FRM Part II · FRM Exam Part II · Risk Mitigation
A bank classifies its systems into tiers. A risk manager proposes giving the payment-processing system, which would cause severe losses within an hour of an outage, the same recovery objectives as an internal training portal. Which is the best critique of this proposal?
The proposal is flawed because recovery time and recovery point objectives should reflect business impact. A payment system causing severe losses within an hour needs far tighter targets than a training portal. Uniform objectives would underprotect critical services or waste resources on low-value ones.
- ARecovery time and recovery point objectives should be set according to business impact, so the payment system needs much tighter targetsCorrect
- BUniform objectives are preferred because they simplify testing and reduce control costs
- CThe training portal should receive tighter objectives because it has more users
- DRecovery objectives apply only to data, not to systems, so tiering is unnecessary
Explanation
Recovery objectives should be derived from a business impact analysis. A system with severe losses within an hour needs short RTO and RPO, while low-criticality systems can tolerate longer recovery. Uniform targets either overspend on trivial systems or underprotect critical ones.
Did you get it right without looking?
One question tells you little. A timed set on Risk Mitigation shows your real accuracy, how long you take and where you lose marks.
More Risk Mitigation questions
- A bank wants its annual continuity testing to provide the strongest evidence that critical staff and systems can actually perform under a se…
- A bank assesses a key control that addresses a risk with inherent annual expected loss of USD 20 million. Testing shows the control is effec…
- A bank buys an operational risk insurance policy with a per-event deductible of USD 5 million and a per-event limit of USD 40 million. A sin…
- A bank's payments platform supports a critical business service. Management sets a statement of the maximum disruption it is willing to tole…
- A bank outsources its payment processing to a single provider. Risk management is concerned that a failure of the provider would halt paymen…
- In the three lines model commonly applied by banks, a business unit's head of operations identifies, owns and tests the day-to-day controls …