FRM Part II · FRM Exam Part II · Risk Mitigation
A bank wants its annual continuity testing to provide the strongest evidence that critical staff and systems can actually perform under a severe but plausible disruption. Which approach is most appropriate?
A full failover exercise using a realistic severe scenario, the real recovery site, key third parties and unannounced elements, with findings followed through to remediation, gives the strongest evidence of capability. Document reviews, walkthroughs and call-tree checks test only limited aspects of the plan.
- AA desk-based review of the plan document by its authors
- BA walkthrough where team leaders discuss the plan in a meeting room
- CA full failover exercise with a realistic scenario, involving the actual recovery site, third parties and unannounced elements, with findings tracked to remediationCorrect
- DA call-tree test confirming that phone numbers are current
Explanation
Live full-failover tests with realistic, partly unannounced scenarios and third-party participation give the strongest assurance of real capability. Document reviews, walkthroughs and call-tree checks are lower-intensity tests and verify only parts of the plan.
Did you get it right without looking?
One question tells you little. A timed set on Risk Mitigation shows your real accuracy, how long you take and where you lose marks.
More Risk Mitigation questions
- After a breach investigation, a bank finds that an attacker used stolen credentials of a vendor to move laterally from a low-sensitivity rep…
- During due diligence on a prospective cloud service provider, which finding should most concern a bank's risk committee when the service sup…
- A bank outsources its customer call centre to a vendor under a contract with service-level agreements. After a vendor failure, the bank's cu…
- Which practice best addresses moral hazard that arises once a bank has purchased operational risk insurance?
- A bank discovers that its critical vendor relies on a subcontractor (a fourth party) to host client data. What is the most appropriate respo…
- A bank's operational risk team classifies a newly adopted control: a network intrusion detection system that raises an alert when unusual ou…