Skip to content

FRM Part II · FRM Exam Part II · Introduction to Operational Risk and Resilience

A bank has three critical operations. Operation A has 2-hour tolerance and tested recovery of 1.5 hours; B has 8-hour tolerance and tested recovery of 9 hours; C has 24-hour tolerance and tested recovery of 20 hours. All three rely on one third-party cloud provider whose own failure was not included in any test. Which is the most appropriate priority?

The bank should remediate Operation B, which exceeded its 8-hour tolerance, and also test a severe-but-plausible failure of the shared cloud provider. The common dependency could breach all three tolerances at once, and passing isolated tests does not address that concentration. Adjusting tolerances to fit results would be inappropriate.

  1. ARemediate B only, since A and C are within tolerance, and consider the cloud scenario complete
  2. BRemediate B and test a severe-but-plausible scenario of cloud provider failure affecting all three operationsCorrect
  3. CLengthen B's tolerance to 9 hours and retest A and C
  4. DReduce A's tolerance to 1.5 hours to reflect actual capability

Explanation

B exceeds its tolerance (9 > 8 hours) and needs remediation. Yet A and C passing individual tests does not cover the concentration risk of a shared provider, which was never tested; a common-cause scenario could breach all three simultaneously. Changing tolerances to match results defeats their purpose.

Did you get it right without looking?

One question tells you little. A timed set on Introduction to Operational Risk and Resilience shows your real accuracy, how long you take and where you lose marks.

Practise Introduction to Operational Risk and ResilienceFree diagnostic mock

More Introduction to Operational Risk and Resilience questions