CORES Key Risk Indicator Development 5

Question 1

Which of the following represents the BEST example of a KRI with strong predictive validity for cybersecurity operational risk?

Accepted Answer

Percentage of critical systems with overdue patch remediation

Answer

Unpatched critical systems directly increase the attack surface and have a documented statistical relationship with successful breaches, giving this KRI strong predictive validity.

Question 2

A risk manager notices that a KRI for transaction error rate has been in the green zone for 12 consecutive months without any threshold changes. What action is MOST appropriate?

Accepted Answer

Review whether the threshold is set too loosely and lacks discriminating power

Answer

A KRI that never leaves the green zone may have a threshold that is too generous to detect meaningful risk changes, requiring recalibration to remain useful.

Question 3

Under Basel II/III operational risk guidance, how do KRIs relate to the Advanced Measurement Approach (AMA)?

Accepted Answer

KRIs serve as a qualitative/forward-looking component alongside internal and external loss data

Answer

Under AMA, KRIs form part of the four-data-element framework alongside internal losses, external losses, and scenario analysis to produce a comprehensive risk capital estimate.

Question 4

When performing a KRI gap analysis for a newly acquired subsidiary, what is the PRIMARY output expected?

Accepted Answer

A list of material risks in the subsidiary that lack adequate KRI coverage

Answer

A KRI gap analysis identifies material risks that are not yet monitored by any indicator, enabling the organization to build out monitoring coverage before losses occur.

Question 5

Which approach BEST ensures KRI thresholds remain relevant as the business environment changes?

Accepted Answer

Embedding a periodic review cycle (e.g., annual or after major risk events) into the governance framework

Answer

A structured periodic review tied to governance ensures thresholds are updated systematically in response to business changes, not left to drift or be changed ad hoc.

(CORES) Certified Operational Risk Executive Specialist Practice Test

(CORES) Certified Operational Risk Executive Specialist Practice Test

CORES Key Risk Indicator Development 5