Skip to content

FRM Part II · FRM Exam Part II · Introduction to Operational Risk and Resilience

A bank's critical payments service has a tolerance of 4 hours maximum outage. A severe but plausible scenario test shows that failure of a single third-party cloud provider would take 9 hours to recover, because failover to a secondary region has never been exercised. What is the most appropriate management response under operational resilience principles?

The bank should treat the 9-hour recovery against a 4-hour tolerance as a gap, strengthen failover and contingency arrangements, retest, and escalate to the board if unresolved. Accountability stays with the bank despite outsourcing, and tolerance should not be loosened to fit capability.

  1. AAccept the result, since the failure is of a third party and therefore outside the bank's responsibility
  2. BRedefine the tolerance as 9 hours to match tested capability
  3. CTreat it as a gap, remediate failover and exit or contingency arrangements, and retest, while escalating to the board if it cannot be closed in timeCorrect
  4. DBuy additional insurance covering the 5 hours of excess outage and consider the issue closed

Explanation

The bank remains accountable for critical operations even when relying on third parties. Tolerance should be set by impact, not by current capability, so widening it is wrong. Insurance compensates losses but does not restore service. The gap should be remediated, retested and escalated if unresolved.

Did you get it right without looking?

One question tells you little. A timed set on Introduction to Operational Risk and Resilience shows your real accuracy, how long you take and where you lose marks.

Practise Introduction to Operational Risk and ResilienceFree diagnostic mock

More Introduction to Operational Risk and Resilience questions