CORES Key Risk Indicator Development 3 — Questions and Answers
Question 1: Which statistical technique is commonly used to determine whether a KRI threshold is set at an appropriate level relative to historical loss data?
- Monte Carlo simulation
- Regression analysis linking KRI values to loss events (Correct answer)
- Chi-square goodness-of-fit test
- Exponential smoothing forecast
Correct answer: Regression analysis linking KRI values to loss events
Regression analysis can reveal whether KRI movements statistically precede or correlate with loss events, validating the threshold's predictive relevance.
Question 2: A KRI for third-party vendor risk measures 'percentage of vendors past contract review date.' What type of KRI is this?
- Outcome KRI
- Process / Control KRI (Correct answer)
- Volume KRI
- Velocity KRI
Correct answer: Process / Control KRI
This is a process or control KRI because it measures adherence to a required risk management activity rather than an exposure level or loss outcome.
Question 3: What is the PRIMARY purpose of normalizing KRI data before aggregating it into an enterprise risk score?
- To remove outliers that would trigger false alerts
- To enable comparison and combination of metrics measured in different units or scales (Correct answer)
- To align reporting cycles across business lines
- To satisfy external audit documentation requirements
Correct answer: To enable comparison and combination of metrics measured in different units or scales
Normalization converts disparate metrics (counts, percentages, dollar amounts) onto a common scale so they can be meaningfully aggregated without distortion.
Question 4: Which scenario represents a 'false positive' problem in KRI design?
- A KRI fails to alert when a major fraud event occurs
- A KRI repeatedly triggers red alerts but no actual losses follow (Correct answer)
- A KRI threshold is never reviewed after initial setting
- A KRI is owned by a team with no risk management training
Correct answer: A KRI repeatedly triggers red alerts but no actual losses follow
False positives occur when the KRI signals danger too often without corresponding losses, eroding management confidence and leading to alert fatigue.
Question 5: In operational risk management, a 'leading' KRI for people risk would MOST likely measure which of the following?
- Number of HR policy violations recorded last quarter
- Employee engagement score and voluntary turnover rate trend (Correct answer)
- Total disciplinary actions taken year-to-date
- Value of settlements paid in employment lawsuits
Correct answer: Employee engagement score and voluntary turnover rate trend
Engagement and turnover trends are predictive of future conduct incidents and operational errors, making them leading indicators of people risk.
Question 6: An organization uses a 'heat map' to display KRI status. What additional dimension does a heat map add compared to a simple RAG (Red-Amber-Green) status report?
- It shows the financial cost of each risk
- It visualizes both likelihood and impact dimensions simultaneously (Correct answer)
- It ranks KRIs by ownership accountability
- It links each KRI to a specific regulatory requirement
Correct answer: It visualizes both likelihood and impact dimensions simultaneously
A heat map plots risks on a two-axis grid (likelihood vs. impact), providing richer context than a single-color status that only indicates whether a threshold is breached.
Question 7: Which governance body is typically responsible for approving changes to enterprise-level KRI thresholds at a large financial institution?
- IT Risk Steering Committee
- Operational Risk Management Committee or equivalent second-line forum (Correct answer)
- Individual business line risk managers
- External auditors during the annual review
Correct answer: Operational Risk Management Committee or equivalent second-line forum
Enterprise KRI thresholds represent the organization's risk appetite and must be approved by a formal second-line governance body to ensure consistency and accountability.
CORES Key Risk Indicator Development 3
Which statistical technique is commonly used to determine whether a KRI threshold is set at an appropriate level relative to historical loss data?