Operational Risk Management Flashcards
7 cards from real CRA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Operational Risk Management flashcards as text
A risk architect is designing a three lines of defense model. Which function represents the second line of defense?
Answer: Risk and compliance functions providing oversight and challenge
The second line of defense consists of risk management and compliance functions that set frameworks, provide oversight, and challenge the first line's risk management.
What distinguishes a 'near miss' from an operational loss event in loss data collection?
Answer: A near miss is an event that could have resulted in a loss but did not due to chance or control intervention
A near miss is an incident where a loss was averted—by luck or control—providing valuable risk intelligence without an actual financial impact.
Which scenario analysis technique involves asking subject matter experts to estimate the frequency and severity of hypothetical extreme operational risk scenarios?
Answer: Expert judgment-based scenario analysis
Expert judgment-based scenario analysis elicits structured estimates from experienced practitioners for rare but plausible events not captured in historical loss data.
A bank's operational risk framework establishes a risk appetite of no more than $10M in annual operational losses. This type of statement is best classified as a:
Answer: Risk tolerance threshold
A risk tolerance threshold defines the acceptable level of risk variation the institution is willing to experience relative to its risk appetite.
Under the OCC's Heightened Standards (12 CFR Part 30), which of the following is a required component of an operational risk management framework for large US banks?
Answer: A risk governance framework with an independent risk management function reporting to the board
OCC Heightened Standards require large banks to have an independent risk management function with direct reporting lines to the board to ensure objective oversight.
When evaluating vendor/third-party operational risk, which control is most critical for ensuring business continuity if a key vendor fails?
Answer: Maintaining a documented exit strategy and fallback arrangements
A documented exit strategy and fallback arrangements ensure the organization can transfer services or bring them in-house if a critical vendor becomes unavailable.
In operational risk management, what is the difference between inherent risk and residual risk?
Answer: Inherent risk exists before controls; residual risk remains after controls are applied
Inherent risk is the gross risk level before any mitigating controls are considered; residual risk is what remains after the effectiveness of controls is accounted for.