QFC Internal Controls & Risk Assessment 3 — Questions and Answers
Question 1: A risk heat map plots risks on axes representing probability and impact. A risk that falls in the high-probability, high-impact quadrant should primarily be:
- Accepted and monitored
- Transferred to a third party
- Prioritized for immediate mitigation (Correct answer)
- Documented and reviewed annually
Correct answer: Prioritized for immediate mitigation
Risks in the high-probability, high-impact quadrant represent the greatest threat and require immediate, active mitigation strategies.
Question 2: Which internal control principle under COSO requires that management establish structures, reporting lines, and appropriate authorities?
- Demonstrates commitment to integrity
- Establishes structure, authority, and responsibility (Correct answer)
- Enforces accountability
- Selects and develops competent individuals
Correct answer: Establishes structure, authority, and responsibility
The principle 'Establishes Structure, Authority, and Responsibility' under the Control Environment component requires management to define organizational structures and authority.
Question 3: In operational risk management, the Loss Distribution Approach (LDA) combines which two data sets to model annual loss distributions?
- Market data and credit ratings
- Internal loss data and external loss data (Correct answer)
- Regulatory capital figures and scenario estimates
- VaR outputs and stress test results
Correct answer: Internal loss data and external loss data
The LDA combines internal loss data with external loss data (supplemented by scenario analysis) to estimate frequency and severity distributions for operational losses.
Question 4: A trader's P&L consistently falls outside the 99% VaR boundary more than 5 times in 250 trading days. Under Basel backtesting rules, this result falls in the:
- Green zone
- Yellow zone
- Red zone (Correct answer)
- Gray zone
Correct answer: Red zone
Under Basel traffic-light backtesting, more than 4 exceptions in 250 days places the model in the red zone, indicating likely model inadequacy.
Question 5: Segregation of duties (SoD) is designed primarily to prevent which type of control failure?
- Systemic IT outages
- Collusion between external parties
- A single individual from both executing and recording a transaction (Correct answer)
- Inadequate documentation of procedures
Correct answer: A single individual from both executing and recording a transaction
SoD ensures that no single person has control over all phases of a transaction, reducing the risk that errors or fraud could be committed and concealed by one individual.
Question 6: Which quantitative risk measure captures the expected loss in the tail of the distribution beyond the VaR threshold?
- Expected Shortfall (ES) (Correct answer)
- Maximum Drawdown
- Beta
- Tracking Error
Correct answer: Expected Shortfall (ES)
Expected Shortfall (also called CVaR or ETL) measures the average loss in the worst scenarios beyond the VaR confidence level, capturing tail risk.
Question 7: An enterprise risk register typically includes all of the following EXCEPT:
- Risk description and category
- Risk owner and mitigation actions
- Actual historical loss amounts for all events (Correct answer)
- Residual risk rating after controls
Correct answer: Actual historical loss amounts for all events
Risk registers capture identified risks, owners, controls, and residual ratings, but do not necessarily include actual historical loss amounts, which are tracked in loss databases.
QFC Internal Controls & Risk Assessment 3
A risk heat map plots risks on axes representing probability and impact.
A risk that falls in the high-probability, high-impact quadrant should primarily be: