CORES Operational Risk Identification & Assessment 5 — Questions and Answers
Question 1: Which assessment method is MOST appropriate for estimating potential operational losses in a business line that has never experienced a major loss event?
- Actuarial analysis of internal loss data
- Forward-looking scenario analysis using expert judgment (Correct answer)
- Trend analysis of historical KRIs
- Regression analysis of past quarterly results
Correct answer: Forward-looking scenario analysis using expert judgment
When internal loss history is absent, scenario analysis leverages expert judgment to estimate the likelihood and impact of potential severe events.
Question 2: The 'four-eyes principle' in operational risk control design primarily mitigates which risk category?
- External fraud
- Technology failure
- Internal fraud and errors (Correct answer)
- Legal and compliance breaches
Correct answer: Internal fraud and errors
The four-eyes (dual-authorization) principle requires two people to review and approve actions, reducing the risk of internal fraud and undetected errors.
Question 3: A firm's operational risk function receives a new product proposal. The FIRST risk identification step should be to:
- Assign a risk rating based on the firm's existing heat map
- Map the end-to-end process of the new product to identify where risks could arise (Correct answer)
- Calculate the expected loss using the Basic Indicator Approach
- Benchmark the product against a competitor's loss history
Correct answer: Map the end-to-end process of the new product to identify where risks could arise
Process mapping a new product from inception to settlement reveals risk points before the product is launched, enabling proactive control design.
Question 4: Which of the following BEST illustrates a 'concentration risk' in an operational context?
- Multiple business lines relying on a single critical third-party vendor (Correct answer)
- A single large loan exposure in a credit portfolio
- A high frequency of small transaction errors
- Market price volatility affecting multiple asset classes
Correct answer: Multiple business lines relying on a single critical third-party vendor
Operational concentration risk arises when a single point of failure — such as one critical vendor — can simultaneously disrupt multiple business lines.
Question 5: The residual risk rating in an RCSA is determined by:
- Inherent risk rating minus the control effectiveness rating
- Evaluating the level of risk remaining after considering the effectiveness of existing controls (Correct answer)
- Adding the probability score to the impact score
- The external auditor's opinion on control design
Correct answer: Evaluating the level of risk remaining after considering the effectiveness of existing controls
Residual risk reflects what is left after applying and accounting for the effectiveness of all current mitigating controls.
Question 6: In operational risk identification, 'interdependency mapping' is used to:
- Calculate the correlation between market and credit risks
- Understand how failures in one system or process can cascade to others (Correct answer)
- Assign ownership for each risk in the risk register
- Rank risks by financial impact alone
Correct answer: Understand how failures in one system or process can cascade to others
Interdependency mapping reveals chains of causation so that a single control failure is not analyzed in isolation but in the context of downstream impacts.
Question 7: Which statement about qualitative versus quantitative operational risk assessment is MOST accurate?
- Quantitative methods are always preferred because they produce precise loss estimates
- Qualitative methods are only acceptable for small firms with limited data
- Both methods are complementary: qualitative captures expert insight while quantitative provides statistical rigor (Correct answer)
- Quantitative methods eliminate the need for scenario analysis once sufficient loss data exists
Correct answer: Both methods are complementary: qualitative captures expert insight while quantitative provides statistical rigor
Best practice combines qualitative tools (RCSA, scenario workshops) with quantitative analysis (loss modeling, KRI statistics) because each addresses the other's blind spots.
CORES Operational Risk Identification & Assessment 5
Which assessment method is MOST appropriate for estimating potential operational losses in a business line that has never experienced a major loss event?