FRM Part II · FRM Exam Part II · Risk Mitigation
A bank's board is setting its operational resilience framework. It identifies critical operations and sets an impact tolerance for each. Which statement best describes the purpose of an impact tolerance?
An impact tolerance is the maximum disruption a critical operation can bear before causing intolerable harm, assuming the disruption occurs. It focuses on outcomes and limits rather than probability, so it differs from risk appetite and expected loss, and is not simply a recovery site activation time.
- AIt is the expected annual loss from disruption, used to set the capital charge
- BIt is the maximum level of disruption to a critical operation the bank could withstand, assuming disruption will occur, beyond which intolerable harm resultsCorrect
- CIt is the probability of a disruption that management accepts within its risk appetite
- DIt is the time allowed for the disaster recovery site to be activated
Explanation
Impact tolerance assumes a disruption has already happened and sets the limit of disruption (usually time-based) before intolerable harm to customers or market stability. It is not a loss expectation, a likelihood measure, or a site activation time. This differs from risk appetite, which concerns likelihood and acceptable risk-taking.
Did you get it right without looking?
One question tells you little. A timed set on Risk Mitigation shows your real accuracy, how long you take and where you lose marks.
More Risk Mitigation questions
- A risk manager compares two mitigation options for a fraud risk with expected annual loss of USD 2.0 million. Option A costs USD 0.6 million…
- A bank's ransomware scenario shows an annual probability of 5% and a loss of USD 40 million if it occurs. Management considers two options. …
- A bank estimates that, without a new email-filtering control, phishing-related losses would have an expected annual loss of USD 4.0 million.…
- A bank considers shifting part of its cyber risk to a captive insurance subsidiary that reinsures with external markets. Which statement bes…
- During control testing, a bank finds that a key reconciliation control is well designed but was skipped on 6 of the 20 days sampled because …
- A bank has a cyber insurance policy with a USD 50 million limit. Its scenario analysis shows a severe but plausible cyber event could cause …