FRM Part II · FRM Exam Part II · Digital Resilience and Financial Stability: The Quest for Policy Tools in the Financial Sector
A financial stability authority is weighing capital buffers against operational-resilience requirements as a response to systemic cyber risk. Which argument best explains why capital alone is an incomplete tool?
Capital absorbs losses but does not keep critical services running, and cyber losses are hard to quantify and can be highly correlated across firms through shared dependencies. Resilience measures such as continuity, testing and third-party oversight are therefore needed alongside capital.
- ACapital absorbs losses but does not prevent a simultaneous loss of critical service availability, and cyber losses are hard to quantify and may be highly correlated across firmsCorrect
- BCapital requirements cannot legally apply to operational risk
- CCyber events only ever affect one firm at a time, so capital is unnecessary
- DCapital buffers increase the probability of cyber attacks
Explanation
Capital provides loss absorption but cannot restore service availability or prevent confidence-driven disruption. Cyber losses are difficult to model, with fat tails and correlation through shared dependencies. The other options are false: operational risk capital exists, events can be correlated, and buffers do not raise attack probability.
Did you get it right without looking?
One question tells you little. A timed set on Digital Resilience and Financial Stability: The Quest for Policy Tools in the Financial Sector shows your real accuracy, how long you take and where you lose marks.
More Digital Resilience and Financial Stability: The Quest for Policy Tools in the Financial Sector questions
- An insurer writes cyber policies with a 1,000 policy portfolio, each with a 4 million limit. It estimates an independent annual claim probab…
- A supervisor is assessing why the cyber insurance market may be unable to absorb systemic digital shocks. Which feature of cyber risk most d…
- Which feature best describes threat-led penetration testing as used in digital resilience frameworks?
- A regional bank's risk committee is reviewing why supervisors increasingly treat cyber incidents as a potential threat to financial stabilit…
- A central bank runs a system-wide cyber stress test in which a critical payment service is unavailable. Participating banks report they can …
- A bank participates in an information-sharing group but its legal team worries about liability and confidentiality of shared data. Which des…