Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

A bank has three critical services. Annualised expected losses from cyber events are: Service A USD 2.0m with inherent risk 10m, Service B USD 1.5m with inherent risk 6m, Service C USD 0.9m with inherent risk 3m. Inherent risk is the expected loss without controls. Which service has the highest control effectiveness (percentage of inherent risk removed by controls)?

Control effectiveness equals one minus residual over inherent risk. Service A gives 1 - 2/10 = 80%, Service B 75% and Service C 70%, so Service A is highest. The 20% figure is the residual share, not the share removed.

  1. AService A, at 80%Correct
  2. BService B, at 75%
  3. CService C, at 70%
  4. DService A, at 20%

Explanation

Residual losses are the stated expected losses given controls. Effectiveness = 1 - residual/inherent. A: 1 - 2/10 = 80%. B: 1 - 1.5/6 = 75%. C: 1 - 0.9/3 = 70%. Option D reports the residual ratio (20%) rather than effectiveness.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions