CORES Risk Control Strategies & Mitigation Planning 2

Question 1

A bank discovers that a critical vendor handles 60% of its payment processing. Which risk control strategy best addresses this concentration risk?

Accepted Answer

Diversify across multiple vendors to reduce single-point dependency

Answer

Diversification reduces concentration risk by distributing dependency across multiple vendors, limiting exposure if one vendor fails.

Question 2

Which element is MOST critical when designing a risk mitigation control to ensure it remains effective over time?

Accepted Answer

Built-in monitoring and periodic review mechanisms

Answer

Controls must include monitoring and review mechanisms because risk environments evolve, and a static control can become ineffective.

Question 3

An operational risk manager recommends purchasing cyber insurance for a data breach scenario. This is an example of which risk strategy?

Accepted Answer

Risk transfer

Answer

Cyber insurance transfers the financial consequences of a data breach to a third-party insurer, exemplifying risk transfer.

Question 4

Under the Basel operational risk framework, the 'four-eyes principle' is a control primarily designed to mitigate which risk type?

Accepted Answer

Internal fraud and processing errors

Answer

The four-eyes principle requires dual approval, directly reducing internal fraud and inadvertent processing errors through segregation of duties.

Question 5

A firm identifies a residual risk that remains after all feasible controls are applied. What is the MOST appropriate next step?

Accepted Answer

Document the residual risk and obtain formal management acceptance

Answer

Residual risk that cannot be economically reduced further must be formally accepted by management and documented in the risk framework.

(CORES) Certified Operational Risk Executive Specialist Practice Test