Skip to content

FRM Part II · FRM Exam Part II · Risk Measurement and Assessment

A bank's RCSA for payments rates a control as 'effective' based on its design documentation. Control testing later shows it was bypassed in 30% of sampled transactions during peak periods. Which conclusion is most consistent with sound RCSA practice?

The control has adequate design but is not operating effectively, so its effectiveness rating should be downgraded, the residual risk raised and remediation planned. A control must both be well designed and work in practice; a 30 percent bypass rate shows it does not.

  1. AThe control is effective because design is adequate
  2. BThe control has a design-adequate but operating-ineffective weakness, so the residual rating should be raised and remediation plannedCorrect
  3. CThe inherent risk should be reduced because the control exists
  4. DThe result should be excluded as sampling error without further investigation

Explanation

Control effectiveness requires both adequate design and effective operation. A 30% bypass rate shows operating failure, so the control credit must be reduced, increasing residual risk and triggering remediation. Excluding the result ignores evidence, and inherent risk is independent of controls.

Did you get it right without looking?

One question tells you little. A timed set on Risk Measurement and Assessment shows your real accuracy, how long you take and where you lose marks.

Practise Risk Measurement and AssessmentFree diagnostic mock

More Risk Measurement and Assessment questions