FRM Part II · FRM Exam Part II · Risk Mitigation
A bank's disaster recovery test shows that its trading system, supported by a secondary data center, recovers in 6 hours. The business continuity plan assumes recovery within 3 hours. A manager proposes simply documenting the 6-hour result as the new target without changes. Which response is most consistent with sound resilience practice?
The firm should compare the 6-hour result with the service's impact tolerance and, if it breaches it, fix the gap or escalate for a formal risk acceptance decision. Simply relabeling the target conceals a weakness, and insurance cannot restore a disrupted critical service.
- ACompare the 6-hour result with the impact tolerance, and if it exceeds it, remediate the gap or escalate for a risk acceptance decisionCorrect
- BAccept 6 hours as the new RTO because tests always differ from live events
- CDiscard the test result as unrepresentative and rely on the original plan
- DTransfer the whole risk by raising insurance coverage, which removes the need for recovery
Explanation
A test gap should be assessed against the impact tolerance and business need. If the actual capability breaches it, management must remediate or formally escalate and accept the risk. Silently resetting the target hides the weakness, and insurance does not restore service.
Did you get it right without looking?
One question tells you little. A timed set on Risk Mitigation shows your real accuracy, how long you take and where you lose marks.
More Risk Mitigation questions
- A bank's annual expected operational loss from an event type is USD 8 million, and its 99.9% annual loss quantile is USD 120 million. It con…
- A bank's business impact analysis shows that a trade settlement process generates losses that grow the longer it is down. The firm sets a ma…
- A bank wants to reduce capital-relevant operational risk using an insurance program. Which feature of a policy would most weaken its recogni…
- A bank's payments platform supports a critical business service. Management states that the service must be restored within 4 hours of a dis…
- A firm is designing scenario testing for operational resilience. Which scenario design best tests resilience of a critical service rather th…
- Which contractual provision best supports a bank's ability to oversee an outsourced critical service on an ongoing basis?