm stays accountable.
5. Study resilience as an end-to-end idea: critical services, impact tolerance, testing, and recovery objectives.
6. Practise scenario questions and for each wrong option, name the reason it fails.
7. Read the digital resilience and AI material in Current Issues alongside the cyber topic to connect the ideas.

Common mistakes in Risk Mitigation

• Treating insurance as a full substitute for controls

  Fix: Remember that insurance covers some financial loss only, with limits and delays, and does not stop the event or protect reputation.

• Saying outsourcing transfers responsibility to the vendor

  Fix: Choose answers where the firm keeps accountability and must oversee and test the provider.

• Mixing up preventive, detective and corrective controls

  Fix: Ask when the control acts: before, during discovery, or after the event. Pick the main purpose in the scenario.

• Confusing business continuity with operational resilience

  Fix: Continuity is about plans to recover; resilience is the wider ability to keep critical services within tolerance, including prevention and adaptation.

• Choosing a technical cyber fix when the scenario points to governance or people

  Fix: Read for the root cause. Weak access rights, poor training or no incident plan call for governance and process fixes.

• Picking the most extreme or costly mitigation

  Fix: Match the measure to the risk and its cost. Accepting a small, low-impact risk can be the correct answer.

Last-day revision: Risk Mitigation

• ✓Four responses to risk: avoid, reduce, transfer, accept.
• ✓Mitigation lowers likelihood or impact; residual risk always remains.
• ✓Preventive controls stop events; detective controls find them; corrective controls fix them.
• ✓Three lines of defence: business ownership, independent risk and compliance oversight, internal audit assurance.
• ✓Insurance transfers financial loss, not the underlying risk or reputational damage.
• ✓Insurance gaps include deductibles, limits, exclusions, payout delays and insurer credit risk.
• ✓Outsourcing moves the activity, not the accountability.
• ✓Third-party risk needs due diligence, contract terms, ongoing monitoring and an exit strategy.
• ✓Concentration in one provider is a risk in itself.
• ✓Business continuity plans need regular testing to be credible.
• ✓Operational resilience focuses on delivering critical services within an impact tolerance.
• ✓Cyber defence is layered: access control, monitoring, patching, staff training, incident response and recovery.

Risk Mitigation practice questions

• Which contractual provision best supports a bank's ability to oversee an outsourced critical service on an ongoing basis?
• A bank's expected annual loss from a process is USD 4 million with an event frequency of 20 per year. A new control is projected to cut freq…
• A bank's disaster recovery test shows that its trading system, supported by a secondary data center, recovers in 6 hours. The business conti…
• A bank's incident response plan is reviewed. Which element most improves its ability to limit damage during an actual cyber incident?
• A bank's cyber-risk manager wants to limit the damage if an attacker compromises one employee's credentials, so that the attacker cannot mov…
• A bank wants its annual continuity testing to provide the strongest evidence that critical staff and systems can actually perform under a se…
• A bank outsources its loan-servicing platform to a vendor that itself relies on a single cloud provider. The bank's risk committee wants to …
• A bank assesses a key control that addresses a risk with inherent annual expected loss of USD 20 million. Testing shows the control is effec…

Risk Mitigation in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

• CS ProfessionalInternal Controls
• CMA FinalInternal Control and Internal Audit
• CMA IntermediateAudit Risk, Internal Control, Internal Check and Internal Audit
• ACCA Applied SkillsSystems of internal control