Skip to content

FRM Part II · FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks

A bank estimates that a ransomware event has a 5% annual probability. If it occurs, expected loss is USD 20 million. A new offline-backup control costs USD 0.4 million per year and would cut the loss given occurrence to USD 8 million while leaving probability unchanged. What is the annual net benefit of the control?

The net benefit is USD 0.20 million a year. Expected loss falls from USD 1.0 million (5% of 20 million) to USD 0.4 million (5% of 8 million), a saving of USD 0.6 million, and subtracting the USD 0.4 million annual control cost leaves USD 0.2 million.

  1. AUSD 0.20 millionCorrect
  2. BUSD 0.60 million
  3. CUSD 0.80 million
  4. DUSD 0.24 million

Explanation

Expected annual loss before is 5% x 20 = 1.0 million. After is 5% x 8 = 0.4 million. Reduction is 0.6 million; subtracting the 0.4 million cost gives a net benefit of 0.2 million. Ignoring the cost gives 0.6, the key distractor.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Cyberthreats and Information Security Risks shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Cyberthreats and Information Security RisksFree diagnostic mock

More Case Study: Cyberthreats and Information Security Risks questions