Skip to content

FRM Part II · FRM Exam Part II · Risk Mitigation

A bank's security team wants to ensure that no single administrator can both create a new payment beneficiary and approve payments to that beneficiary in its treasury system. Which control principle does this requirement most directly implement?

This is segregation of duties. Splitting beneficiary creation from payment approval means no single administrator can complete a fraudulent payment alone, so collusion or a second person is needed. Defense in depth instead layers different control types and does not separate roles within one process.

  1. ASegregation of dutiesCorrect
  2. BDefense in depth
  3. CData minimization
  4. DSecurity through obscurity

Explanation

Separating the ability to create beneficiaries from the ability to approve payments to them is segregation of duties, which reduces fraud and error by requiring more than one person to complete a sensitive process. Defense in depth refers to layering different types of controls, not splitting duties between people.

Did you get it right without looking?

One question tells you little. A timed set on Risk Mitigation shows your real accuracy, how long you take and where you lose marks.

Practise Risk MitigationFree diagnostic mock

More Risk Mitigation questions