Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

A bank performs a cyber risk assessment of its payments platform. Inherent risk is rated 'High'. Existing controls are assessed as reducing likelihood substantially but having no effect on impact. Which statement about the resulting residual risk assessment is most appropriate?

Residual risk is lower than inherent risk, because controls that substantially cut likelihood reduce expected loss even though the severity of a successful event is unchanged. Residual risk is assessed after considering control effectiveness, not only after an actual breach.

  1. AResidual risk is lower than inherent risk because lower likelihood reduces expected loss, though the impact severity remains unchangedCorrect
  2. BResidual risk equals inherent risk because impact is unchanged
  3. CResidual risk is higher than inherent risk because controls add complexity
  4. DResidual risk cannot be assessed until a breach has occurred

Explanation

Residual risk reflects the risk after controls. Expected loss is likelihood times impact, so reducing likelihood lowers residual risk even if the impact of a successful event stays the same. Equating residual to inherent ignores the likelihood reduction.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions