Question 1

How can a chief risk officer encourage the governing body and executive management team to create a stronger risk culture?

Accepted Answer

A

Explanation: A Chief Risk Officer (CRO) plays a crucial role in shaping and strengthening the risk culture within an organization. PRMIA defines risk culture as the shared values, beliefs, knowledge, and understanding about risk that drive behaviors within an institution. Setting a Clear Vision The CRO should communicate a vision of risk management that aligns with organizational goals while ensuring that risk-taking remains within acceptable limits. The vision should be achievable and realistic, rather than overly ambitious, which could incentivize reckless risk-taking. Embedding Risk Awareness into Decision-Making A strong risk culture ensures that risk considerations are embedded into business decision-making rather than treated as a separate compliance exercise. This is supported by PRMIA’s Enterprise Risk Management (ERM) Framework, which stresses integrating risk management into strategy and operations. Avoiding a Blame Culture A risk-aware organization promotes accountability without fear, enabling employees to report risks without retribution. Option B (Discourage personal accountability to avoid a blame culture) is incorrect because personal accountability is essential for a healthy risk culture. Avoiding a Strict, Prescriptive Approach A set of rigid objectives that must be followed by the executive team (Option C) does not foster a dynamic, evolving risk culture. Instead, risk culture should be flexible and adaptive to emerging risks. Balancing Incentives and Consequences While balancing rewards with penalties (Option D) is part of governance, a strong risk culture is not built solely through fear of punishment. PRMIA emphasizes positive reinforcement, such as linking risk management behaviors to performance evaluations and incentives. PRMIA Reference for Verification PRMIA Risk Governance Framework – Discusses the role of leadership in shaping risk culture. PRMIA Standards on Enterprise Risk Management (ERM) – Covers best practices for embedding risk culture within organizations.

Question 2

What are the roles of business versus risk management in developing and implementing risk assessments?

Accepted Answer

B

Explanation: The Principles for Risk Governance, as established by PRMIA (Professional Risk Managers' International Association), emphasize the Three Lines of Defense (3LoD) Model, which is widely used in risk management and governance frameworks. Business Line Ownership of Risk (First Line of Defense) The business units are responsible for identifying, assessing, managing, and monitoring risks within their operations. Since they generate the risks through their activities, they must own the risk assessment process. This aligns with PRMIA Governance Principles, which state that risk management should be embedded within business operations to ensure proactive risk identification and control. Risk Management’s Role (Second Line of Defense) The risk management function is not directly responsible for conducting risk assessments but plays a key role in designing and maintaining the risk assessment framework. This includes setting standards, methodologies, and tools for assessing risks across business functions. Risk management provides supervision and oversight, ensuring that risk assessments align with organizational policies and regulatory expectations. Oversight from Senior Management & the Board (Third Line of Defense) Internal audit (third line of defense) independently reviews and provides assurance that the risk management framework is effective and that risk assessments are conducted properly. PRMIA’s Risk Governance Standards emphasize that internal audit should evaluate the effectiveness of the risk assessment framework without being involved in its direct execution. Why Other Answers Are Incorrect Option Explanation A . Risk management, in its role as second line of defense, performs the risk assessment process from beginning to end. There is no business line involvement. Incorrect – Risk management facilitates and oversees the risk assessment process, but the business must take ownership of the risks it generates. Incorrect – While the business owns the process, risk management plays a crucial role in developing the framework, setting policies, and providing oversight. C . Business owns the risk assessment process so risk management does not play a role in the process. Incorrect – Business management is actively responsible for executing risk assessments, not just overseeing them. D . Business management's role in the risk assessment process should be confined to oversight. PRMIA Reference for Verification PRMIA Standards for Risk Governance – Establishes the Three Lines of Defense and the separation of responsibilities. PRMIA Risk Management Framework (RMF) Guidelines – Defines the roles of business and risk management in risk assessment. PRMIA Enterprise Risk Management Best Practices – Outlines how risk management facilitates risk assessments while the business retains ownership. This answer is verified according to PRMIA’s official risk governance documents and best practices. Would you like additional clarification or supporting documentation

Question 3

For the Northern Rock case study, what was the low-probability-high-impact event that was most responsible for the loss event?

