Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

During a cyber risk self-assessment, a bank's business units rate their own control effectiveness as strong, yet internal audit finds repeated unresolved access-management findings. What is the most appropriate response by the second line?

The second line should independently challenge the ratings and calibrate them using objective evidence such as audit findings, control testing and incident data. Self-assessments tend to be optimistic, so accepting them, removing the scope or relying on one vulnerability count would leave known access-management weaknesses unreflected.

  1. AAccept the self-assessments since business units know their processes best
  2. BChallenge the ratings independently, using audit findings, testing results and incident data to calibrate the assessmentCorrect
  3. CRemove access management from the assessment scope to avoid conflict
  4. DReplace all qualitative assessment with a single vulnerability count

Explanation

Self-assessments are subject to optimism bias and need independent challenge, using objective evidence such as audit findings, control testing and incidents. Accepting them or dropping the scope leaves known weaknesses unreflected, and a single count oversimplifies.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions