FRM Part II · FRM Exam Part II · Risk Identification

A bank is reviewing a 5 million loss. A vendor's software update (an external event) failed because internal change management did not require regression testing, and operators then manually re-entered 4,000 transactions, making errors. Which approach to recording the event is most consistent with a sound taxonomy and framework?

Record it once as a Business Disruption and System Failures event, with linked causal factors for the vendor, weak change management and manual operator errors. This captures the loss once while preserving root-cause insight; it was not fraud, should not be triple counted, and should not be excluded.

1. ARecord one event under External Fraud because a third party was involved
2. BRecord one event under Business Disruption and System Failures, with linked causal factors for third-party, change-management process and people failuresCorrect
3. CRecord three separate losses, each of 5 million, one per cause, to reflect each failure
4. DExclude it from the loss database because the trigger was external