Skip to content

FRM Part II · FRM Exam Part II · Case Study: Financial Crime and Fraud

A bank's fraud team discovers that a relationship manager has been moving client funds through nominee accounts to hide losses. Which action should be taken FIRST under a sound incident response plan?

The first step is containment: freeze affected accounts and preserve evidence with a documented chain of custody. This stops further loss and protects the investigation and any legal or regulatory action. Deleting logs, delaying until an audit, or rushing public statements would worsen losses or compromise the case.

  1. AContain the incident by freezing affected accounts and preserving evidence under a documented chain of custodyCorrect
  2. BIssue a public statement explaining the loss before the facts are fully known
  3. CDismiss the manager immediately and delete the manager's system logs to prevent further access
  4. DWait for the next quarterly audit cycle to confirm the scale of the fraud

Explanation

Initial response priorities are to stop ongoing loss and preserve evidence so that investigation, recovery and any regulatory or criminal action are possible. Deleting logs destroys evidence, waiting allows losses to grow, and premature public statements risk inaccuracy and legal exposure.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Financial Crime and Fraud shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Financial Crime and FraudFree diagnostic mock

More Case Study: Financial Crime and Fraud questions