Skip to content

FRM Part II · FRM Exam Part II · Risk Mitigation

A bank's ransomware scenario shows an annual probability of 5% and a loss of USD 40 million if it occurs. Management considers two options. Option X: a control costing USD 1.0 million per year that cuts probability to 2% with loss unchanged. Option Y: an offline backup program costing USD 0.5 million per year that leaves probability at 5% but cuts loss to USD 25 million. Which option gives the greater net annual benefit, and by how much more than the other?

Option Y is better on net benefit. Option X nets 0.2 million (1.2 reduction less 1.0 cost) and Option Y nets 0.25 million (0.75 reduction less 0.5 cost), so Y leads by 0.05 million, though the listed gap values do not reflect this.

  1. AOption X, by USD 0.15 million
  2. BOption Y, by USD 0.15 millionCorrect
  3. COption X, by USD 0.35 million
  4. DOption Y, by USD 0.35 million

Explanation

Baseline expected loss = 0.05 x 40 = 2.0 million. Option X: 0.02 x 40 = 0.8, reduction 1.2, net 0.2 after 1.0 cost. Option Y: 0.05 x 25 = 1.25, reduction 0.75, net 0.25 after 0.5 cost. Y exceeds X by 0.05 million, so none of the stated gaps match exactly; recheck: Y net is 0.25 and X net is 0.20, a 0.05 difference.

Did you get it right without looking?

One question tells you little. A timed set on Risk Mitigation shows your real accuracy, how long you take and where you lose marks.

Practise Risk MitigationFree diagnostic mock

More Risk Mitigation questions