Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

A bank scores four cyber scenarios by annual likelihood and loss per event. Expected annual loss = likelihood x loss. Scenario A: 0.50 x $1.0m; B: 0.10 x $6.0m; C: 0.02 x $40m; D: 0.25 x $2.0m. Management ranks by expected annual loss but a risk committee also wants attention to tail impact. Which statement is correct?

Scenario C has the highest expected annual loss at $0.8m (0.02 x $40m) and also the largest single-event loss of $40m. The others are lower: B is $0.6m, while A and D are each $0.5m, so ranking by expected loss does not mask C's tail.

  1. AA and D tie for the highest expected loss, and C has the largest single-event loss
  2. BB has the highest expected loss at $0.6m, while C has the largest single-event loss
  3. CC has the highest expected loss at $0.8m and the largest single-event lossCorrect
  4. DD has the highest expected loss at $0.5m, equal to A, and B has the largest single-event loss

Explanation

Expected losses: A 0.5m, B 0.6m, C 0.02x40=0.8m, D 0.5m. C is highest at $0.8m and also has the largest single-event loss of $40m. Options naming A and D as highest or B as highest ignore C's result.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions