FRM Part II · FRM Exam Part II · Risk Identification
A bank's risk function combines internal loss data with scenario-based loss estimates. For a cyber-extortion event, internal data shows no losses above USD 5 million, while the scenario workshop, informed by peer incidents, estimates a plausible 1-in-50-year loss of USD 150 million. A reviewer must decide how to treat the discrepancy. Which approach is most consistent with sound practice?
The reviewer should investigate the gap, challenge the scenario assumptions against external peer incidents and the bank's controls, and document the severity chosen, allowing the scenario to inform the tail. Internal data rarely contains tail events, so neither ignoring the scenario nor mechanically averaging is sound.
- AAdopt the internal data figure because it is objectively observed and scenarios are subjective
- BAverage the two figures to remove the disagreement without further analysis
- CInvestigate the gap, validate scenario assumptions against external data and control environment, and document the rationale for the severity used, using the scenario to inform the tailCorrect
- DDiscard the scenario since no internal loss has ever approached USD 150 million
Explanation
Internal data typically lacks tail observations, so scenarios and external data are meant to fill that gap. The discrepancy should be investigated, challenged against peer events and the bank's controls, and the final choice documented. Simple averaging has no analytical basis, and ignoring either source defeats the purpose of combining them.
Did you get it right without looking?
One question tells you little. A timed set on Risk Identification shows your real accuracy, how long you take and where you lose marks.
More Risk Identification questions
- A bank's internal loss data show many small losses but almost no large ones, while industry data show several very large losses in the same …
- An analyst reviews an internal loss event database and finds that it contains only events above a USD 50,000 collection threshold. Which is …
- A bank's payments division is preparing to run its first Risk and Control Self-Assessment (RCSA). The operational risk function wants the ex…
- A bank's horizon scanning exercise highlights that a rapidly growing fintech partner may become a critical dependency for its customer onboa…
- A bank runs scenario workshops and finds that participants anchor on the first loss estimate offered by a senior executive, and that estimat…
- A bank is about to migrate its payments platform to a new vendor system. Which approach best reflects sound operational risk identification …