APRP Operational Risk Management 5

Question 1

A payments institution conducts a Business Impact Analysis (BIA) as part of its business continuity planning. What is the PRIMARY output of a BIA?

Accepted Answer

A ranked list of critical business functions and their maximum tolerable downtime

Answer

A BIA identifies critical business functions, dependencies, and the maximum tolerable period of disruption (MTPD) to prioritize recovery efforts.

Question 2

Which risk response strategy is being used when a payment company decides to accept a low-probability operational risk because the cost of controls exceeds the expected loss?

Accepted Answer

Risk acceptance

Answer

Risk acceptance is the deliberate decision to retain a risk when its cost of mitigation outweighs the potential loss impact.

Question 3

A payment processor implements a 'four-eyes' approval policy requiring two authorized personnel to approve large wire transfers. This control BEST addresses which operational risk category?

Accepted Answer

Internal fraud and unauthorized transactions

Answer

Four-eyes controls are designed to prevent unauthorized or fraudulent internal transactions by requiring dual authorization.

Question 4

Under the NIST Cybersecurity Framework, which function focuses on developing organizational understanding to manage cybersecurity risk to systems and assets?

Accepted Answer

Identify

Answer

The 'Identify' function establishes the foundation for cybersecurity risk management by understanding assets, risks, and governance contexts.

Question 5

A risk manager is calculating the Annualized Loss Expectancy (ALE) for a payment system outage. If the Single Loss Expectancy (SLE) is $500,000 and the outage is expected to occur twice per year, the ALE is:

Accepted Answer

$1,000,000

Answer

ALE = SLE × Annual Rate of Occurrence (ARO); $500,000 × 2 = $1,000,000.

APRP - Accredited Payments Risk Professional Practice Test

APRP - Accredited Payments Risk Professional Practice Test

APRP Operational Risk Management 5