Accepted Answer

C

Explanation: Step 1: Understanding the Northern Rock Case Study Northern Rock was a UK bank that collapsed in 2007 due to its heavy reliance on short-term wholesale funding rather than customer deposits. When the 2007 financial crisis hit, the inter-bank lending market and commercial paper market froze, cutting off Northern Rock’s access to liquidity. Step 2: Why Option C Is Correct Northern Rock depended on short-term borrowing to fund long-term mortgage lending. When the liquidity crisis hit, it couldn’t refinance its debt, leading to a bank run and collapse. The Bank of England had to intervene, and the UK government nationalized Northern Rock in 2008. Step 3: Why the Other Options Are Incorrect Option A ("Acquisition of Merrill Lynch") → Incorrect because this happened in 2008, after Northern Rock’s failure. Option B ("Withdrawal of Deposit Protection") → Incorrect because UK deposit protection remained in place. Option D ("Real estate exposure in Berlin") → Incorrect because Northern Rock's problem was funding liquidity, not real estate losses. PRMIA Risk Reference Used: PRMIA Liquidity Risk Management Framework – Describes how liquidity shocks impact banks like Northern Rock. Basel III Liquidity Coverage Ratio (LCR) Standards – Created after Northern Rock to prevent similar liquidity crises. Final Conclusion: The collapse of the inter-bank and commercial paper markets was the key low-probability-high- impact event that led to Northern Rock’s failure, making Option C the correct answer.

Question 4

For the FTX case study, what was the "backdoor" used for?

Accepted Answer

B

Explanation: The FTX collapse involved fraudulent fund mismanagement, where FTX executives created a "backdoor" to allow Alameda Research (FTX’s sister trading firm) to borrow client funds without their consent. Step 1: The "Backdoor" in FTX The backdoor was a hidden code in FTX’s system, allegedly created by Sam Bankman-Fried, which allowed Alameda to access customer deposits without triggering alerts to auditors or compliance teams. Alameda used these funds for risky trading strategies and investments, leading to the eventual collapse of FTX when a liquidity crunch exposed the missing funds. Step 2: Why the Other Options Are Incorrect Option A ("allowed a stablecoin to be removed from the ledger and added to the balance sheet") Incorrect because FTX’s fraud involved misuse of customer funds, not just a stablecoin misclassification. Option C ("allowed currency traders to smooth profits and conceal losses for over two years") Incorrect because this sounds more like LIBOR-rigging scandals, whereas FTX misappropriated client funds. Option D ("allowed a rapid pace of acquisitions but poor integration of acquired companies") Incorrect because FTX's collapse was due to financial fraud, not poor acquisition strategy. PRMIA Risk Reference Used: PRMIA Financial Crime Risk Management – Discusses insider risk and fraudulent misappropriation of funds. FTX Collapse Reports – SEC, CFTC, and DOJ filings confirm that Alameda had unauthorized access to client funds. Final Conclusion: FTX’s backdoor enabled Alameda to take $65 billion in client funds without permission, making Option B the correct answer.

Question 5

In relation to the template for writing policy documents, which one of the following pairings of requirements is correct? A well designed policy will include:

Accepted Answer

C

Explanation: Step 1: Key Elements of a Well-Designed Policy Document A well-designed policy should include: Scope – Who the policy applies to. Exception Handling – How and where exceptions should be requested. Accountability – Who is responsible for enforcement. Step 2: Why Option C is Correct A policy must clearly define exceptions and the process for requesting them. It should also define areas where the policy does not apply to avoid confusion. Step 3: Why the Other Options Are Incorrect Option A ("List of exceptions for board members' families") → Incorrect because policies should apply consistently to all stakeholders. Option B ("List of acceptable fonts and margin types") → Incorrect because formatting is secondary to content clarity. Option D ("To whom the policy applies and an additional management report") → Incorrect because policy scope should not include unnecessary reports. PRMIA Risk Reference Used: PRMIA Policy Writing Guidelines – Defines policy structure and exception handling. ISO 19600 Compliance Management Standard – Supports clear, well-documented policies. Final Conclusion: A well-designed policy clearly defines exceptions and their handling process, making Option C the correct answer.

Question 6

What are some of the properties of Bottom-Up KRIs?

