FRM Part II · FRM Exam Part II · Risk Measurement and Assessment
A risk manager reviews RCSA results and notes that nearly every business unit rated its controls 'effective' and its residual risks 'low', yet loss event data show repeated losses in those same units. Which is the most appropriate response?
The risk manager should challenge the ratings through independent review, triangulating them against loss data, key risk indicators and audit findings. Self-assessments are subject to optimism bias, and conflicting objective evidence shows the ratings are unreliable, though RCSA itself remains valuable.
- AAccept the self-assessments because managers know their processes best
- BChallenge the ratings through independent review, comparing them with loss data, KRIs and audit findingsCorrect
- CEliminate the RCSA program and rely only on internal loss data
- DRaise the inherent risk ratings in all units by one level
Explanation
Self-assessments are prone to optimism and bias. A second-line challenge using objective evidence such as losses, KRIs and audit results corrects this. Abandoning RCSA discards forward-looking insight, and uniform adjustments are arbitrary.
Did you get it right without looking?
One question tells you little. A timed set on Risk Measurement and Assessment shows your real accuracy, how long you take and where you lose marks.
More Risk Measurement and Assessment questions
- A bank classifies a loss in which a loan default was caused by the loan officer deliberately falsifying the borrower's documents to meet sal…
- A bank's loss database records a loan fraud as follows: an employee colluded with an outside borrower to approve a false loan, causing a los…
- An operational risk manager notices that a bank's loss database only records events with a gross loss above USD 100,000, but the severity mo…
- During a risk and control self-assessment, a manager lists these items as 'operational risks': (1) a new competitor cutting prices, (2) staf…
- A risk manager is running scenario analysis workshops to estimate the severity of a rare cyber-extortion event. Business experts tend to anc…
- A bank's risk and control self-assessment (RCSA) program is reviewed. Business units identify risks by listing only events that have caused …