FRM Part II · FRM Exam Part II · Risk Mitigation
A bank estimates a ransomware event has an annual probability of 10% and an expected loss of USD 20 million per event. A proposed control suite costing USD 0.8 million per year would cut the annual probability to 4% and cut the expected loss per event to USD 15 million. What is the net annual benefit of the control suite (reduction in expected annual loss minus cost)?
The net annual benefit is USD 0.6 million. Expected annual loss falls from 2.0 million (10% x 20 million) to 0.6 million (4% x 15 million), a reduction of 1.4 million, and subtracting the 0.8 million annual cost leaves 0.6 million.
- AUSD 0.2 millionCorrect
- BUSD 0.4 million
- CUSD 0.6 million
- DUSD 1.2 million
Explanation
Current expected annual loss = 0.10 x 20 = 2.0 million. After controls = 0.04 x 15 = 0.6 million. Reduction = 1.4 million; less cost of 0.8 gives 0.6 million. Check: that is option C, so correct value is 0.6 million, not 0.2.
Did you get it right without looking?
One question tells you little. A timed set on Risk Mitigation shows your real accuracy, how long you take and where you lose marks.
More Risk Mitigation questions
- A bank has a critical service with an impact tolerance of 6 hours. Scenario testing of a severe but plausible ransomware event yields these …
- A bank's payments unit has identified that a manual reconciliation process produces frequent errors, each of small value. Management decides…
- A bank outsources its loan-servicing platform to a vendor that itself relies on a single cloud provider. The bank's risk committee wants to …
- A bank's board reviews a proposal for cyber insurance to mitigate losses from data breaches. Which statement best reflects a sound view of i…
- A payments bank is drafting its business continuity plan for its card-authorisation service. Which measure defines the maximum amount of dat…
- During due diligence on a prospective vendor that will handle sensitive customer data, which finding should most strongly prompt the bank to…