FRM Part II · FRM Exam Part II · Risk Mitigation
A bank tests its continuity plan for a critical clearing function. The plan relies on a nearby secondary site and on the same regional power grid and telecom provider as the primary site. A regional flood disables both. Which weakness in the plan design does this most directly illustrate, and what is the best remedy?
The failure shows concentration of common dependencies: both sites shared the same region, power and telecom. The best remedy is placing the recovery site in a separate risk region with independent utilities and testing failover against wide-area scenarios, rather than only tightening backup frequency.
- AInsufficient RPO; shorten backup intervals
- BConcentration of common dependencies; locate the recovery site in a separate risk region with independent utilities and test failover under a wide-area scenarioCorrect
- CExcessive staff training; reduce the number of exercises
- DPoor model validation; recalibrate the scenarios
Explanation
Both sites shared geography and infrastructure, so one event caused simultaneous failure. The remedy is geographic and utility diversification, validated by scenario tests that assume wide-area disruption. Shortening the RPO addresses data loss, not site availability.
Did you get it right without looking?
One question tells you little. A timed set on Risk Mitigation shows your real accuracy, how long you take and where you lose marks.
More Risk Mitigation questions
- A bank's ransomware scenario shows an annual probability of 5% and a loss of USD 40 million if it occurs. Management considers two options. …
- A bank estimates that, without a new email-filtering control, phishing-related losses would have an expected annual loss of USD 4.0 million.…
- A bank considers shifting part of its cyber risk to a captive insurance subsidiary that reinsures with external markets. Which statement bes…
- A bank discovers that its critical vendor relies on a subcontractor (a fourth party) to host client data. What is the most appropriate respo…
- A bank has a cyber insurance policy with a USD 50 million limit. Its scenario analysis shows a severe but plausible cyber event could cause …
- A broker-dealer runs a business impact analysis for its trade settlement function. Management finds that the function's RTO of 8 hours is sh…