Accepted Answer

D

Explanation: Definition of Bottom-Up KRIs Bottom-Up Key Risk Indicators (KRIs) are identified at the operational level, focusing on localized risks within business units. They are tied to actual internal loss events and reported frequently (daily, weekly, or monthly) to capture ongoing trends. Key Properties of Bottom-Up KRIs Selected by local management → Ensures relevance to specific business areas. Tied to internal loss events → Helps in tracking risk patterns within specific legal entities, countries, or business units. Reported frequently → Allows for timely risk detection and mitigation. Why Answer D is Correct Bottom-up KRIs focus on localized risk exposure and are monitored frequently to track operational changes. Why Other Answers Are Incorrect Option Explanation A . Seated by senior management: tied to internal loss events at the legal entity, country, business, and/or product level, reported daily, weekly, or monthly. Incorrect – Senior management sets top-down KRIs, while bottom-up KRIs are managed locally. Incorrect – While audit reports are useful, bottom-up KRIs are based on loss events, not just audit findings. Quarterly reporting is too infrequent. B . Selected by local management, based on key controls or weaknesses identified by audit reports, reported quarterly. C . Are not used due to changes in regulations. Incorrect – Bottom-up KRIs remain essential despite regulatory changes. PRMIA Reference for Verification PRMIA Risk Indicator Best Practices Basel Committee’s Risk Measurement and Reporting Guidelines

Question 7

How should Near Misses and Opportunity Costs be treated within Operational Risk?

Accepted Answer

C

Explanation: Near Misses in Operational Risk A near miss is an event that could have led to a loss but was avoided or mitigated before actual financial impact occurred. PRMIA emphasizes that near misses should be reported, recorded, and analyzed because they provide valuable insights into potential vulnerabilities in risk controls. However, since they did not result in actual financial losses, they are not included in the calculation of Operational Risk Capital. Opportunity Costs in Operational Risk Opportunity costs refer to the loss of potential gains due to missed strategic opportunities. These are not directly quantifiable as operational risk losses and are not included in Operational Risk Capital calculations. PRMIA’s Operational Risk Framework states that operational risk is about actual losses rather than theoretical costs. Why Other Answers Are Incorrect Option Explanation A . Ignored. Incorrect – Near misses and opportunity costs provide valuable insights into operational risk, so they should never be ignored. Incorrect – While they should be recorded and analyzed, they are not included in Operational Risk Capital calculations because they do not result in actual losses. B . Recorded and Analyzed. Used in calculation of Operational Risk Capital. D . Reported, Recorded, and Analyzed, Used in calculation of Operational Risk Capital. Incorrect – Reporting, recording, and analysis are correct, but they should not be included in capital calculations. PRMIA Reference for Verification PRMIA Operational Risk Management Standards – Defines near misses and opportunity costs. Basel II & III Operational Risk Framework – Outlines the principles of operational risk capital calculations.

Question 8

Which of the following principles best applies to a compliance function?

Accepted Answer

B

Explanation: Step 1: Compliance Function and the Three Lines of Defense Model The Three Lines of Defense (3LoD) model ensures that risk management responsibilities are properly segregated: First Line: Business units (own and manage risk). Second Line: Compliance and risk management (independent oversight). Third Line: Internal audit (provides assurance). Step 2: Why Compliance Must Be Independent PRMIA and Basel Compliance Principles state that compliance should not report to business units, as this creates a conflict of interest. Compliance must be independent to ensure objective oversight of regulatory adherence. Step 3: Why the Other Options Are Incorrect Option A ("Report to the business") → Incorrect because compliance must provide independent oversight, not report to business units. Option C ("Outsource compliance if risk function exists") → Incorrect because compliance and risk functions have distinct roles. Option D ("Outsource risk if compliance exists") → Incorrect because risk management is a core function, not an outsourcing candidate. PRMIA Risk Reference Used: PRMIA Compliance Risk Governance – States compliance must be independent under the Three Lines of Defense model. Basel Compliance Principles – Recommends separate reporting structures for compliance and business units. Final Conclusion: Compliance must be independent from the business to avoid conflicts of interest, making Option B the correct answer.

Question 9

In Operational Resilience, which of the following is not an important measure of whether a Business Service can be considered Critical?

