Risk Management Auditing Flashcards
7 cards from real CBA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Risk Management Auditing flashcards as text
An auditor reviewing a bank's risk register finds that several high-rated risks have no assigned owner. What is the most significant implication?
Answer: High risks without owners are unlikely to receive timely mitigation or escalation
Without designated risk owners, accountability is absent and high-severity risks may go unmitigated, increasing the likelihood of loss events.
Which regulatory framework specifically addresses operational risk capital requirements under the standardized approach for large US banks?
Answer: Basel III / OCC/Fed capital rules implementing the Business Indicator Component (BIC)
Basel III's standardized approach for operational risk capital uses the Business Indicator Component (BIC) to set minimum capital requirements for large banks.
A bank uses credit default swaps (CDS) to hedge credit risk. As an auditor, which risk introduced by this hedging strategy warrants the most scrutiny?
Answer: Counterparty credit risk on the CDS protection seller
CDS introduce counterparty credit risk because if the protection seller defaults, the hedge fails precisely when it is most needed.
What is the primary purpose of a risk and control self-assessment (RCSA) in a bank's operational risk framework?
Answer: To allow business units to identify, assess, and document their own risks and controls
RCSAs are a first-line tool that empowers business units to proactively identify operational risks and evaluate the adequacy of existing controls.
Which scenario would most likely result in a Matters Requiring Attention (MRA) from a bank regulator related to risk management?
Answer: A bank with no formal process for escalating limit breaches to senior management
The absence of a formal limit breach escalation process is a material control gap that regulators would cite as requiring prompt corrective action.
In evaluating a bank's market risk model, an auditor notes the model uses a 99% confidence level and a 10-day holding period. Under Basel rules, what does exceeding four backtesting exceptions in a year trigger?
Answer: An increase in the VaR capital multiplier (from the 'green zone' to a higher zone)
More than four backtesting exceptions in 250 trading days moves the bank from the green zone and triggers an increase in the regulatory VaR multiplication factor.
An internal audit of the enterprise risk management (ERM) framework reveals that risk appetite metrics are not linked to performance management incentives. What risk does this create?
Answer: Employees may take excessive risks because compensation is not tied to staying within risk limits
When incentives are decoupled from risk appetite, employees face pressure to maximize short-term gains without accountability for risk-taking behavior.