Skip to content

FRM Part II · FRM Exam Part II · Risk Identification

In an RCSA, a bank distinguishes between a top-down and a bottom-up approach. Which statement correctly describes the bottom-up approach?

In a bottom-up RCSA, each business unit identifies and assesses its own risks and controls at process level, and the results are aggregated upward to give a firm-wide view. This differs from top-down approaches driven by senior management and from external data or audit-led reviews.

  1. ASenior management sets risk ratings for the whole firm without business input
  2. BEach business unit identifies and assesses risks and controls at process level, and results are aggregated upwardCorrect
  3. CRisks are identified only from external loss databases
  4. DOnly the internal audit function assesses controls

Explanation

A bottom-up RCSA starts at process or business-unit level, where owners identify risks and rate controls, and results are then aggregated. Senior-only rating is top-down, external data use is a different tool, and internal audit's independent assurance is separate from self-assessment.

Did you get it right without looking?

One question tells you little. A timed set on Risk Identification shows your real accuracy, how long you take and where you lose marks.

Practise Risk IdentificationFree diagnostic mock

More Risk Identification questions