Skip to content

FRM Part II · FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks

A bank assesses an information asset's risk using inherent risk of 80 (on a 0-100 scale of loss exposure before controls). Preventive controls are judged to reduce exposure by 50% and, of the remaining exposure, detective and response controls reduce a further 25%. What is the residual risk score, assuming controls act sequentially?

Residual risk is 30. Preventive controls cut the inherent score of 80 by half to 40, and detective and response controls then reduce that remaining 40 by 25%, giving 30. The reductions apply sequentially to the remaining exposure and are not added together.

  1. A30Correct
  2. B40
  3. C20
  4. D60

Explanation

After preventive controls: 80 x (1-0.50) = 40. After detective/response controls on the remainder: 40 x (1-0.25) = 30. Adding the reductions (75%) would give 20, which wrongly treats the second reduction as applying to the original base. Applying only the first control gives 40.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Cyberthreats and Information Security Risks shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Cyberthreats and Information Security RisksFree diagnostic mock

More Case Study: Cyberthreats and Information Security Risks questions