Skip to content

FRM Part II · FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks

A bank assesses a phishing-related risk scenario. Expected frequency without controls is 10 successful attacks per year, each with an average loss of USD 200,000. Email filtering reduces frequency by 60%, and staff training reduces the remaining frequency by a further 50%. Controls do not affect severity. What is the residual expected annual loss?

Residual expected annual loss is USD 400,000. Controls compound multiplicatively: 10 attacks fall to 4 after the 60% filtering reduction and to 2 after the further 50% training reduction. Two attacks at USD 200,000 each give USD 400,000.

  1. AUSD 400,000
  2. BUSD 800,000Correct
  3. CUSD 1,200,000
  4. DUSD 600,000

Explanation

Inherent loss = 10 x 200,000 = 2,000,000. After filtering: 4 attacks. After training: 2 attacks. Residual = 2 x 200,000 = 400,000. Check: 0.4 x 0.5 = 0.2 of 2,000,000 = 400,000.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Cyberthreats and Information Security Risks shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Cyberthreats and Information Security RisksFree diagnostic mock

More Case Study: Cyberthreats and Information Security Risks questions