FRM Part II · FRM Exam Part II · Risk Measurement and Assessment
A bank's RCSA program uses a heat map for aggregation across business lines. The operational risk head notes that two risks both rated 'medium' (likelihood 'possible', impact 'major') are treated as equivalent for prioritization, although one is a high-frequency, low-severity risk and the other a low-frequency, extreme-severity cyber event whose impact is capped by the top rating category. What is the principal limitation of the approach that this illustrates?
The limitation is that coarse ordinal scales, especially with a capped top impact category, put risks with very different frequency and severity profiles into the same cell. This hides extreme tail exposures and distorts prioritization and aggregation across the bank.
- AOrdinal rating scales with capped impact categories compress very different risk profiles and understate tail severityCorrect
- BHeat maps cannot be used with qualitative data
- CHeat maps overstate the effect of controls on all risks
- DRCSA results cannot be compared with any internal loss data
Explanation
Ordinal scales with a capped top category group risks with very different severity into the same cell, hiding tail exposure and distorting prioritization and aggregation. Heat maps are in fact built on qualitative data, so the second option is wrong. Nothing here concerns control effects or the ability to compare with loss data.
Did you get it right without looking?
One question tells you little. A timed set on Risk Measurement and Assessment shows your real accuracy, how long you take and where you lose marks.
More Risk Measurement and Assessment questions
- A bank's loss distribution approach models annual loss frequency as Poisson with mean 20 events per year and severity with mean USD 50,000. …
- A bank aggregates RCSA results across 40 business units to prioritize remediation. Unit A rates a risk 'high' on a 3-level scale (low, mediu…
- A bank's operational risk modeler wants to combine internal loss data with external loss data when estimating severity for a rare event type…
- An operational risk analyst notices that a bank's internal loss database records events by the date they were discovered, not the date they …
- A bank sets a KRI for staff turnover in its settlements team with an amber threshold of 10% and a red threshold of 15% annualised. Last quar…
- Under a loss distribution approach (LDA), a bank models a single risk cell with annual frequency Poisson with mean 20 and a severity distrib…