Skip to content

FRM Part II · FRM Exam Part II · Risk Identification

A bank's payments division is preparing to run its first Risk and Control Self-Assessment (RCSA). The operational risk function wants the exercise to be owned and completed by the people who actually run the processes. Which approach best reflects sound RCSA practice?

Business line managers should perform the RCSA on their own processes, because they own the risks and controls. The operational risk function supplies the framework and provides independent challenge and consistency review. Audit or second-line completion removes ownership, while no challenge risks biased ratings.

  1. ABusiness line managers identify and assess risks and controls in their own processes, with the second line providing the framework, challenge and consistency reviewCorrect
  2. BThe internal audit function completes the assessments independently so that results are free of management bias
  3. CThe second line completes all assessments on behalf of the business to ensure uniform ratings across units
  4. DThe business line completes the assessments and the results are accepted without challenge to preserve ownership

Explanation

In an RCSA the first line owns risks and controls and performs the assessment. The second line sets methodology and challenges results for consistency. Having audit or the second line perform it removes ownership, and accepting results without challenge allows optimism bias to go unchecked.

Did you get it right without looking?

One question tells you little. A timed set on Risk Identification shows your real accuracy, how long you take and where you lose marks.

Practise Risk IdentificationFree diagnostic mock

More Risk Identification questions