Skip to content

FRM Part II · FRM Exam Part II · Introduction to Operational Risk and Resilience

A bank's loss database records an event where an external hacker breached a payment system through a vulnerability that was left unpatched because of a lapse in the bank's change-management process, and the hack also caused a 6-hour outage of the payment platform. Customers' funds were stolen. The bank wants to follow sound taxonomy practice for classifying the event. Which approach is most consistent with that practice?

Classify it once, as external fraud, based on the triggering event and the primary loss from the outside attack. Record the unpatched control lapse and the outage as linked causes or effects. Arbitrary splitting or omission would distort loss data and frequency analysis.

  1. AClassify it under the event type of the root cause and the primary loss, external fraud, while recording the process failure and outage as linked causal factors or related effectsCorrect
  2. BSplit the single loss equally across external fraud, process management and business disruption categories
  3. CClassify it as internal fraud because the control lapse was internal
  4. DExclude it from the database because multiple event types are involved

Explanation

Taxonomies require each event to be mapped to one primary category, normally by the triggering event and main loss, with causes and secondary effects captured as attributes. Here the theft by an outside hacker drives it to external fraud. Splitting arbitrarily distorts frequency data, a control lapse does not make it internal fraud, and exclusion biases data.

Did you get it right without looking?

One question tells you little. A timed set on Introduction to Operational Risk and Resilience shows your real accuracy, how long you take and where you lose marks.

Practise Introduction to Operational Risk and ResilienceFree diagnostic mock

More Introduction to Operational Risk and Resilience questions