CISI UAE FRR Risk Management Frameworks 1 — Questions and Answers
Question 1: The 'three lines of defence' model in UAE financial institution risk management consists of:
- Business lines, risk/compliance functions, and internal audit (Correct answer)
- Regulators, external auditors, and internal audit
- Board, executive management, and shareholders
- Front office, middle office, and back office
Correct answer: Business lines, risk/compliance functions, and internal audit
The three lines model: 1st line (business units own and manage risks), 2nd line (risk management and compliance provide oversight and challenge), 3rd line (internal audit provides independent assurance).
Question 2: Under the CBUAE's risk management framework for banks, the Risk Appetite Statement (RAS) should be:
- Approved by the Board and cascaded through the organisation in measurable metrics (Correct answer)
- Developed exclusively by the Chief Risk Officer without board input
- A confidential document not shared with business lines
- Revised only during regulatory examinations
Correct answer: Approved by the Board and cascaded through the organisation in measurable metrics
The RAS articulates the Board-approved level and types of risk the bank is willing to accept in pursuit of its strategy; it must be translated into measurable limits and metrics that are monitored and reported regularly.
Question 3: Which Basel III risk category covers the risk of losses from inadequate processes, systems, people, or external events?
- Operational risk (Correct answer)
- Credit risk
- Market risk
- Liquidity risk
Correct answer: Operational risk
Operational risk encompasses losses from failures in processes, systems, or human error, as well as external events such as fraud, cyberattacks, natural disasters, and legal risks.
Question 4: Under CBUAE regulations, banks must conduct stress tests to assess:
- The impact of adverse scenarios on capital, liquidity, and profitability (Correct answer)
- Normal operating performance under current conditions
- Historical performance over the past 10 years
- Competitive positioning relative to peer banks
Correct answer: The impact of adverse scenarios on capital, liquidity, and profitability
Stress testing evaluates the bank's resilience under adverse scenarios (economic downturns, market shocks, liquidity crises) to identify vulnerabilities and ensure adequate capital and liquidity buffers.
Question 5: The CBUAE's guidance on model risk requires banks to:
- Validate, document, and regularly review all financial models used for risk measurement (Correct answer)
- Apply only regulatory-approved models without internal development
- Outsource all model development to external consultants
- Use historical data exclusively without scenario analysis
Correct answer: Validate, document, and regularly review all financial models used for risk measurement
Model risk management requires robust development, independent validation, documentation, and regular review of models to ensure they remain fit for purpose and that model limitations are understood.
Question 6: What is 'concentration risk' in the context of UAE bank credit risk management?
- Excessive exposure to a single borrower, sector, geography, or product (Correct answer)
- The risk of interest rate rises affecting all loans simultaneously
- The risk that a bank's operational systems fail at once
- Currency risk from operating in a single currency
Correct answer: Excessive exposure to a single borrower, sector, geography, or product
Concentration risk arises when a portfolio is excessively exposed to a single counterparty, industry sector, geographic region, or product type, meaning a single adverse event can cause disproportionate losses.
CISI UAE FRR Risk Management Frameworks 1
The 'three lines of defence' model in UAE financial institution risk management consists of: