Skip to content

FRM Part II · FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks

A bank has three cyber risk treatment options for a scenario with inherent expected annual loss of USD 3.0 million. Option A: a control costing USD 0.4 million per year cuts expected loss by 30%. Option B: a control costing USD 0.8 million per year cuts expected loss by 60%. Option C: a control costing USD 1.5 million per year cuts expected loss by 70%. Considering only net annual benefit (loss reduction minus cost), which should be chosen?

Choose Option B, with a net annual benefit of USD 1.0 million: loss reduction of USD 1.8 million less cost of USD 0.8 million. Option A nets USD 0.5 million and Option C nets USD 0.6 million, so B is the best cost-benefit choice.

  1. AOption C with net benefit USD 0.6 million
  2. BOption A with net benefit USD 0.5 million
  3. COption B with net benefit USD 1.0 millionCorrect
  4. DOption B with net benefit USD 1.8 million

Explanation

A: 0.9 - 0.4 = 0.5. B: 1.8 - 0.8 = 1.0. C: 2.1 - 1.5 = 0.6. Option B has the highest net benefit of USD 1.0 million. The distractor quoting 1.8 ignores the cost.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Cyberthreats and Information Security Risks shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Cyberthreats and Information Security RisksFree diagnostic mock

More Case Study: Cyberthreats and Information Security Risks questions