Skip to content

FRM Part II · FRM Exam Part II · Risk Governance

A bank's operational risk committee reviews a control test showing that a reconciliation control has a design effectiveness rating of 'strong' but an operating effectiveness rating of 'weak' because staff frequently skip the review step. Inherent risk for the process is rated high. Which conclusion is most appropriate for residual risk reporting?

Residual risk should stay high, close to inherent risk. Good design gives no protection if the control is not executed, so weak operating effectiveness means little real mitigation. Reporting low residual risk based on design alone would overstate control strength and mislead management.

  1. AResidual risk is low because the control is well designed
  2. BResidual risk should remain high or close to inherent because a control that does not operate effectively provides little actual mitigationCorrect
  3. CResidual risk is zero because the control exists
  4. DResidual risk cannot be assessed until the design is changed

Explanation

Residual risk reflects the control as it actually operates. A well-designed control that is not performed gives little risk reduction, so residual risk stays near inherent. Crediting design alone overstates mitigation and would mislead reporting.

Did you get it right without looking?

One question tells you little. A timed set on Risk Governance shows your real accuracy, how long you take and where you lose marks.

Practise Risk GovernanceFree diagnostic mock

More Risk Governance questions