Accepted Answer

C

Explanation: Step 1: Definition of a Critical Business Service in Operational Resilience A Critical Business Service is one whose failure could result in severe harm to customers, financial markets, or the firm’s viability. Regulators (e.g., Bank of England, Basel Committee, PRMIA) define three primary factors for identifying critical services: Customer impact Market integrity impact Firm viability impact Step 2: Why Option C Is Incorrect Risk appetite is an internal business decision, not an external measure of criticality. A service can be critical even if its disruption stays within risk appetite. Criticality is based on external impacts, not just internal risk limits. Step 3: Why the Other Options Are Correct Option A ("Material customer detriment") → Correct as customer harm defines critical services. Option B ("Harm to market integrity") → Correct as market stability is a regulatory priority. Option D ("Threaten firm viability") → Correct as critical services often determine business survival. PRMIA Risk Reference Used: PRMIA Operational Resilience Framework – Defines criteria for critical business services. Basel Committee Operational Risk Guidelines – Highlights customer, market, and firm viability as resilience factors. Final Conclusion: Risk appetite is an internal benchmark, not a measure of critical service designation, making Option C the correct answer.

Question 10

Confidence Accounting can be defined as:

Accepted Answer

B

Explanation: Definition of Confidence Accounting Confidence Accounting challenges traditional accounting by introducing probability distributions and ranges rather than fixed numbers for financial reporting. This approach improves transparency and risk awareness by acknowledging uncertainty in financial figures. Why Answer B is Correct Encourages using ranges (confidence intervals) instead of discrete values to better reflect uncertainty. Used in risk-sensitive industries where financial estimates vary due to external factors (e.g., credit risk, market fluctuations). Why Other Answers Are Incorrect Option Explanation A . An approach that encourages companies and audit firms to have diverse boards. Incorrect – Board diversity is unrelated to Confidence Accounting. C . An approach that encourages companies and audit firms to use regular statements in their AI software. Incorrect – AI may use probability models, but Confidence Accounting is an accounting methodology, not an AI approach. Incorrect – Confidence Accounting still relies on mathematical models; it does not eliminate numerical analysis. D . An approach that encourages companies and audit firms to stop using figures and maths. PRMIA Reference for Verification PRMIA Financial Risk Reporting Standards IFRS (International Financial Reporting Standards) Guidelines on Probability-Based Accounting

Question 11

Which of the follow does the risk function typically have responsibility for?

Accepted Answer

B

Explanation: Role of the Risk Function The risk function is responsible for documenting, monitoring, and overseeing risk policies and frameworks. It ensures the organization maintains structured risk governance, reporting, and compliance. Key Responsibilities Developing Risk Management Manuals to define risk appetite, risk frameworks, and risk governance structures. Creating Risk Policies that align with regulatory standards and internal controls. Why Answer B is Correct The risk function primarily develops, implements, and maintains risk management frameworks, which include formal manuals and policies. Why Other Answers Are Incorrect Option Explanation A . Documenting its activities, typically by operating and then recording the daily operation of controls. Incorrect – The first line of defense (business units) handles daily operational controls, not the risk function. C . Putting in place the servers, firewalls, and software to ensure cybersecurity. Incorrect – Cybersecurity is an IT responsibility, while the risk function oversees cyber risk frameworks. D . Creating a trial balance, balance sheet statement, and cash flow statement. Incorrect – These are financial accounting responsibilities, not risk management duties. PRMIA Reference for Verification PRMIA Governance Framework for Risk Management Basel Risk Management Principles

Question 12

For credit risk losses containing operational risk elements that have been historically included in an organizations' credit risk database how should the loss amount be treated?

Accepted Answer

C

Explanation: Understanding Credit Risk and Operational Risk Overlap In some cases, credit risk losses contain elements of operational risk, such as fraud, documentation errors, or IT failures affecting credit transactions. Basel II and III frameworks require institutions to distinguish between pure credit risk losses and operational risk components within those losses. Treatment of Losses The credit-related portion is accounted for under credit risk capital calculations. The operational risk portion (e.g., fraud-related losses) should be classified separately and included in operational risk databases for risk measurement. Why Answer C is Correct Basel III and PRMIA recommend a clear split between credit risk and operational risk components to ensure accurate risk modeling. If operational risk elements are ignored, an organization may underestimate its true operational risk exposure. Why Other Answers Are Incorrect Option Explanation Incorrect – This ignores operational risk components that should be accounted for separately. A . The entire loss amount is treated as credit risk. Incorrect – Credit risk losses are typically dominant in lending-related losses and should not be fully classified as operational risk. B . The entire loss amount is treated as operational risk. D . The entire loss amount is treated as credit risk, but the loss is entered as a memorandum within the operational loss database and not used for capital modeling purposes. Incorrect – The operational risk portion must be considered for capital modeling, not just recorded as a memo. PRMIA Reference for Verification Basel II & III Guidelines on Credit and Operational Risk Integration PRMIA Operational Risk Framework

Question 13

For the National Australia Bank - FX Options case study, which was the major cause of the loss event?

