FRM Part II · FRM Exam Part II · Risk Mitigation
A bank's operations team reviews its payment-release process. A single clerk can create a new beneficiary, approve the payment and release funds. Which type of control weakness does this most directly represent, and which control would best address it?
This is a segregation of duties weakness, because one clerk can initiate, approve and release payments. The best fix is a preventive maker-checker control that assigns these steps to different people, rather than detective reports, physical security or continuity measures.
- ALack of segregation of duties; require that initiation and approval be performed by different peopleCorrect
- BLack of detective monitoring; add a monthly variance report
- CWeak physical access control; install badge readers
- DInadequate business continuity planning; add a backup site
Explanation
One person controlling initiation, approval and release of payments is a classic segregation of duties failure. The preventive remedy is the separation of these functions (maker-checker). A monthly report would only detect problems after the fact, and physical access or backup sites do not address the conflict.
Did you get it right without looking?
One question tells you little. A timed set on Risk Mitigation shows your real accuracy, how long you take and where you lose marks.
More Risk Mitigation questions
- A bank wants its annual continuity testing to provide the strongest evidence that critical staff and systems can actually perform under a se…
- A bank assesses a key control that addresses a risk with inherent annual expected loss of USD 20 million. Testing shows the control is effec…
- A bank buys an operational risk insurance policy with a per-event deductible of USD 5 million and a per-event limit of USD 40 million. A sin…
- A bank's payments platform supports a critical business service. Management sets a statement of the maximum disruption it is willing to tole…
- A bank outsources its payment processing to a single provider. Risk management is concerned that a failure of the provider would halt paymen…
- In the three lines model commonly applied by banks, a business unit's head of operations identifies, owns and tests the day-to-day controls …