Skip to content

FRM Part II · FRM Exam Part II · Digital Resilience and Financial Stability: The Quest for Policy Tools in the Financial Sector

A bank defines its impact tolerance for its payments service as a maximum of 6 hours of disruption. A scenario test shows recovery takes 9 hours because of a dependency on one outsourced provider. Under a resilience framework built around impact tolerances, what is the most appropriate conclusion?

The bank is 3 hours beyond its 6-hour impact tolerance, so it has a resilience gap and should remediate, for instance by improving recovery or diversifying the outsourced dependency. Merely raising the tolerance to match test results would defeat the purpose of setting a tolerance.

  1. AThe bank is compliant because 9 hours is within normal operating variability
  2. BThe bank should raise the tolerance to 9 hours without further analysis
  3. CThe test is invalid because impact tolerances apply only to data loss
  4. DThe bank has a 3-hour gap against its tolerance and should remediate, for example by diversifying or improving recovery for the provider dependencyCorrect

Explanation

Impact tolerance is the maximum disruption acceptable for an important service. Recovery of 9 hours exceeds 6 by 3 hours, so a vulnerability exists and needs remediation. Simply resetting the tolerance to fit results defeats the purpose.

Did you get it right without looking?

One question tells you little. A timed set on Digital Resilience and Financial Stability: The Quest for Policy Tools in the Financial Sector shows your real accuracy, how long you take and where you lose marks.

Practise Digital Resilience and Financial Stability: The Quest for Policy Tools in the Financial SectorFree diagnostic mock

More Digital Resilience and Financial Stability: The Quest for Policy Tools in the Financial Sector questions