FRM Part II · FRM Exam Part II · Risk Mitigation
A bank buys an operational risk insurance policy with a per-event deductible of USD 5 million and a per-event limit of USD 40 million. A single fraud event produces a gross loss of USD 32 million. What is the bank's retained loss and the insurer's payout for this event, assuming the policy responds in full under its terms?
The bank retains USD 5 million and the insurer pays USD 27 million. The insurer covers the loss above the deductible, 32 minus 5, which is within the USD 40 million limit, so the limit does not bind and the deductible is the bank's retained amount.
- ABank retains USD 5 million; insurer pays USD 27 millionCorrect
- BBank retains USD 32 million; insurer pays nothing
- CBank retains USD 0; insurer pays USD 32 million
- DBank retains USD 12 million; insurer pays USD 20 million
Explanation
The insurer pays the loss above the deductible, up to the limit: 32 - 5 = 27, which is below the 40 million limit. The bank therefore retains the 5 million deductible. Option 3 ignores the deductible; option 2 assumes no coverage is triggered.
Did you get it right without looking?
One question tells you little. A timed set on Risk Mitigation shows your real accuracy, how long you take and where you lose marks.
More Risk Mitigation questions
- A bank wants its annual continuity testing to provide the strongest evidence that critical staff and systems can actually perform under a se…
- A bank assesses a key control that addresses a risk with inherent annual expected loss of USD 20 million. Testing shows the control is effec…
- A bank's payments platform supports a critical business service. Management sets a statement of the maximum disruption it is willing to tole…
- A bank outsources its payment processing to a single provider. Risk management is concerned that a failure of the provider would halt paymen…
- In the three lines model commonly applied by banks, a business unit's head of operations identifies, owns and tests the day-to-day controls …
- A bank's security architecture assumes no user or device is trusted by default, even inside the corporate network, and requires continuous v…