Skip to content

FRM Part II · FRM Exam Part II · Risk Identification

A bank compares its RCSA results with other operational risk data. The fraud RCSA for retail lending rates residual risk as Low and controls as Effective, yet the loss event database shows rising fraud losses in that unit over four quarters and internal audit found repeated control overrides. What is the most appropriate response by the operational risk function?

The function should challenge the RCSA and reassess control effectiveness using the loss and audit evidence, requiring the business to revise its ratings. Rising losses and control overrides contradict a Low residual rating, so the self-assessment is likely biased or incomplete. Abandoning RCSA would lose forward-looking information.

  1. AChallenge the RCSA ratings, reassess control effectiveness using loss and audit evidence, and require the business to revise its assessmentCorrect
  2. BAccept the RCSA rating because self-assessment reflects management's best knowledge of the process
  3. CReplace the RCSA with loss data alone for this unit going forward
  4. DLower the likelihood score further since fraud events are already being detected and recorded

Explanation

Loss data and audit findings are independent evidence that contradicts the self-assessed ratings, suggesting control effectiveness is overstated. The second line should challenge and trigger reassessment. Dropping RCSA discards forward-looking insight, and lowering likelihood is the opposite of what the evidence implies.

Did you get it right without looking?

One question tells you little. A timed set on Risk Identification shows your real accuracy, how long you take and where you lose marks.

Practise Risk IdentificationFree diagnostic mock

More Risk Identification questions