Skip to content

FRM Part II · FRM Exam Part II · Risk Mitigation

A bank estimates that, without a new email-filtering control, phishing-related losses would have an expected annual loss of USD 4.0 million. The control is expected to reduce the frequency of successful attacks by 60% with no change in severity, and costs USD 1.5 million per year. What is the expected net annual benefit of the control?

The net annual benefit is USD 0.9 million. A 60% frequency reduction cuts expected loss by USD 2.4 million from USD 4.0 million, and subtracting the USD 1.5 million annual cost leaves USD 0.9 million, so the control is worthwhile on expected value.

  1. AUSD 0.9 millionCorrect
  2. BUSD 2.4 million
  3. CUSD 1.6 million
  4. DUSD 2.5 million

Explanation

Loss reduction = 60% x 4.0 = 2.4 million. Net benefit = 2.4 - 1.5 = 0.9 million. Quoting 2.4 ignores the control cost; 1.6 is the residual loss (4.0 - 2.4) after treating it as a benefit; 2.5 is 4.0 - 1.5, ignoring the effect of the control's effectiveness.

Did you get it right without looking?

One question tells you little. A timed set on Risk Mitigation shows your real accuracy, how long you take and where you lose marks.

Practise Risk MitigationFree diagnostic mock

More Risk Mitigation questions