Skip to content

FRM Part II · FRM Exam Part II · Introduction to Operational Risk and Resilience

A payments firm has mapped a critical operation, instant retail payments, and set a tolerance for disruption of 4 hours. During a scenario test, restoring the service took 6 hours because a third-party data centre failover was slower than assumed. What is the most appropriate interpretation and response?

The 6-hour recovery breached the 4-hour tolerance, so the test exposed a vulnerability in the third-party failover. The firm should remediate that dependency rather than loosen the tolerance, since tolerances are set from impact on customers and the firm, not from test results.

  1. AThe tolerance is met because the firm eventually restored the service and no data was lost
  2. BThe tolerance should be widened to 6 hours so that the test result is shown as a pass
  3. CThe tolerance was breached, so the firm should treat this as a vulnerability and remediate the dependency, for example through the vendor's failover capabilityCorrect
  4. DThe result is irrelevant because tolerance for disruption applies only to actual incidents, not to tests

Explanation

A tolerance for disruption is the maximum level of disruption the firm will accept for a critical operation. A 6-hour recovery against a 4-hour tolerance reveals a vulnerability, here a third-party dependency. The firm should remediate rather than redefine the tolerance to fit the result, which would defeat the purpose of testing.

Did you get it right without looking?

One question tells you little. A timed set on Introduction to Operational Risk and Resilience shows your real accuracy, how long you take and where you lose marks.

Practise Introduction to Operational Risk and ResilienceFree diagnostic mock

More Introduction to Operational Risk and Resilience questions