Step 1: Role of a Risk Function

A Risk Function ensures that an organization follows best practices in risk governance, assessment,

and control implementation.

It should be aligned with the board’s risk strategy and ensure independent oversight.

Step 2: Why Option B is Correct

The board sets the overall risk strategy, and the risk function implements risk controls accordingly.

PRMIA emphasizes board oversight as the guiding force behind risk management.

Step 3: Why the Other Options Are Incorrect

Option A ("Implement management’s direction") → Incorrect because risk oversight should be

board-driven, not solely management-driven.

Option C ("Ensure opinions are listened to") → Incorrect because risk functions enforce policies, not

just share opinions.

Option D ("Lower risk-taking to zero") → Incorrect because risk-taking is necessary for growth—

excessive risk aversion harms business.

PRMIA Risk Reference Used:

PRMIA Risk Governance Framework – Highlights board oversight in risk management.

Basel III Risk Management Standards – Emphasizes board-driven risk controls.

Final Conclusion:

The Risk Function must follow the board’s direction in implementing risk controls, making Option B

the correct answer.

PRMIA’s 10 Principles of Good Governance

PRMIA outlines 10 key principles that focus on risk governance, accountability, transparency, and risk

management effectiveness.

These principles ensure strong risk governance structures for financial institutions.

Why Answer B is Correct

Holding the PRM Designation (Professional Risk Manager certification) is NOT a governance

principle.

While PRMIA promotes risk education, governance principles focus on organizational risk structures,

not individual certifications.

Why Other Answers Are Incorrect

Option

Explanation

A . Risk appetite.

Correct – PRMIA governance principles include establishing a clear risk

appetite.

C . External validation.

Correct – External audits and validation improve governance and risk

transparency.

D . Clear accountability. Correct – Governance principles emphasize clear accountability at all levels of

management.

PRMIA Reference for Verification

PRMIA 10 Principles of Good Governance

Basel Corporate Governance Guidelines for Financial Institutions

Introduction of Operational Risk in Basel Accords

Basel I (1988) → Focused only on credit risk and market risk; operational risk was not yet included.

Basel II (2004) → Introduced operational risk as a separate category, subject to capital requirements.

Basel III (2010) → Strengthened capital and liquidity requirements but did not introduce operational

risk.

Basel IV (2017, still evolving) → Adjusts Basel III reforms but does not introduce operational risk as a

new category.

Why Answer B is Correct

Basel II (2004) was the first to introduce operational risk as a risk requiring a capital charge.

Why Other Answers Are Incorrect

Option

Explanation

A . Basel I Incorrect – Basel I focused on credit risk and market risk, with no capital requirements for

operational risk.

C . Basel IIIIncorrect – Basel III strengthened Basel II but did not introduce operational risk.

D . Basel

IV

Incorrect – Basel IV refines Basel III but does not introduce operational risk as a new capital

charge.

PRMIA Reference for Verification

Basel II (2004) Operational Risk Framework

PRMIA Operational Risk Management Guidelines

Definition of DORA

The Digital Operational Resilience Act (DORA) is a regulation by the European Union (EU) aimed at

strengthening the digital resilience of financial institutions.

It establishes a regulatory framework for managing information and communication technology (ICT)

risks in the financial sector.

Key Objectives of DORA

Ensures that financial institutions can withstand, respond to, and recover from cyber threats and ICT-

related disruptions.

Introduces standards for risk management, incident reporting, and third-party ICT risk oversight.

Why Other Answers Are Incorrect

Option

Explanation

A . Domain for Operational Risk

Act.

Incorrect – No such regulation exists under this name.

B . Digital Operational Risk Act.

Incorrect – The official name is Digital Operational Resilience Act

(DORA).

C . Daily Operational Resilience

Act.

Incorrect – DORA is not focused on daily operations but rather long-

term digital resilience.

PRMIA Reference for Verification

PRMIA Risk Governance & Digital Resilience Standards

European Commission’s Official DORA Regulation

Step 1: Definition of Risk Capacity

Risk Capacity refers to the maximum level of risk a bank can absorb while still maintaining orderly

operations or, in extreme cases, conducting an orderly resolution.

PRMIA and Basel III define risk capacity as a bank’s ability to absorb losses in a crisis without

systemic consequences.

Step 2: Why Option D Is Correct

The ultimate test of a bank’s risk capacity is whether it can survive an extreme shock without

harming depositors or financial markets.

Regulators ensure that a bank can be wound up in an orderly manner so that only shareholders lose

money, while depositors and creditors remain protected under resolution planning frameworks.

Step 3: Why the Other Options Are Incorrect

Option A ("Amount of risk the bank wishes to take")

Incorrect because this describes Risk Appetite, not Risk Capacity.

Option B ("Amount of risk the regulator sets for the bank")

Incorrect because regulators set capital requirements, but the bank's actual risk capacity is based on

its own capital structure and business model.

Option C ("Ability to withstand an extreme event and make a profit")

Incorrect because risk capacity is about survival, not profit-making during extreme events.

PRMIA Risk Reference Used:

Basel III Risk Capacity Standards – Defines the ability to absorb losses during crises.

PRMIA Risk Governance Framework – Describes how banks should manage risk capacity through

capital buffers.

Final Conclusion:

Banks must be able to withstand an extreme event and conduct an orderly wind-up if necessary,

ensuring that only shareholders bear the loss, making Option D the correct answer.