FRM Part II · FRM Exam Part II · Risk Mitigation
Which testing approach best demonstrates that a firm can actually remain within its impact tolerances for an important business service during a severe but plausible disruption?
End-to-end scenario testing of the whole service, including third-party dependencies, with findings fed into remediation, best demonstrates ability to stay within impact tolerances. Policy reviews, isolated component tests and vendor self-certification do not show that the complete service can be recovered within the required limits.
- AReviewing the business continuity policy document annually
- BEnd-to-end scenario testing of the service, including third-party dependencies, with lessons fed back into remediationCorrect
- CTesting only the backup of individual databases in isolation
- DRelying on the vendor's certification of its own continuity arrangements
Explanation
Resilience is a service-level outcome, so end-to-end scenario tests that include people, processes, technology and third parties show whether tolerances can be met, and findings drive remediation. Document reviews, isolated component tests and vendor assertions do not prove the full service can be recovered in time.
Did you get it right without looking?
One question tells you little. A timed set on Risk Mitigation shows your real accuracy, how long you take and where you lose marks.
More Risk Mitigation questions
- A bank discovers that its critical vendor relies on a subcontractor (a fourth party) to host client data. What is the most appropriate respo…
- After a breach investigation, a bank finds that an attacker used stolen credentials of a vendor to move laterally from a low-sensitivity rep…
- During due diligence on a prospective cloud service provider, which finding should most concern a bank's risk committee when the service sup…
- A bank outsources its customer call centre to a vendor under a contract with service-level agreements. After a vendor failure, the bank's cu…
- Which practice best addresses moral hazard that arises once a bank has purchased operational risk insurance?
- A bank's operational risk team classifies a newly adopted control: a network intrusion detection system that raises an alert when unusual ou…