Free 8020 Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

Step 1: What Is the Turnbull Report?

The Turnbull Report (1999) was a UK corporate governance report that set risk management

expectations for boards.

It required companies to assess and manage risks effectively as part of corporate governance.

Step 2: Why Option C is Correct

Turnbull was the first report to mandate that boards must consider risk management in corporate

governance.

This report established risk assessment as a board-level responsibility.

Step 3: Why the Other Options Are Incorrect

Option A ("Defined risk governance for insurance") → Incorrect because Turnbull applied to all

sectors, not just insurance.

Option B ("First report to propose board structure") → Incorrect because corporate boards existed

long before Turnbull.

Option D ("Led to the US Federal Reserve") → Incorrect because the Federal Reserve was established

in 1913, long before Turnbull.

PRMIA Risk Reference Used:

PRMIA Corporate Governance Guidelines – Highlights Turnbull's role in board-level risk oversight.

UK Corporate Governance Code – Turnbull contributed to defining board risk responsibilities.

Final Conclusion:

The Turnbull Report was the first to require boards to consider risks in corporate governance, making

Option C the correct answer.

Thank you for your visit.

Step 1: Role of a Risk Assessment Facilitator

The facilitator’s main role is to guide discussions without bias, ensuring objective risk identification.

PRMIA’s Risk Governance Framework highlights neutral facilitation as key to effective risk

workshops.

Step 2: Why Option C Is Correct

Objectivity ensures unbiased risk assessment.

Expressing personal opinions can influence risk ratings, leading to distorted outcomes.

Step 3: Why the Other Options Are Incorrect

Option A ("Guide the workshop toward a pre-determined conclusion")

Incorrect because risk workshops should discover risks, not confirm pre-set beliefs.

Option B ("Attendees can override results")

Incorrect as risk results should be evidence-based, not subject to override.

Option D ("Attend via video connection")

Incorrect as facilitators must engage actively, making remote facilitation less effective.

PRMIA Risk Reference Used:

PRMIA Risk Governance Framework – Stresses objectivity in risk assessment facilitation.

PRMIA Risk Identification Best Practices – Encourages unbiased workshops.

Final Conclusion:

Facilitators must remain neutral and objective, making Option C the correct answer.

Impact Tolerance is a key concept in Operational Resilience, defined as the ability of a firm to

withstand, respond to, and recover from disruptions. According to PRMIA and global regulatory

frameworks (such as the Bank of England's Operational Resilience Framework), impact tolerance is

specifically tied to business services rather than processes.

Step 1: Defining Impact Tolerance

Impact tolerance is the maximum acceptable level of disruption to an important business service,

beyond which there would be intolerable harm to customers, financial markets, or regulatory

obligations.

It is not the same as risk appetite or risk capacity, as those deal with broader organizational risk

exposure.

Step 2: Why Business Services Matter

PRMIA defines business services as end-to-end services delivered to clients and stakeholders, such as

payments processing, trade execution, or loan approvals.

Disruptions to these services directly impact customers and financial stability, making business

service resilience the core focus of impact tolerance.

Step 3: Why the Other Options Are Incorrect

Option A ("tolerance for disruption to a particular business process")

Incorrect because impact tolerance applies to services, not just internal processes.

Option C ("a firm's risk appetite statement")

Incorrect because risk appetite focuses on how much risk a firm is willing to take, while impact

tolerance is about surviving disruptions.

Option D ("a firm's risk capacity statement")

Incorrect because risk capacity is the maximum level of risk a firm can bear, which is broader than

business service disruptions.

PRMIA Risk Reference Used:

PRMIA Operational Resilience Guidelines – Defines impact tolerance as a service-based metric.

Bank of England’s Operational Resilience Framework – Establishes impact tolerance as a limit on

business service disruption.

Final Conclusion:

Impact tolerance focuses on business services, not just internal processes or risk appetite, making

Option B the correct answer.

tep 1: Purpose of Internal Loss Investigations

Internal loss investigations analyze past loss events to identify root causes, improve controls, and

enhance risk assessments.

