Step 1: What Is the Turnbull Report?

The Turnbull Report (1999) was a UK corporate governance report that set risk management

expectations for boards.

It required companies to assess and manage risks effectively as part of corporate governance.

Step 2: Why Option C is Correct

Turnbull was the first report to mandate that boards must consider risk management in corporate

governance.

This report established risk assessment as a board-level responsibility.

Step 3: Why the Other Options Are Incorrect

Option A ("Defined risk governance for insurance") → Incorrect because Turnbull applied to all

sectors, not just insurance.

Option B ("First report to propose board structure") → Incorrect because corporate boards existed

long before Turnbull.

Option D ("Led to the US Federal Reserve") → Incorrect because the Federal Reserve was established

in 1913, long before Turnbull.

PRMIA Risk Reference Used:

PRMIA Corporate Governance Guidelines – Highlights Turnbull's role in board-level risk oversight.

UK Corporate Governance Code – Turnbull contributed to defining board risk responsibilities.

Final Conclusion:

The Turnbull Report was the first to require boards to consider risks in corporate governance, making

Option C the correct answer.

Thank you for your visit.

Step 1: Role of a Risk Assessment Facilitator

The facilitator’s main role is to guide discussions without bias, ensuring objective risk identification.

PRMIA’s Risk Governance Framework highlights neutral facilitation as key to effective risk

workshops.

Step 2: Why Option C Is Correct

Objectivity ensures unbiased risk assessment.

Expressing personal opinions can influence risk ratings, leading to distorted outcomes.

Step 3: Why the Other Options Are Incorrect

Option A ("Guide the workshop toward a pre-determined conclusion")

Incorrect because risk workshops should discover risks, not confirm pre-set beliefs.

Option B ("Attendees can override results")

Incorrect as risk results should be evidence-based, not subject to override.

Option D ("Attend via video connection")

Incorrect as facilitators must engage actively, making remote facilitation less effective.

PRMIA Risk Reference Used:

PRMIA Risk Governance Framework – Stresses objectivity in risk assessment facilitation.

PRMIA Risk Identification Best Practices – Encourages unbiased workshops.

Final Conclusion:

Facilitators must remain neutral and objective, making Option C the correct answer.

Impact Tolerance is a key concept in Operational Resilience, defined as the ability of a firm to

withstand, respond to, and recover from disruptions. According to PRMIA and global regulatory

frameworks (such as the Bank of England's Operational Resilience Framework), impact tolerance is

specifically tied to business services rather than processes.

Step 1: Defining Impact Tolerance

Impact tolerance is the maximum acceptable level of disruption to an important business service,

beyond which there would be intolerable harm to customers, financial markets, or regulatory

obligations.

It is not the same as risk appetite or risk capacity, as those deal with broader organizational risk

exposure.

Step 2: Why Business Services Matter

PRMIA defines business services as end-to-end services delivered to clients and stakeholders, such as

payments processing, trade execution, or loan approvals.

Disruptions to these services directly impact customers and financial stability, making business

service resilience the core focus of impact tolerance.

Step 3: Why the Other Options Are Incorrect

Option A ("tolerance for disruption to a particular business process")

Incorrect because impact tolerance applies to services, not just internal processes.

Option C ("a firm's risk appetite statement")

Incorrect because risk appetite focuses on how much risk a firm is willing to take, while impact

tolerance is about surviving disruptions.

Option D ("a firm's risk capacity statement")

Incorrect because risk capacity is the maximum level of risk a firm can bear, which is broader than

business service disruptions.

PRMIA Risk Reference Used:

PRMIA Operational Resilience Guidelines – Defines impact tolerance as a service-based metric.

Bank of England’s Operational Resilience Framework – Establishes impact tolerance as a limit on

business service disruption.

Final Conclusion:

Impact tolerance focuses on business services, not just internal processes or risk appetite, making

Option B the correct answer.

tep 1: Purpose of Internal Loss Investigations

Internal loss investigations analyze past loss events to identify root causes, improve controls, and

enhance risk assessments.

Step 2: Why Option A Is Correct

Root Cause Analysis: Identifying why the loss occurred.

Focus on Remediation: Implementing corrective measures to prevent recurrence.

Scenario Analysis Improvement: Using lessons learned to enhance risk scenario modeling.

Step 3: Why the Other Options Are Incorrect

Option B ("Focus on who caused the issue") → Incorrect because loss investigations are about

systemic issues, not assigning blame.

Option C ("Ascertain responsibility for the loss event") → Incorrect because the focus is on process

improvements, not individual accountability.

Option D ("Determined by HR on a case-by-case basis") → Incorrect because HR does not dictate risk

investigations—risk and compliance functions do.

PRMIA Risk Reference Used:

PRMIA Operational Risk Framework – Emphasizes loss investigations for systemic risk management.

Basel III Risk Governance Standards – Defines loss event analysis as a key risk management tool.

Risk-sensitive pricing ensures that financial institutions and businesses properly account for risk in

their pricing strategies to maintain stability and sustainability. PRMIA’s Risk Pricing and Capital

Adequacy Guidelines define the importance of risk-sensitive pricing in ensuring fair compensation

for risk exposure and avoiding risk concentration issues.

Step 1: Why Risk-Sensitive Pricing Is Important

Aligns risk with return: Pricing should be designed to reflect the underlying risk and return trade-off.

Protects investors: Investors expect compensation for capital at risk (Option A is correct).

