Financial Risk Management Operational Risk Framework 2 — Questions and Answers
Question 1: What is 'scenario analysis' used for in operational risk capital modeling?
- Forecasting interest rate movements over a five-year horizon
- Using expert judgment to estimate the frequency and severity of rare but plausible extreme operational loss events not in the historical data (Correct answer)
- Backtesting credit risk models against past defaults
- Simulating equity portfolio returns under changing correlations
Correct answer: Using expert judgment to estimate the frequency and severity of rare but plausible extreme operational loss events not in the historical data
Scenario analysis supplements internal loss data by capturing low-frequency/high-severity events (e.g., a major cyber attack or rogue trader) that haven't occurred recently but could happen.
Question 2: What does the Basel Standardized Approach (TSA) for operational risk use to differentiate capital across business lines?
- Different beta factors (12–18%) applied to gross income by business line (Correct answer)
- Different alpha factors based on the number of employees per business line
- A flat percentage applied to total assets regardless of business mix
- Credit ratings of the business line's major counterparties
Correct answer: Different beta factors (12–18%) applied to gross income by business line
TSA assigns beta factors ranging from 12% to 18% to eight defined business lines (retail banking, trading, asset management, etc.) and multiplies each by its gross income.
Question 3: Which of the following best describes the 'Advanced Measurement Approach' (AMA) for operational risk under Basel II?
- A fixed 15% capital charge applied uniformly to all banks
- An internal model approach where banks use quantitative models combining internal loss data, external data, scenario analysis, and business environment factors to estimate operational risk capital (Correct answer)
- A regulator-prescribed formula using total assets as the base
- A peer-comparison method where capital is set to the 75th percentile of industry losses
Correct answer: An internal model approach where banks use quantitative models combining internal loss data, external data, scenario analysis, and business environment factors to estimate operational risk capital
The AMA allowed sophisticated banks to build bespoke models for operational risk capital, incorporating all four data elements, subject to regulatory approval — it was replaced by the Standardized Measurement Approach in Basel IV.
Question 4: What is 'cyber risk' classified as under the operational risk framework?
- Market risk because it affects asset prices
- Liquidity risk because it can freeze payment systems
- Operational risk under the 'systems failures' or 'external events' category (Correct answer)
- Strategic risk outside the Basel operational risk definition
Correct answer: Operational risk under the 'systems failures' or 'external events' category
Cyber attacks (data breaches, ransomware, DDoS) fall within the Basel operational risk definition under 'systems failures' or 'external events,' and are increasingly the largest operational risk concern for banks.
Question 5: What is 'business continuity planning' (BCP) in the context of operational risk?
- A strategic plan for entering new markets during economic downturns
- A documented framework ensuring critical business functions can continue or recover quickly after a disruptive operational risk event (Correct answer)
- A regulatory requirement to disclose operational losses quarterly
- A process for terminating vendor relationships that pose excessive operational risk
Correct answer: A documented framework ensuring critical business functions can continue or recover quickly after a disruptive operational risk event
BCP includes disaster recovery plans, backup systems, alternate operating sites, and communication protocols to minimize downtime and loss when a disruption (fire, flood, cyberattack) occurs.
Question 6: In operational risk, what is the 'frequency-severity' framework?
- A model that separates operational losses into how often they occur and how large they are, then combines these distributions to estimate total loss (Correct answer)
- A regulatory stress test framework requiring banks to test both high-frequency and high-severity market scenarios
- A grading scale used by auditors to rate internal control weaknesses
- A Basel formula for allocating capital between trading and banking book exposures
Correct answer: A model that separates operational losses into how often they occur and how large they are, then combines these distributions to estimate total loss
Operational risk capital models separately model loss frequency (using Poisson distributions) and loss severity (using lognormal or Pareto), then convolve them via Monte Carlo to produce a loss distribution.
Financial Risk Management Operational Risk Framework 2
What is 'scenario analysis' used for in operational risk capital modeling?