Step 2: Why Option A Is Correct

Root Cause Analysis: Identifying why the loss occurred.

Focus on Remediation: Implementing corrective measures to prevent recurrence.

Scenario Analysis Improvement: Using lessons learned to enhance risk scenario modeling.

Step 3: Why the Other Options Are Incorrect

Option B ("Focus on who caused the issue") → Incorrect because loss investigations are about

systemic issues, not assigning blame.

Option C ("Ascertain responsibility for the loss event") → Incorrect because the focus is on process

improvements, not individual accountability.

Option D ("Determined by HR on a case-by-case basis") → Incorrect because HR does not dictate risk

investigations—risk and compliance functions do.

PRMIA Risk Reference Used:

PRMIA Operational Risk Framework – Emphasizes loss investigations for systemic risk management.

Basel III Risk Governance Standards – Defines loss event analysis as a key risk management tool.

Risk-sensitive pricing ensures that financial institutions and businesses properly account for risk in

their pricing strategies to maintain stability and sustainability. PRMIA’s Risk Pricing and Capital

Adequacy Guidelines define the importance of risk-sensitive pricing in ensuring fair compensation

for risk exposure and avoiding risk concentration issues.

Step 1: Why Risk-Sensitive Pricing Is Important

Aligns risk with return: Pricing should be designed to reflect the underlying risk and return trade-off.

Protects investors: Investors expect compensation for capital at risk (Option A is correct).

Reinforces risk-aware culture: PRMIA promotes linking incentives to risk-adjusted returns (Option B

is correct).

Prevents adverse selection: Proper risk pricing prevents low-quality assets from accumulating

(Option C is correct).

Step 2: Why Option D Is Incorrect

Income targets are business-driven, not risk-driven.

Risk-sensitive pricing aims to balance risk and reward, not just maximize revenue.

PRMIA discourages profit-seeking behavior at the expense of risk considerations.

PRMIA Risk Reference Used:

PRMIA Risk Pricing Guidelines – Defines the principles of risk-sensitive pricing.

PRMIA Risk-Adjusted Return Standards – Stresses linking incentives to risk-aware decisions.

PRMIA Capital Adequacy Framework – Highlights the role of risk-sensitive pricing in portfolio

management.

Final Conclusion:

Risk-sensitive pricing is designed to align returns with risk exposure, not simply to meet or exceed

income targets, making Option D the correct answer.

Role of the Risk Function

The risk function is responsible for documenting, monitoring, and overseeing risk policies and

frameworks.

It ensures the organization maintains structured risk governance, reporting, and compliance.

Key Responsibilities

Developing Risk Management Manuals to define risk appetite, risk frameworks, and risk governance

structures.

Creating Risk Policies that align with regulatory standards and internal controls.

Why Answer B is Correct

The risk function primarily develops, implements, and maintains risk management frameworks,

which include formal manuals and policies.

Why Other Answers Are Incorrect

Option

Explanation

A . Documenting its activities, typically by

operating and then recording the daily operation

of controls.

Incorrect – The first line of defense (business units)

handles daily operational controls, not the risk

function.

C . Putting in place the servers, firewalls, and

software to ensure cybersecurity.

Incorrect – Cybersecurity is an IT responsibility, while

the risk function oversees cyber risk frameworks.

D . Creating a trial balance, balance sheet

statement, and cash flow statement.

Incorrect – These are financial accounting

responsibilities, not risk management duties.

PRMIA Reference for Verification

PRMIA Governance Framework for Risk Management

Basel Risk Management Principles

Process Mapping is a risk management tool used to visualize workflows, identify inefficiencies, and

detect control gaps. PRMIA defines process mapping as an essential operational risk management

tool.

Step 1: Understanding Process Mapping

Helps analyze complex, process-intensive activities (Option A).

Reveals control weaknesses that could lead to operational risks (Option B).

Improves hand-offs and collaboration between teams (Option C).

Step 2: Why "All of the Above" is Correct

Process mapping serves multiple risk management purposes, making all listed options valid.

PRMIA Risk Reference Used:

PRMIA Operational Risk Management Guidelines – Recommends process mapping to identify

inefficiencies and control gaps.

