Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

A bank's cyber strategy states that it will tolerate no more than two high-severity incidents per year affecting critical services. Management reports three such incidents in the latest year. Which action is most consistent with sound cyber governance?

The breach should be escalated to the board or its risk committee with a remediation plan and clear accountability. Changing definitions, delaying review, or linking escalation to insurance would undermine the purpose of a risk appetite, which is to trigger timely governance responses when limits are exceeded.

  1. AEscalate the breach of risk appetite to the board or its risk committee and require a remediation plan with accountabilityCorrect
  2. BRedefine 'high-severity' quietly so that only two incidents qualify
  3. CWait until the next annual strategy review to discuss the results
  4. DTreat the tolerance as a target to be revisited only if losses exceed insurance coverage

Explanation

A breach of a stated appetite or tolerance should trigger formal escalation and remedial action. Redefining the metric hides the issue, delaying defers oversight, and tying escalation to insurance confuses risk transfer with appetite.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions