CRO Operational Resilience Planning 2 — Questions and Answers
Question 1: Which metric best measures the maximum tolerable period of disruption for a critical business service?
- Recovery Time Objective (RTO)
- Maximum Tolerable Period of Disruption (MTPD) (Correct answer)
- Recovery Point Objective (RPO)
- Mean Time Between Failures (MTBF)
Correct answer: Maximum Tolerable Period of Disruption (MTPD)
MTPD defines the absolute outer limit beyond which a disruption would cause irreversible harm to the organization.
Question 2: In operational resilience, what does 'impact tolerance' represent?
- The level of risk appetite approved by the board
- The maximum level of disruption a firm can tolerate before it causes intolerable harm (Correct answer)
- The threshold at which a business continuity plan is activated
- The acceptable variance in service delivery standards
Correct answer: The maximum level of disruption a firm can tolerate before it causes intolerable harm
Impact tolerance sets the outer boundary of disruption a firm can absorb before harm to customers or the financial system becomes intolerable.
Question 3: A CRO is reviewing third-party concentration risk. Which scenario represents the greatest operational resilience threat?
- Three vendors providing non-critical administrative services
- A single cloud provider hosting all critical processing systems (Correct answer)
- Two vendors sharing a non-critical data analytics function
- Multiple vendors in different geographies for the same service
Correct answer: A single cloud provider hosting all critical processing systems
Single-provider concentration for all critical systems creates a single point of failure with potential systemic impact.
Question 4: Under the UK PRA's operational resilience policy, firms must be able to remain within impact tolerances during severe but plausible scenarios by what year?
- 2023
- 2024
- 2025 (Correct answer)
- 2026
Correct answer: 2025
UK regulators set March 2025 as the deadline for firms to demonstrate they can remain within impact tolerances under stress.
Question 5: What is the primary purpose of mapping dependencies in important business services?
- To satisfy regulatory reporting obligations
- To identify vulnerabilities and single points of failure that could breach impact tolerances (Correct answer)
- To allocate IT budget across business units
- To benchmark against industry peers
Correct answer: To identify vulnerabilities and single points of failure that could breach impact tolerances
Dependency mapping reveals where failures in people, processes, technology, or third parties could cascade and breach impact tolerances.
Question 6: Which approach to scenario testing provides the most realistic assessment of operational resilience?
- Tabletop exercises using historical incidents only
- Simulations limited to IT disaster recovery
- Severe but plausible scenarios that stress-test actual system interdependencies (Correct answer)
- Annual reviews of documented BCP procedures
Correct answer: Severe but plausible scenarios that stress-test actual system interdependencies
Severe but plausible scenario testing reveals real gaps by challenging actual system interdependencies under realistic adverse conditions.
Question 7: When a critical outsourced service provider experiences a prolonged outage, the first action a CRO should take is:
- Terminate the contract immediately
- Activate the firm's pre-established contingency and continuity arrangements (Correct answer)
- Notify regulators before assessing the situation
- Wait 24 hours to assess whether self-recovery occurs
Correct answer: Activate the firm's pre-established contingency and continuity arrangements
Pre-established contingency arrangements should be activated immediately to minimize disruption and maintain service within impact tolerances.
CRO Operational Resilience Planning 2
Which metric best measures the maximum tolerable period of disruption for a critical business service?