8020 Practice Questions

A Chief Risk Officer (CRO) plays a crucial role in shaping and strengthening the risk culture within an

organization. PRMIA defines risk culture as the shared values, beliefs, knowledge, and understanding

about risk that drive behaviors within an institution.

Setting a Clear Vision

The CRO should communicate a vision of risk management that aligns with organizational goals

while ensuring that risk-taking remains within acceptable limits.

The vision should be achievable and realistic, rather than overly ambitious, which could incentivize

reckless risk-taking.

Embedding Risk Awareness into Decision-Making

A strong risk culture ensures that risk considerations are embedded into business decision-making

rather than treated as a separate compliance exercise.

This is supported by PRMIA’s Enterprise Risk Management (ERM) Framework, which stresses

integrating risk management into strategy and operations.

Avoiding a Blame Culture

A risk-aware organization promotes accountability without fear, enabling employees to report risks

without retribution.

Option B (Discourage personal accountability to avoid a blame culture) is incorrect because personal

accountability is essential for a healthy risk culture.

Avoiding a Strict, Prescriptive Approach

A set of rigid objectives that must be followed by the executive team (Option C) does not foster a

dynamic, evolving risk culture.

Instead, risk culture should be flexible and adaptive to emerging risks.

Balancing Incentives and Consequences

While balancing rewards with penalties (Option D) is part of governance, a strong risk culture is not

built solely through fear of punishment.

PRMIA emphasizes positive reinforcement, such as linking risk management behaviors to

performance evaluations and incentives.

PRMIA Reference for Verification

PRMIA Risk Governance Framework – Discusses the role of leadership in shaping risk culture.

PRMIA Standards on Enterprise Risk Management (ERM) – Covers best practices for embedding risk

culture within organizations.

The Principles for Risk Governance, as established by PRMIA (Professional Risk Managers'

International Association), emphasize the Three Lines of Defense (3LoD) Model, which is widely used

in risk management and governance frameworks.

Business Line Ownership of Risk (First Line of Defense)

The business units are responsible for identifying, assessing, managing, and monitoring risks within

their operations.

Since they generate the risks through their activities, they must own the risk assessment process.

This aligns with PRMIA Governance Principles, which state that risk management should be

embedded within business operations to ensure proactive risk identification and control.

Risk Management’s Role (Second Line of Defense)

The risk management function is not directly responsible for conducting risk assessments but plays a

key role in designing and maintaining the risk assessment framework.

This includes setting standards, methodologies, and tools for assessing risks across business

functions.

Risk management provides supervision and oversight, ensuring that risk assessments align with

organizational policies and regulatory expectations.

Oversight from Senior Management & the Board (Third Line of Defense)

Internal audit (third line of defense) independently reviews and provides assurance that the risk

management framework is effective and that risk assessments are conducted properly.

PRMIA’s Risk Governance Standards emphasize that internal audit should evaluate the effectiveness

of the risk assessment framework without being involved in its direct execution.

Why Other Answers Are Incorrect

Option

Explanation

A . Risk management, in its role as second line of

defense, performs the risk assessment process from

beginning to end. There is no business line

involvement.

Incorrect – Risk management facilitates and

oversees the risk assessment process, but the

business must take ownership of the risks it

generates.

Incorrect – While the business owns the process,

risk management plays a crucial role in developing

the framework, setting policies, and providing

oversight.

C . Business owns the risk assessment process so

risk management does not play a role in the

process.

Incorrect – Business management is actively

responsible for executing risk assessments, not just

overseeing them.

D . Business management's role in the risk

assessment process should be confined to oversight.

PRMIA Reference for Verification

PRMIA Standards for Risk Governance – Establishes the Three Lines of Defense and the separation of

responsibilities.

PRMIA Risk Management Framework (RMF) Guidelines – Defines the roles of business and risk

management in risk assessment.

PRMIA Enterprise Risk Management Best Practices – Outlines how risk management facilitates risk

assessments while the business retains ownership.

This answer is verified according to PRMIA’s official risk governance documents and best practices.

Would you like additional clarification or supporting documentation

?

Step 1: Understanding the Northern Rock Case Study

Northern Rock was a UK bank that collapsed in 2007 due to its heavy reliance on short-term

wholesale funding rather than customer deposits.

When the 2007 financial crisis hit, the inter-bank lending market and commercial paper market froze,

cutting off Northern Rock’s access to liquidity.

Step 2: Why Option C Is Correct

Northern Rock depended on short-term borrowing to fund long-term mortgage lending.

When the liquidity crisis hit, it couldn’t refinance its debt, leading to a bank run and collapse.

The Bank of England had to intervene, and the UK government nationalized Northern Rock in 2008.

Step 3: Why the Other Options Are Incorrect

Option A ("Acquisition of Merrill Lynch") → Incorrect because this happened in 2008, after Northern

Rock’s failure.

