Skip to content

FRM Part II · FRM Exam Part II · Risk Reporting

A payments bank sets a tolerance of 30 minutes for the maximum tolerable disruption of its card authorisation service. During a test, the failover to the secondary site restored service in 45 minutes. Which interpretation and action is MOST appropriate for the resilience report?

The 45-minute recovery exceeds the 30-minute tolerance, so it should be reported as a breach in the scenario test, with the causes of the delay identified and remediation tracked by owner and date. Loosening the tolerance or ignoring the test would hide a genuine resilience weakness.

  1. AReport the result as within tolerance because the service was eventually restored
  2. BReport a tolerance breach in the scenario test, identify the vulnerabilities causing the delay, and track remediation actions with owners and datesCorrect
  3. CRaise the tolerance to 45 minutes so the test is shown as passed
  4. DExclude the test from reporting because it was not a real incident

Explanation

Impact tolerance is the maximum disruption acceptable; 45 minutes exceeds 30, so the test shows a breach. Resilience reporting should show the gap, root causes and remediation. Resetting the tolerance to fit the result defeats its purpose, and ignoring tests removes valuable evidence.

Did you get it right without looking?

One question tells you little. A timed set on Risk Reporting shows your real accuracy, how long you take and where you lose marks.

Practise Risk ReportingFree diagnostic mock

More Risk Reporting questions