Skip to content

FRM Part II · FRM Exam Part II · Risk Measurement and Assessment

A bank's risk and control self-assessment (RCSA) workshops produce a list of risks. The head of operational risk wants to use a cause-event-impact structure for each risk. A scenario states: 'Because of insufficient staff training, an operator misreads a payment instruction, resulting in a duplicate payment of USD 2 million that is only partly recovered.' Which mapping is correct?

Insufficient training is the cause, the misread instruction and duplicate payment is the event, and the unrecovered amount is the impact. A cause-event-impact structure separates the root driver, the operational incident and its financial consequence, which supports targeted controls and consistent loss data classification.

  1. ACause: duplicate payment; Event: insufficient training; Impact: partial recovery loss
  2. BCause: insufficient staff training; Event: misreading the instruction and duplicate payment; Impact: unrecovered USD amountCorrect
  3. CCause: misreading the instruction; Event: insufficient training; Impact: duplicate payment
  4. DCause: partial recovery; Event: duplicate payment; Impact: insufficient training

Explanation

The cause is the underlying driver (inadequate training, a people factor). The event is what happened (misread instruction leading to the duplicate payment). The impact is the financial consequence (the unrecovered portion). The other options swap these elements, for example treating training as an event.

Did you get it right without looking?

One question tells you little. A timed set on Risk Measurement and Assessment shows your real accuracy, how long you take and where you lose marks.

Practise Risk Measurement and AssessmentFree diagnostic mock

More Risk Measurement and Assessment questions