Option B ("Withdrawal of Deposit Protection") → Incorrect because UK deposit protection remained

in place.

Option D ("Real estate exposure in Berlin") → Incorrect because Northern Rock's problem was

funding liquidity, not real estate losses.

PRMIA Risk Reference Used:

PRMIA Liquidity Risk Management Framework – Describes how liquidity shocks impact banks like

Northern Rock.

Basel III Liquidity Coverage Ratio (LCR) Standards – Created after Northern Rock to prevent similar

liquidity crises.

Final Conclusion:

The collapse of the inter-bank and commercial paper markets was the key low-probability-high-

impact event that led to Northern Rock’s failure, making Option C the correct answer.

The FTX collapse involved fraudulent fund mismanagement, where FTX executives created a

"backdoor" to allow Alameda Research (FTX’s sister trading firm) to borrow client funds without their

consent.

Step 1: The "Backdoor" in FTX

The backdoor was a hidden code in FTX’s system, allegedly created by Sam Bankman-Fried, which

allowed Alameda to access customer deposits without triggering alerts to auditors or compliance

teams.

Alameda used these funds for risky trading strategies and investments, leading to the eventual

collapse of FTX when a liquidity crunch exposed the missing funds.

Step 2: Why the Other Options Are Incorrect

Option A ("allowed a stablecoin to be removed from the ledger and added to the balance sheet")

Incorrect because FTX’s fraud involved misuse of customer funds, not just a stablecoin

misclassification.

Option C ("allowed currency traders to smooth profits and conceal losses for over two years")

Incorrect because this sounds more like LIBOR-rigging scandals, whereas FTX misappropriated client

funds.

Option D ("allowed a rapid pace of acquisitions but poor integration of acquired companies")

Incorrect because FTX's collapse was due to financial fraud, not poor acquisition strategy.

PRMIA Risk Reference Used:

PRMIA Financial Crime Risk Management – Discusses insider risk and fraudulent misappropriation of

funds.

FTX Collapse Reports – SEC, CFTC, and DOJ filings confirm that Alameda had unauthorized access to

client funds.

Final Conclusion:

FTX’s backdoor enabled Alameda to take $65 billion in client funds without permission, making

Option B the correct answer.

Step 1: Key Elements of a Well-Designed Policy Document

A well-designed policy should include:

Scope – Who the policy applies to.

Exception Handling – How and where exceptions should be requested.

Accountability – Who is responsible for enforcement.

Step 2: Why Option C is Correct

A policy must clearly define exceptions and the process for requesting them.

It should also define areas where the policy does not apply to avoid confusion.

Step 3: Why the Other Options Are Incorrect

Option A ("List of exceptions for board members' families") → Incorrect because policies should

apply consistently to all stakeholders.

Option B ("List of acceptable fonts and margin types") → Incorrect because formatting is secondary

to content clarity.

Option D ("To whom the policy applies and an additional management report") → Incorrect because

policy scope should not include unnecessary reports.

PRMIA Risk Reference Used:

PRMIA Policy Writing Guidelines – Defines policy structure and exception handling.

ISO 19600 Compliance Management Standard – Supports clear, well-documented policies.

Final Conclusion:

A well-designed policy clearly defines exceptions and their handling process, making Option C the

correct answer.

Definition of Bottom-Up KRIs

Bottom-Up Key Risk Indicators (KRIs) are identified at the operational level, focusing on localized

risks within business units.

They are tied to actual internal loss events and reported frequently (daily, weekly, or monthly) to

capture ongoing trends.

Key Properties of Bottom-Up KRIs

Selected by local management → Ensures relevance to specific business areas.

Tied to internal loss events → Helps in tracking risk patterns within specific legal entities, countries,

or business units.

Reported frequently → Allows for timely risk detection and mitigation.

Why Answer D is Correct

Bottom-up KRIs focus on localized risk exposure and are monitored frequently to track operational

changes.

Why Other Answers Are Incorrect

Option

Explanation

A . Seated by senior management: tied to internal

loss events at the legal entity, country, business,

and/or product level, reported daily, weekly, or

monthly.

Incorrect – Senior management sets top-down

KRIs, while bottom-up KRIs are managed locally.

Incorrect – While audit reports are useful,

bottom-up KRIs are based on loss events, not just

audit findings. Quarterly reporting is too

infrequent.

B . Selected by local management, based on key

controls or weaknesses identified by audit reports,

reported quarterly.

C . Are not used due to changes in regulations.

Incorrect – Bottom-up KRIs remain essential

despite regulatory changes.

PRMIA Reference for Verification

PRMIA Risk Indicator Best Practices

Basel Committee’s Risk Measurement and Reporting Guidelines

Near Misses in Operational Risk

A near miss is an event that could have led to a loss but was avoided or mitigated before actual

financial impact occurred.

