CORES Operational Risk Identification & Assessment 3 — Questions and Answers
Question 1: Which qualitative risk assessment tool structures risks into categories such as People, Process, Technology, and External factors?
- PESTLE analysis
- Operational Risk Taxonomy / Categorization Framework (Correct answer)
- Monte Carlo simulation
- Expected Loss model
Correct answer: Operational Risk Taxonomy / Categorization Framework
An operational risk taxonomy organizes risks into standard categories (People, Process, Technology, External) to ensure comprehensive identification.
Question 2: Gross risk (also called inherent risk) is best defined as:
- Risk remaining after all controls are applied
- Risk exposure before any mitigating controls are considered (Correct answer)
- Risk transferred to a third party through insurance
- Risk accepted within the firm's appetite
Correct answer: Risk exposure before any mitigating controls are considered
Inherent (gross) risk represents the level of risk that exists in the absence of any controls or mitigating actions.
Question 3: A scenario analysis workshop for a data center outage should PRIMARILY consider:
- Historical P&L volatility over the last decade
- Plausible but severe combinations of threat, vulnerability, and impact (Correct answer)
- Current KRI thresholds set by the risk committee
- The firm's approved risk appetite statement only
Correct answer: Plausible but severe combinations of threat, vulnerability, and impact
Scenario analysis explores credible, severe combinations of factors to stress-test preparedness beyond what historical data alone reveals.
Question 4: The primary purpose of maintaining an internal loss database is to:
- Replace the need for external loss data consortia
- Provide empirical evidence of past operational failures for trend analysis and capital modeling (Correct answer)
- Satisfy regulatory reporting requirements only
- Benchmark the firm's losses against insurance premiums
Correct answer: Provide empirical evidence of past operational failures for trend analysis and capital modeling
An internal loss database captures historical operational loss events to support trend analysis, root-cause studies, and regulatory capital calculations.
Question 5: External loss data (e.g., from ORX or public databases) is MOST valuable when:
- Internal data is sufficient and recent
- A firm lacks sufficient internal data for rare but high-severity events (Correct answer)
- Only qualitative methods are being used
- KRIs are already in the red zone
Correct answer: A firm lacks sufficient internal data for rare but high-severity events
External loss data fills gaps where a firm's own history is insufficient, particularly for tail events that are rare but catastrophic.
Question 6: In RCSA (Risk and Control Self-Assessment), a 'control gap' exists when:
- A control is rated effective but no risk exists
- A risk's residual rating remains unacceptably high despite existing controls (Correct answer)
- The risk owner disagrees with the risk committee's rating
- Two controls address the same risk simultaneously
Correct answer: A risk's residual rating remains unacceptably high despite existing controls
A control gap is identified when current controls are insufficient to reduce residual risk to within the firm's acceptable tolerance.
Question 7: Which statement BEST describes the difference between a Key Risk Indicator (KRI) and a Key Control Indicator (KCI)?
- KRIs measure control effectiveness; KCIs measure risk exposure levels
- KRIs provide early warning signals of increasing risk; KCIs measure how well controls are operating (Correct answer)
- KRIs are quantitative; KCIs are always qualitative
- KRIs are reported to regulators; KCIs are internal only
Correct answer: KRIs provide early warning signals of increasing risk; KCIs measure how well controls are operating
KRIs signal rising risk levels before losses occur, while KCIs track whether specific controls are functioning as designed.
CORES Operational Risk Identification & Assessment 3
Which qualitative risk assessment tool structures risks into categories such as People, Process, Technology, and External factors?