Skip to content

FRM Part I · FRM Exam Part I · Operational Risk

In an operational risk framework, a risk and control self-assessment (RCSA) is performed by a business unit. Which statement best describes a limitation that governance should address?

An RCSA relies on the business unit's own judgment, so it is subjective and may be biased. Good governance has the second line challenge the results and validate them against internal loss data and key risk indicators. It is forward-looking and does identify control weaknesses.

  1. ARCSA results are purely backward-looking and based solely on audited loss data
  2. BRCSA is subjective and prone to bias, so results need independent challenge and should be validated against loss data and key risk indicatorsCorrect
  3. CRCSA cannot identify control weaknesses, only loss events
  4. DRCSA must be performed by the internal audit function to be valid

Explanation

RCSAs are forward-looking and rely on management judgment, so they can be biased, for example by optimism or fear of reporting weaknesses. Governance addresses this through challenge from the second line and comparison with loss data and indicators. They do identify control weaknesses, and they are performed by the business, not internal audit.

Did you get it right without looking?

One question tells you little. A timed set on Operational Risk shows your real accuracy, how long you take and where you lose marks.

Practise Operational RiskFree diagnostic mock

More Operational Risk questions