FRM Part II · FRM Exam Part II · Risk Mitigation
A bank's business impact analysis shows that a trade settlement process generates losses that grow the longer it is down. The firm sets a maximum tolerable period of disruption (MTPD) of 8 hours. The supporting application has a recovery time objective (RTO) of 3 hours and a work recovery time (time to reconcile backlog and verify data after systems return) of 4 hours. Which conclusion is most appropriate?
The plan is consistent. The RTO of 3 hours plus the work recovery time of 4 hours equals 7 hours, which is within the 8-hour maximum tolerable period of disruption. Looking at the RTO alone would overlook the backlog reconciliation needed before the process is truly restored.
- AThe plan is consistent, because RTO of 3 hours is below the MTPD of 8 hours
- BThe plan is inconsistent, because RTO must equal the MTPD
- CThe plan is consistent, because RTO plus work recovery time is 7 hours, within the MTPD of 8 hoursCorrect
- DThe plan is inconsistent, because RTO plus work recovery time of 7 hours exceeds the MTPD
Explanation
The MTPD must cover both the technical recovery (RTO) and the work recovery time: 3 + 4 = 7 hours, which is less than 8 hours, leaving 1 hour of slack. Option A ignores work recovery time. RTO need not equal the MTPD; it should be shorter. Option D misstates 7 as exceeding 8.
Did you get it right without looking?
One question tells you little. A timed set on Risk Mitigation shows your real accuracy, how long you take and where you lose marks.
More Risk Mitigation questions
- A bank wants its annual continuity testing to provide the strongest evidence that critical staff and systems can actually perform under a se…
- A bank assesses a key control that addresses a risk with inherent annual expected loss of USD 20 million. Testing shows the control is effec…
- A firm is designing scenario testing for operational resilience. Which scenario design best tests resilience of a critical service rather th…
- A bank buys an operational risk insurance policy with a per-event deductible of USD 5 million and a per-event limit of USD 40 million. A sin…
- A bank's payments platform supports a critical business service. Management sets a statement of the maximum disruption it is willing to tole…
- A bank outsources its payment processing to a single provider. Risk management is concerned that a failure of the provider would halt paymen…