FRM Part II · FRM Exam Part II · Digital Resilience and Financial Stability: The Quest for Policy Tools in the Financial Sector
A risk analyst compares two ways of modelling extreme cyber losses for the financial sector. Historical data are scarce and incidents are highly correlated across firms. Which approach is most appropriate for assessing systemic impact?
Scenario-based analysis of severe but plausible events, such as a common-provider failure, supplemented by tail-focused statistics, is most appropriate. Scarce data, fat tails and cross-firm correlation make averages, independence assumptions and short loss histories understate systemic cyber losses.
- AUse average annual loss per firm multiplied by the number of firms
- BUse scenario-based analysis of severe but plausible events, including common-provider failure, alongside tail-focused statisticsCorrect
- CAssume losses are independent and normally distributed
- DRely solely on the past three years of reported losses
Explanation
Sparse data, fat tails and correlation make simple averages and normal independence assumptions understate systemic loss. Scenario analysis of severe but plausible events captures contagion and common-mode failure. Option A ignores correlation and tails; C and D understate risk given limited history.
Did you get it right without looking?
One question tells you little. A timed set on Digital Resilience and Financial Stability: The Quest for Policy Tools in the Financial Sector shows your real accuracy, how long you take and where you lose marks.
More Digital Resilience and Financial Stability: The Quest for Policy Tools in the Financial Sector questions
- An insurer considers offering cyber coverage to many banks that all depend on the same software vendor. Which is the main concern for the in…
- A bank's risk committee reviews a cyber incident scenario. The bank's critical payment service has a maximum tolerable outage of 4 hours. Te…
- A supervisor wants a policy tool that addresses the risk that many financial institutions rely on the same cloud provider, so that one outag…
- A regional bank migrates most of its core payment processing to a single cloud provider to cut costs. From a financial stability perspective…
- Several banks in a jurisdiction rely on the same cloud provider for core payment processing. A supervisor wants a tool that directly address…
- During a cross-border cyber incident, firms hesitate to share information with authorities in other jurisdictions. Which obstacle is most co…