Skip to content

FRM Part II · FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks

A regional bank's chief information security officer (CISO) reports to the chief risk officer and the board risk committee that the security team both operates the bank's security controls and independently tests whether those controls work. An internal audit review criticises this arrangement. Which principle of a sound cyber control framework is most directly breached?

The breach is segregation of duties between operating controls and independently testing them. A team that checks its own work provides no independent assurance, so the three lines of defence model requires separate second-line oversight or internal audit to validate control effectiveness.

  1. ADefence in depth, because only one layer of controls exists
  2. BSegregation of duties between control operation and independent assuranceCorrect
  3. CLeast privilege, because the CISO has excessive system access
  4. DRisk transfer, because cyber insurance has not been purchased

Explanation

When the same team runs controls and also tests them, there is no independent challenge. This is the role of the three lines of defence, where assurance on control effectiveness comes from an independent party such as internal audit or a separate testing function. Defence in depth and least privilege concern control design and access, not independence of testing.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Cyberthreats and Information Security Risks shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Cyberthreats and Information Security RisksFree diagnostic mock

More Case Study: Cyberthreats and Information Security Risks questions