Skip to content

FRM Part II · FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks

When a bank builds a cyber loss distribution using a loss distribution approach, which statement about combining frequency and severity is most accurate?

Frequency and severity are modelled separately, typically Poisson for counts and a heavy-tailed distribution for loss size, and then aggregated by simulation into an annual loss distribution. This allows tail measures such as VaR to be derived, unlike simply combining averages.

  1. AFrequency and severity are modelled separately and then aggregated, for example by simulation, to obtain an annual loss distributionCorrect
  2. BOnly severity is modelled because frequency of cyber incidents is constant
  3. CThe annual loss distribution is obtained by adding the mean frequency to the mean severity
  4. DFrequency is modelled with a normal distribution and severity with a Poisson distribution

Explanation

The loss distribution approach models how often events occur (commonly Poisson) and how large they are (commonly heavy-tailed such as lognormal), then aggregates via Monte Carlo to give annual losses and tail measures. Adding means is meaningless dimensionally, and the distribution assignments in the last option are reversed.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Cyberthreats and Information Security Risks shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Cyberthreats and Information Security RisksFree diagnostic mock

More Case Study: Cyberthreats and Information Security Risks questions