FRM Part II · FRM Exam Part II · Risk Reporting
A payments firm has defined an impact tolerance for its payment processing service of a maximum disruption of 4 hours. During a scenario test, the service was restored after 6 hours, with the delay caused by a third-party hosting provider. Which reporting action is most appropriate?
The firm should report the test as a breach of its 4-hour impact tolerance, name the third-party hosting dependency as the cause, and track remediation to senior management. Eventual restoration, loosening the tolerance or excluding external causes would hide a real resilience weakness.
- AReport the test as successful because the service was eventually restored
- BReport a tolerance breach in the test, identify the third-party dependency as the cause, and track remediation actions to senior managementCorrect
- CIncrease the impact tolerance to 6 hours so the test passes
- DExclude the result because the cause was external to the firm
Explanation
A 6-hour recovery exceeds the 4-hour tolerance, so it is a breach that must be reported with root cause and remediation. Changing the tolerance to fit results defeats its purpose, and third-party dependencies remain the firm's responsibility.
Did you get it right without looking?
One question tells you little. A timed set on Risk Reporting shows your real accuracy, how long you take and where you lose marks.
More Risk Reporting questions
- A mid-sized bank's operational risk function produces a single monthly report that is sent unchanged to the board, business-line heads and f…
- A bank uses a key risk indicator (KRI) for unreconciled payment breaks with thresholds: green below 40 breaks, amber 40 to 59, red 60 or mor…
- A bank's operational risk team is redesigning its quarterly board risk report. Board members have said the current 60-page document makes it…
- A bank's risk reports are produced quarterly. During a period of rapid growth in digital payments, a series of near-miss incidents occurs wi…
- A bank's credit exposure report is built by manually combining spreadsheets from several business lines, with frequent reconciliation breaks…
- A bank's board asks why its risk reports take weeks to produce after quarter-end and contain figures that differ between business lines. An …