FRM Part II · FRM Exam Part II · Risk Mitigation
A risk manager is evaluating whether buying cyber insurance adequately mitigates a bank's exposure to a major data breach. Which limitation of insurance as an operational risk mitigant should she most clearly flag?
Insurance transfers only part of the financial loss. Reputational damage, loss of customer trust and the regulatory accountability for the bank's operations remain with the bank. Insurance does not fix control weaknesses or reduce breach frequency, and payouts can be delayed, capped or disputed.
- AInsurance eliminates the underlying control weaknesses that caused the breach
- BInsurance can transfer financial loss but not reputational damage or the regulatory responsibility for the bank's own operationsCorrect
- CInsurance always reduces the frequency of breaches
- DInsurance proceeds are always received immediately after the event
Explanation
Insurance transfers part of the financial loss but leaves reputational harm, customer trust, and accountability with the bank. It does not fix control weaknesses or lower frequency, and claims can be delayed or disputed. The other options misstate what insurance does.
Did you get it right without looking?
One question tells you little. A timed set on Risk Mitigation shows your real accuracy, how long you take and where you lose marks.
More Risk Mitigation questions
- A bank considers insurance mitigation under an advanced measurement approach-style framework. A risk manager notes that the insurance policy…
- A risk manager compares two mitigation options for a fraud risk with expected annual loss of USD 2.0 million. Option A costs USD 0.6 million…
- A bank's ransomware scenario shows an annual probability of 5% and a loss of USD 40 million if it occurs. Management considers two options. …
- A bank estimates that, without a new email-filtering control, phishing-related losses would have an expected annual loss of USD 4.0 million.…
- A bank considers shifting part of its cyber risk to a captive insurance subsidiary that reinsures with external markets. Which statement bes…
- A bank has a cyber insurance policy with a USD 50 million limit. Its scenario analysis shows a severe but plausible cyber event could cause …