FRM Part II · FRM Exam Part II · Risk Measurement and Assessment
A bank's RCSA for its trade settlement unit shows that nearly every business owner rates control effectiveness as 'strong', yet internal loss data show frequent settlement failures in that unit. Which action is most appropriate to address the weakness in the RCSA process?
The second line should independently challenge the ratings and triangulate them against loss data, key risk indicators and audit findings. Self-assessments are prone to optimism bias, and a clear conflict with actual losses shows the control ratings are unreliable and need validation.
- AChallenge the ratings through independent review by the second line and compare them with loss data, KRIs and audit findingsCorrect
- BAccept the ratings because business owners know their processes best
- CRemove the settlement unit from the RCSA scope until losses decline
- DReplace qualitative ratings with a single numeric score set by the business
Explanation
The mismatch suggests optimism bias in self-assessment. Independent challenge and triangulation with losses, KRIs and audit results is the standard remedy. Accepting the ratings leaves the bias in place, and removing the unit or letting the business set the scores reduces the independence and coverage that RCSA needs.
Did you get it right without looking?
One question tells you little. A timed set on Risk Measurement and Assessment shows your real accuracy, how long you take and where you lose marks.
More Risk Measurement and Assessment questions
- A bank aggregates RCSA results across 40 business units to prioritize remediation. Unit A rates a risk 'high' on a 3-level scale (low, mediu…
- A bank wants its risk identification process to capture emerging risks that have not yet produced losses, such as a new payments platform wi…
- A bank's scenario analysis workshop asks business experts for the frequency and severity of a cyber-extortion event. The first estimate give…
- A bank's LDA model for one risk category has an expected annual loss of USD 20 million and a 99.9% annual aggregate loss quantile of USD 260…
- A risk manager is reviewing how the bank defines operational risk for its taxonomy. Which of the following losses should be excluded from th…
- A risk manager notes that key risk indicator (KRI) data for a payments process are manually compiled by the process owners whose performance…