CORES Study Guide 2026
Everything you need to pass the CORES exam in one place: the exam format, every topic to study, real practice questions with explanations, flashcards, and full-length practice tests. Free, no sign-up needed.
📋 CORES Exam Format at a Glance
📚 CORES Topics to Study (75)
✍️ Sample CORES Questions & Answers
1. The primary purpose of maintaining a detailed incident log throughout an event is to:
A contemporaneous incident log captures the timeline, decisions, and actions in real time, supporting both immediate situational awareness and subsequent review, legal, and regulatory purposes.
2. An organization's vendor risk committee is reviewing a high-risk vendor that has consistently failed to remediate identified control gaps. What is the MOST appropriate escalation action?
Persistent control failures by a high-risk vendor require escalation to leadership and consideration of corrective actions up to and including termination.
3. Which approach is used when a risk cannot be eliminated?
When a risk cannot be eliminated or sufficiently reduced through other controls, risk transfer is an approach used to shift the financial consequences of the risk to another party. This is typically achieved through mechanisms like insurance, outsourcing, or contractual agreements. While the risk itself may still exist, the financial burden is transferred.
4. When scaling external loss data to fit an institution's risk profile, which size proxy is most commonly used?
Gross income is the standard scaling factor for adjusting external loss data, aligning with the Basel Standardized Approach's use of gross income as a risk proxy.
5. A risk manager notices that a KRI for transaction error rate has been in the green zone for 12 consecutive months without any threshold changes. What action is MOST appropriate?
A KRI that never leaves the green zone may have a threshold that is too generous to detect meaningful risk changes, requiring recalibration to remain useful.
6. A vendor serving a community bank is acquired by a foreign company in a country with weak data privacy laws. What is the MOST significant risk this creates?
Foreign acquisitions can expose customer data to the jurisdiction of countries with weaker privacy protections or government surveillance powers, creating regulatory and reputational risk.
🎯 Free CORES Practice Tests
📖 CORES Guides & Articles
- CORES Certification Guide: Everything You Need to Know About the COR Certification
- CORES Practice Tests: Free CORES Exam Questions & Study Guide 2026
- CORES Practice Test PDF (Free Printable 2026)
- Certified Operational Risk Executive Specialist
- Certified Operational Risk Executive Specialist: Your Guide to Mastering Risk Leadership