Skip to content

FRM Part II · FRM Exam Part II · Case Study: Financial Crime and Fraud

A mid-sized bank discovers that an employee in its payments department has been diverting small amounts to personal accounts for several months. After the internal investigation confirms the fraud, which action best reflects sound incident response from an operational resilience perspective?

The best response is to contain the incident, preserve evidence, notify authorities where required, and use root-cause findings to strengthen controls. Removing the employee alone or hiding the event leaves control gaps unaddressed and creates regulatory and reputational exposure.

  1. ACorrect the affected accounts quietly and avoid recording the event to protect the bank's reputation
  2. BContain the incident, preserve evidence, notify the relevant authorities as required, and feed root-cause findings into control improvementsCorrect
  3. CDismiss the employee and close the matter without further review since the perpetrator has been removed
  4. DWait until the next annual audit cycle to review the control weaknesses that allowed the fraud

Explanation

Effective response combines containment, evidence preservation, required disclosure to authorities and learning through root-cause analysis. Dismissing the employee alone leaves the control gap open, and concealing the event breaches reporting duties and prevents loss data capture.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Financial Crime and Fraud shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Financial Crime and FraudFree diagnostic mock

More Case Study: Financial Crime and Fraud questions