Reinforces risk-aware culture: PRMIA promotes linking incentives to risk-adjusted returns (Option B

is correct).

Prevents adverse selection: Proper risk pricing prevents low-quality assets from accumulating

(Option C is correct).

Step 2: Why Option D Is Incorrect

Income targets are business-driven, not risk-driven.

Risk-sensitive pricing aims to balance risk and reward, not just maximize revenue.

PRMIA discourages profit-seeking behavior at the expense of risk considerations.

PRMIA Risk Reference Used:

PRMIA Risk Pricing Guidelines – Defines the principles of risk-sensitive pricing.

PRMIA Risk-Adjusted Return Standards – Stresses linking incentives to risk-aware decisions.

PRMIA Capital Adequacy Framework – Highlights the role of risk-sensitive pricing in portfolio

management.

Final Conclusion:

Risk-sensitive pricing is designed to align returns with risk exposure, not simply to meet or exceed

income targets, making Option D the correct answer.

Role of the Risk Function

The risk function is responsible for documenting, monitoring, and overseeing risk policies and

frameworks.

It ensures the organization maintains structured risk governance, reporting, and compliance.

Key Responsibilities

Developing Risk Management Manuals to define risk appetite, risk frameworks, and risk governance

structures.

Creating Risk Policies that align with regulatory standards and internal controls.

Why Answer B is Correct

The risk function primarily develops, implements, and maintains risk management frameworks,

which include formal manuals and policies.

Why Other Answers Are Incorrect

Option

Explanation

A . Documenting its activities, typically by

operating and then recording the daily operation

of controls.

Incorrect – The first line of defense (business units)

handles daily operational controls, not the risk

function.

C . Putting in place the servers, firewalls, and

software to ensure cybersecurity.

Incorrect – Cybersecurity is an IT responsibility, while

the risk function oversees cyber risk frameworks.

D . Creating a trial balance, balance sheet

statement, and cash flow statement.

Incorrect – These are financial accounting

responsibilities, not risk management duties.

PRMIA Reference for Verification

PRMIA Governance Framework for Risk Management

Basel Risk Management Principles

Process Mapping is a risk management tool used to visualize workflows, identify inefficiencies, and

detect control gaps. PRMIA defines process mapping as an essential operational risk management

tool.

Step 1: Understanding Process Mapping

Helps analyze complex, process-intensive activities (Option A).

Reveals control weaknesses that could lead to operational risks (Option B).

Improves hand-offs and collaboration between teams (Option C).

Step 2: Why "All of the Above" is Correct

Process mapping serves multiple risk management purposes, making all listed options valid.

PRMIA Risk Reference Used:

PRMIA Operational Risk Management Guidelines – Recommends process mapping to identify

inefficiencies and control gaps.

PRMIA Risk Governance Framework – Encourages visualization tools for process improvement.

Final Conclusion:

Process mapping improves risk awareness, identifies control gaps, and enhances operational

workflows, making Option D the correct answer.

The National Australia Bank (NAB) FX Options Case Study is a well-known example of operational

risk, fraud, and governance failure.

What Happened?

Traders engaged in unauthorized foreign exchange (FX) options trading, using deep-in-the-money

options and other complex instruments.

They manipulated profits and losses to smooth earnings and mislead risk managers and auditors.

Why Answer C is Correct

The traders smoothed both profits and losses to avoid detection and ensure continued trading

bonuses.

This aligns with PRMIA’s Operational Risk Management Guidelines, which highlight that hidden

trading losses and smoothing techniques increase financial crime risk.

Why Other Answers Are Incorrect

Option

Explanation

A . Complex structured transactions aided in the

smoothing of losses.

Incorrect – Smoothing occurred with both profits and

losses, not just losses.

B . Deep-in-the-money options and other

complex structured transactions aided in the

smoothing of losses.

Incorrect – Profits were also manipulated, making this

answer incomplete.

Incorrect – This focuses only on deep-in-the-money

options and ignores other structured transactions

involved in the fraud.

D . Deep-in-the-money options aided in the

smoothing of losses.

PRMIA Reference for Verification

PRMIA Fraud and Risk Management Case Studies

Basel Principles on Market Risk and Internal Control Failures

Step 1: Understanding Linked Losses in Operational Risk

In operational risk events, a single event can impact multiple business lines or event types (e.g., IT

failure affecting retail banking and wealth management).

Proper loss attribution is important for accurate risk reporting and regulatory compliance under

Basel III.

Step 2: Why Option C is Correct

Basel III and PRMIA guidance allow institutions flexibility in how to allocate linked losses:

Entire loss can be allocated to the business line with the largest loss impact for simplified reporting.

Loss can be pro-rated across affected business lines for more accurate attribution.

Step 3: Why the Other Options Are Incorrect

Option A ("Allocate entire loss to the business line with the greatest loss") → Partially correct, but

not always required—some firms prefer pro-rating.

Option B ("Pro-rate the loss") → Partially correct, but allocating to the largest impacted business line

is also acceptable.

Option D ("Each business line decides how to treat losses") → Incorrect because loss allocation

should follow a defined policy, not business line discretion.

PRMIA Risk Reference Used:

Basel III Operational Risk Framework – Discusses loss attribution for multi-line impact events.

PRMIA Loss Event Management Guidelines – Supports both full allocation and pro-rating.

Final Conclusion:

Firms can either allocate the full loss to the most impacted business line or pro-rate it across affected

lines, making Option C the correct answer.