PRMIA Risk Governance Framework – Encourages visualization tools for process improvement.

Final Conclusion:

Process mapping improves risk awareness, identifies control gaps, and enhances operational

workflows, making Option D the correct answer.

The National Australia Bank (NAB) FX Options Case Study is a well-known example of operational

risk, fraud, and governance failure.

What Happened?

Traders engaged in unauthorized foreign exchange (FX) options trading, using deep-in-the-money

options and other complex instruments.

They manipulated profits and losses to smooth earnings and mislead risk managers and auditors.

Why Answer C is Correct

The traders smoothed both profits and losses to avoid detection and ensure continued trading

bonuses.

This aligns with PRMIA’s Operational Risk Management Guidelines, which highlight that hidden

trading losses and smoothing techniques increase financial crime risk.

Why Other Answers Are Incorrect

Option

Explanation

A . Complex structured transactions aided in the

smoothing of losses.

Incorrect – Smoothing occurred with both profits and

losses, not just losses.

B . Deep-in-the-money options and other

complex structured transactions aided in the

smoothing of losses.

Incorrect – Profits were also manipulated, making this

answer incomplete.

Incorrect – This focuses only on deep-in-the-money

options and ignores other structured transactions

involved in the fraud.

D . Deep-in-the-money options aided in the

smoothing of losses.

PRMIA Reference for Verification

PRMIA Fraud and Risk Management Case Studies

Basel Principles on Market Risk and Internal Control Failures

Step 1: Understanding Linked Losses in Operational Risk

In operational risk events, a single event can impact multiple business lines or event types (e.g., IT

failure affecting retail banking and wealth management).

Proper loss attribution is important for accurate risk reporting and regulatory compliance under

Basel III.

Step 2: Why Option C is Correct

Basel III and PRMIA guidance allow institutions flexibility in how to allocate linked losses:

Entire loss can be allocated to the business line with the largest loss impact for simplified reporting.

Loss can be pro-rated across affected business lines for more accurate attribution.

Step 3: Why the Other Options Are Incorrect

Option A ("Allocate entire loss to the business line with the greatest loss") → Partially correct, but

not always required—some firms prefer pro-rating.

Option B ("Pro-rate the loss") → Partially correct, but allocating to the largest impacted business line

is also acceptable.

Option D ("Each business line decides how to treat losses") → Incorrect because loss allocation

should follow a defined policy, not business line discretion.

PRMIA Risk Reference Used:

Basel III Operational Risk Framework – Discusses loss attribution for multi-line impact events.

PRMIA Loss Event Management Guidelines – Supports both full allocation and pro-rating.

Final Conclusion:

Firms can either allocate the full loss to the most impacted business line or pro-rate it across affected

lines, making Option C the correct answer.

Step 1: Role of a Risk Function

A Risk Function ensures that an organization follows best practices in risk governance, assessment,

and control implementation.

It should be aligned with the board’s risk strategy and ensure independent oversight.

Step 2: Why Option B is Correct

The board sets the overall risk strategy, and the risk function implements risk controls accordingly.

PRMIA emphasizes board oversight as the guiding force behind risk management.

Step 3: Why the Other Options Are Incorrect

Option A ("Implement management’s direction") → Incorrect because risk oversight should be

board-driven, not solely management-driven.

Option C ("Ensure opinions are listened to") → Incorrect because risk functions enforce policies, not

just share opinions.

Option D ("Lower risk-taking to zero") → Incorrect because risk-taking is necessary for growth—

excessive risk aversion harms business.

PRMIA Risk Reference Used:

PRMIA Risk Governance Framework – Highlights board oversight in risk management.

Basel III Risk Management Standards – Emphasizes board-driven risk controls.

Final Conclusion:

The Risk Function must follow the board’s direction in implementing risk controls, making Option B

the correct answer.

PRMIA’s 10 Principles of Good Governance

PRMIA outlines 10 key principles that focus on risk governance, accountability, transparency, and risk

management effectiveness.

These principles ensure strong risk governance structures for financial institutions.