PRMIA emphasizes that near misses should be reported, recorded, and analyzed because they

provide valuable insights into potential vulnerabilities in risk controls.

However, since they did not result in actual financial losses, they are not included in the calculation

of Operational Risk Capital.

Opportunity Costs in Operational Risk

Opportunity costs refer to the loss of potential gains due to missed strategic opportunities.

These are not directly quantifiable as operational risk losses and are not included in Operational Risk

Capital calculations.

PRMIA’s Operational Risk Framework states that operational risk is about actual losses rather than

theoretical costs.

Why Other Answers Are Incorrect

Option

Explanation

A . Ignored.

Incorrect – Near misses and opportunity costs provide valuable

insights into operational risk, so they should never be ignored.

Incorrect – While they should be recorded and analyzed, they

are not included in Operational Risk Capital calculations

because they do not result in actual losses.

B . Recorded and Analyzed. Used in

calculation of Operational Risk Capital.

D . Reported, Recorded, and Analyzed,

Used in calculation of Operational Risk

Capital.

Incorrect – Reporting, recording, and analysis are correct, but

they should not be included in capital calculations.

PRMIA Reference for Verification

PRMIA Operational Risk Management Standards – Defines near misses and opportunity costs.

Basel II & III Operational Risk Framework – Outlines the principles of operational risk capital

calculations.

Step 1: Compliance Function and the Three Lines of Defense Model

The Three Lines of Defense (3LoD) model ensures that risk management responsibilities are properly

segregated:

First Line: Business units (own and manage risk).

Second Line: Compliance and risk management (independent oversight).

Third Line: Internal audit (provides assurance).

Step 2: Why Compliance Must Be Independent

PRMIA and Basel Compliance Principles state that compliance should not report to business units, as

this creates a conflict of interest.

Compliance must be independent to ensure objective oversight of regulatory adherence.

Step 3: Why the Other Options Are Incorrect

Option A ("Report to the business") → Incorrect because compliance must provide independent

oversight, not report to business units.

Option C ("Outsource compliance if risk function exists") → Incorrect because compliance and risk

functions have distinct roles.

Option D ("Outsource risk if compliance exists") → Incorrect because risk management is a core

function, not an outsourcing candidate.

PRMIA Risk Reference Used:

PRMIA Compliance Risk Governance – States compliance must be independent under the Three

Lines of Defense model.

Basel Compliance Principles – Recommends separate reporting structures for compliance and

business units.

Final Conclusion:

Compliance must be independent from the business to avoid conflicts of interest, making Option B

the correct answer.

Step 1: Definition of a Critical Business Service in Operational Resilience

A Critical Business Service is one whose failure could result in severe harm to customers, financial

markets, or the firm’s viability.

Regulators (e.g., Bank of England, Basel Committee, PRMIA) define three primary factors for

identifying critical services:

Customer impact

Market integrity impact

Firm viability impact

Step 2: Why Option C Is Incorrect

Risk appetite is an internal business decision, not an external measure of criticality.

A service can be critical even if its disruption stays within risk appetite.

Criticality is based on external impacts, not just internal risk limits.

Step 3: Why the Other Options Are Correct

Option A ("Material customer detriment") → Correct as customer harm defines critical services.

Option B ("Harm to market integrity") → Correct as market stability is a regulatory priority.

Option D ("Threaten firm viability") → Correct as critical services often determine business survival.

PRMIA Risk Reference Used:

PRMIA Operational Resilience Framework – Defines criteria for critical business services.

Basel Committee Operational Risk Guidelines – Highlights customer, market, and firm viability as

resilience factors.

Final Conclusion:

Risk appetite is an internal benchmark, not a measure of critical service designation, making Option

C the correct answer.

Definition of Confidence Accounting

Confidence Accounting challenges traditional accounting by introducing probability distributions and

ranges rather than fixed numbers for financial reporting.

This approach improves transparency and risk awareness by acknowledging uncertainty in financial

figures.

Why Answer B is Correct

Encourages using ranges (confidence intervals) instead of discrete values to better reflect

uncertainty.

Used in risk-sensitive industries where financial estimates vary due to external factors (e.g., credit

risk, market fluctuations).

Why Other Answers Are Incorrect

Option

Explanation

A . An approach that encourages companies and

audit firms to have diverse boards.

Incorrect – Board diversity is unrelated to Confidence

Accounting.

C . An approach that encourages companies and

audit firms to use regular statements in their AI

software.

Incorrect – AI may use probability models, but

Confidence Accounting is an accounting methodology,

not an AI approach.

Incorrect – Confidence Accounting still relies on

mathematical models; it does not eliminate numerical

analysis.

D . An approach that encourages companies and

audit firms to stop using figures and maths.

PRMIA Reference for Verification

PRMIA Financial Risk Reporting Standards

IFRS (International Financial Reporting Standards) Guidelines on Probability-Based Accounting