Accepted Answer

C

Explanation: Overview of the National Australia Bank (NAB) FX Options Case Study Traders at National Australia Bank (NAB) engaged in unauthorized foreign exchange (FX) options trading. They smoothed profits and concealed losses using fictitious transactions and manipulated reporting. This led to a major financial scandal and loss of investor confidence. Key Findings of the Investigation Traders artificially smoothed profits to avoid drawing attention to large fluctuations. Losses were concealed from internal risk controls by manipulating trade records. The bank’s risk management and governance controls failed to detect and prevent these activities. Why Other Answers Are Incorrect Option Explanation A . Currency traders were allowed access to the risk system by the CEO. Incorrect – No evidence suggests CEO involvement in granting system access. B . Currency traders concealed losses using back-office knowledge. Incorrect – While they concealed losses, they also smoothed profits to manipulate earnings trends. D . Currency traders were able to complete a Management Buy Out (MBO). Incorrect – This event was not related to a Management Buyout (MBO); it was a trading scandal. PRMIA Reference for Verification PRMIA Fraud and Risk Management Case Studies Basel Principles on Market Risk and Internal Control Failures

Question 14

For the TSB case what was the cause of the outage at the heart of the case?

Accepted Answer

C

Explanation: Step 1: Understanding the TSB Case The TSB outage in 2018 was caused by a failed IT migration from its old banking system to a new one. The transition locked millions of customers out of their accounts for weeks, resulting in financial losses and reputational damage. Step 2: Why Option C Is Correct TSB attempted to move customer data to a new banking platform, but serious defects in the migration process led to service failures. PRMIA and UK Financial Conduct Authority (FCA) reports confirmed that poor IT risk management was a key failure. Step 3: Why the Other Options Are Incorrect Option A ("Liquidity squeeze by hedge-fund") Incorrect because TSB's failure was due to IT migration issues, not a liquidity crisis. Option B ("Sub-standard risk pricing and risk management") Incorrect because pricing models were not the cause—it was an IT system failure. Option D ("IT models did not work if prices were discontinuous") Incorrect as this issue is more common in high-frequency trading failures, not banking system outages. PRMIA Risk Reference Used: UK FCA Investigation on TSB Incident – Confirms IT migration failure as root cause. PRMIA IT Risk Management Framework – Highlights risks of major IT transitions. Final Conclusion: The TSB outage was caused by a failed IT migration, making Option C the correct answer.

Question 15

Risk Sensitive pricing is required for several good reasons. Which one of the following is not relevant to the Management's evaluation of the correct approach to Risk Sensitive pricing?

Accepted Answer

D

Explanation: Risk-sensitive pricing ensures that financial institutions and businesses properly account for risk in their pricing strategies to maintain stability and sustainability. PRMIA’s Risk Pricing and Capital Adequacy Guidelines define the importance of risk-sensitive pricing in ensuring fair compensation for risk exposure and avoiding risk concentration issues. Step 1: Why Risk-Sensitive Pricing Is Important Aligns risk with return: Pricing should be designed to reflect the underlying risk and return trade-off. Protects investors: Investors expect compensation for capital at risk (Option A is correct). Reinforces risk-aware culture: PRMIA promotes linking incentives to risk-adjusted returns (Option B is correct). Prevents adverse selection: Proper risk pricing prevents low-quality assets from accumulating (Option C is correct). Step 2: Why Option D Is Incorrect Income targets are business-driven, not risk-driven. Risk-sensitive pricing aims to balance risk and reward, not just maximize revenue. PRMIA discourages profit-seeking behavior at the expense of risk considerations. PRMIA Risk Reference Used: PRMIA Risk Pricing Guidelines – Defines the principles of risk-sensitive pricing. PRMIA Risk-Adjusted Return Standards – Stresses linking incentives to risk-aware decisions. PRMIA Capital Adequacy Framework – Highlights the role of risk-sensitive pricing in portfolio management. Final Conclusion: Risk-sensitive pricing is designed to align returns with risk exposure, not simply to meet or exceed income targets, making Option D the correct answer.

Free PRMIA 8020 Actual Exam Questions