Why Answer B is Correct

Holding the PRM Designation (Professional Risk Manager certification) is NOT a governance

principle.

While PRMIA promotes risk education, governance principles focus on organizational risk structures,

not individual certifications.

Why Other Answers Are Incorrect

Option

Explanation

A . Risk appetite.

Correct – PRMIA governance principles include establishing a clear risk

appetite.

C . External validation.

Correct – External audits and validation improve governance and risk

transparency.

D . Clear accountability. Correct – Governance principles emphasize clear accountability at all levels of

management.

PRMIA Reference for Verification

PRMIA 10 Principles of Good Governance

Basel Corporate Governance Guidelines for Financial Institutions

Introduction of Operational Risk in Basel Accords

Basel I (1988) → Focused only on credit risk and market risk; operational risk was not yet included.

Basel II (2004) → Introduced operational risk as a separate category, subject to capital requirements.

Basel III (2010) → Strengthened capital and liquidity requirements but did not introduce operational

risk.

Basel IV (2017, still evolving) → Adjusts Basel III reforms but does not introduce operational risk as a

new category.

Why Answer B is Correct

Basel II (2004) was the first to introduce operational risk as a risk requiring a capital charge.

Why Other Answers Are Incorrect

Option

Explanation

A . Basel I Incorrect – Basel I focused on credit risk and market risk, with no capital requirements for

operational risk.

C . Basel IIIIncorrect – Basel III strengthened Basel II but did not introduce operational risk.

D . Basel

IV

Incorrect – Basel IV refines Basel III but does not introduce operational risk as a new capital

charge.

PRMIA Reference for Verification

Basel II (2004) Operational Risk Framework

PRMIA Operational Risk Management Guidelines

Definition of DORA

The Digital Operational Resilience Act (DORA) is a regulation by the European Union (EU) aimed at

strengthening the digital resilience of financial institutions.

It establishes a regulatory framework for managing information and communication technology (ICT)

risks in the financial sector.

Key Objectives of DORA

Ensures that financial institutions can withstand, respond to, and recover from cyber threats and ICT-

related disruptions.

Introduces standards for risk management, incident reporting, and third-party ICT risk oversight.

Why Other Answers Are Incorrect

Option

Explanation

A . Domain for Operational Risk

Act.

Incorrect – No such regulation exists under this name.

B . Digital Operational Risk Act.

Incorrect – The official name is Digital Operational Resilience Act

(DORA).

C . Daily Operational Resilience

Act.

Incorrect – DORA is not focused on daily operations but rather long-

term digital resilience.

PRMIA Reference for Verification

PRMIA Risk Governance & Digital Resilience Standards

European Commission’s Official DORA Regulation

Step 1: Definition of Risk Capacity

Risk Capacity refers to the maximum level of risk a bank can absorb while still maintaining orderly

operations or, in extreme cases, conducting an orderly resolution.

PRMIA and Basel III define risk capacity as a bank’s ability to absorb losses in a crisis without

systemic consequences.

Step 2: Why Option D Is Correct

The ultimate test of a bank’s risk capacity is whether it can survive an extreme shock without

harming depositors or financial markets.

Regulators ensure that a bank can be wound up in an orderly manner so that only shareholders lose

money, while depositors and creditors remain protected under resolution planning frameworks.

Step 3: Why the Other Options Are Incorrect

Option A ("Amount of risk the bank wishes to take")

Incorrect because this describes Risk Appetite, not Risk Capacity.

Option B ("Amount of risk the regulator sets for the bank")

Incorrect because regulators set capital requirements, but the bank's actual risk capacity is based on

its own capital structure and business model.

Option C ("Ability to withstand an extreme event and make a profit")

Incorrect because risk capacity is about survival, not profit-making during extreme events.

PRMIA Risk Reference Used:

Basel III Risk Capacity Standards – Defines the ability to absorb losses during crises.

PRMIA Risk Governance Framework – Describes how banks should manage risk capacity through

capital buffers.

Final Conclusion:

Banks must be able to withstand an extreme event and conduct an orderly wind-up if necessary,

ensuring that only shareholders bear the loss, making Option D the correct answer.