Skip to content

FRM Part II · FRM Exam Part II · Risk Reporting

A bank's operational risk team distributes its monthly risk report by email to a broad list that has grown over several years. An internal review finds that some recipients no longer have any role related to the content, and the report includes sensitive details of ongoing fraud investigations. What is the most appropriate action?

The bank should periodically review the distribution list and limit access to those who need the information, applying confidentiality classification to sensitive content such as fraud investigations. Broad distribution risks leaks, while removing the content entirely or going verbal harms decision-making and the audit trail.

  1. AKeep the broad list because wider distribution improves transparency and risk awareness
  2. BReview the distribution list periodically and restrict access on a need-to-know basis, with sensitive content controlled by appropriate confidentiality classificationCorrect
  3. CRemove all sensitive content from every report permanently, including from senior management
  4. DReplace the report with verbal briefings so that nothing is written down

Explanation

Distribution should be reviewed regularly so that only people with a legitimate need receive reports, and sensitive information should be protected through classification and access controls. Removing it from all users would deprive decision makers of necessary information, and verbal-only briefings weaken audit trail and consistency.

Did you get it right without looking?

One question tells you little. A timed set on Risk Reporting shows your real accuracy, how long you take and where you lose marks.

Practise Risk ReportingFree diagnostic mock

More Risk Reporting questions