2026 Valid 8020 test answers & PRMIA Exam PDF
Free PRMIA 8020 Exam Questions and Answer from Training Expert PracticeVCE
PRMIA 8020 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 21
In operational resilience, what is impact tolerance?
- A. Impact tolerance is a firm's tolerance for disruption to a particular business service.
- B. Impact tolerance is a firm's risk appetite statement.
- C. Impact tolerance is a firm's risk capacity statement.
- D. Impact tolerance is a firm's tolerance for disruption to a particular business process.
Answer: A
Explanation:
Impact Tolerance is a key concept in Operational Resilience, defined as the ability of a firm to withstand, respond to, and recover from disruptions. According to PRMIA and global regulatory frameworks (such as the Bank of England's Operational Resilience Framework), impact tolerance is specifically tied to business services rather than processes.
Step 1: Defining Impact Tolerance
Impact tolerance is the maximum acceptable level of disruption to an important business service, beyond which there would be intolerable harm to customers, financial markets, or regulatory obligations.
It is not the same as risk appetite or risk capacity, as those deal with broader organizational risk exposure.
Step 2: Why Business Services Matter
PRMIA defines business services as end-to-end services delivered to clients and stakeholders, such as payments processing, trade execution, or loan approvals.
Disruptions to these services directly impact customers and financial stability, making business service resilience the core focus of impact tolerance.
Step 3: Why the Other Options Are Incorrect
Option A ("tolerance for disruption to a particular business process")
Incorrect because impact tolerance applies to services, not just internal processes.
Option C ("a firm's risk appetite statement")
Incorrect because risk appetite focuses on how much risk a firm is willing to take, while impact tolerance is about surviving disruptions.
Option D ("a firm's risk capacity statement")
Incorrect because risk capacity is the maximum level of risk a firm can bear, which is broader than business service disruptions.
PRMIA Risk Reference Used:
PRMIA Operational Resilience Guidelines - Defines impact tolerance as a service-based metric.
Bank of England's Operational Resilience Framework - Establishes impact tolerance as a limit on business service disruption.
Final Conclusion:
Impact tolerance focuses on business services, not just internal processes or risk appetite, making Option B the correct answer.
NEW QUESTION # 22
What are some of the deficiencies associated with bottom-up Key Risk Indicators?
- A. Lack of granularity.
- B. Not reported frequently enough.
- C. Causal affects that are not adequately understood.
- D. Mandates from a board that are too restrictive to implement.
Answer: C
Explanation:
Definition of Bottom-Up Key Risk Indicators (KRIs)
Bottom-up KRIs are generated from operational-level data rather than high-level strategic indicators.
They are useful for monitoring localized risks but may fail to capture broad risk drivers.
Key Deficiencies of Bottom-Up KRIs
Lack of clarity on causal relationships - These indicators may detect risk trends but fail to explain root causes.
Focus on micro-level risks - They may miss systemic or enterprise-wide risk interactions.
Why Answer B is Correct
Bottom-up KRIs may indicate changes in risk levels but lack insight into the underlying causes, leading to reactive rather than proactive risk management.
Why Other Answers Are Incorrect
Option
Explanation:
A . Mandates from a board that are too restrictive to implement.
Incorrect - Board mandates apply to top-down governance, not bottom-up KRIs.
C . Not reported frequently enough.
Incorrect - Reporting frequency is an issue but not the primary deficiency; rather, it's the lack of causal insight.
D . Lack of granularity.
Incorrect - Bottom-up KRIs tend to be highly detailed (granular), making this answer incorrect.
PRMIA Reference for Verification
PRMIA Key Risk Indicator Best Practices
Basel Committee's Risk Measurement and Reporting Framework
NEW QUESTION # 23
Which of the following statements best defines the properties of top-down key risk indicators?
- A. Selected by senior management, used to manage changes in the business environment especially under periods of stress, and reported on a daily basis.
- B. Selected by junior management, used to manage changes in the business environment especially under periods of stress, and reported on an annual basis
- C. Can only be selected by the board in line with risk ratings.
- D. Selected by senior management, tied to material external and internal loss exposures and scenarios, and used to manage changes in the business environment, especially under periods of stress.
Answer: D
Explanation:
Definition of Key Risk Indicators (KRIs)
KRIs are quantitative metrics used to monitor risk levels and detect early warning signs of potential risk events.
Top-down KRIs are identified at the senior management level and focus on enterprise-wide risk exposure.
Key Properties of Top-Down KRIs
Selected by senior management to ensure alignment with strategic objectives.
Tied to material external and internal loss exposures to capture critical financial, operational, and strategic risks.
Used to manage changes in the business environment to ensure proactive risk response, especially under stress conditions.
Why Other Answers Are Incorrect
Option
Explanation:
B . Selected by senior management, used to manage changes in the business environment, especially under periods of stress, and reported on a daily basis.
Incorrect - Top-down KRIs are not reported daily; they are monitored periodically (e.g., quarterly).
C . Selected by junior management, used to manage changes in the business environment, especially under periods of stress, and reported on an annual basis.
Incorrect - Junior management does not define top-down KRIs; senior management does. Also, annual reporting is too infrequent.
D . Can only be selected by the board in line with risk ratings.
Incorrect - The board provides oversight, but senior risk management selects KRIs, not just the board.
PRMIA Reference for Verification
PRMIA Risk Indicator Guidelines
Basel Committee on Banking Supervision (BCBS) Principles for Effective Risk Data Aggregation
NEW QUESTION # 24
Managing financial crime is a part of risk and compliance for many firms. Which of the following is a useful control to help reduce this risk?
- A. The requirements to trace all transactions when they are entered into spreadsheets.
- B. Having the business be a cash only business and not report any transactions.
- C. Development of scenarios and red flags that are used to monitor transactions and identify suspicious customers and activities.
- D. Local regulations that allow a bank to not report transactions by family members of the board.
Answer: C
Explanation:
Financial Crime Risk Management
Managing financial crime requires implementing controls, monitoring, and reporting systems to detect and prevent illegal activities.
Developing red flags and monitoring scenarios allows firms to detect suspicious transactions related to money laundering, fraud, and terrorist financing.
Why Answer C is Correct
PRMIA emphasizes that effective risk management requires proactive monitoring of transactions using red flags, transaction patterns, and anomaly detection systems.
This is aligned with Anti-Money Laundering (AML) and Counter-Terrorism Financing (CTF) regulatory requirements.
Why Other Answers Are Incorrect
Option
Explanation:
A . Having the business be a cash-only business and not report any transactions.
Incorrect - Cash-only businesses with no reporting are high-risk for financial crime.
B . The requirements to trace all transactions when they are entered into spreadsheets.
Incorrect - While transaction tracing is important, spreadsheets alone are not an effective control mechanism for financial crime.
D . Local regulations that allow a bank to not report transactions by family members of the board.
Incorrect - This would violate AML and financial crime regulations, increasing corruption risk.
PRMIA Reference for Verification
PRMIA Financial Crime and AML Risk Guidelines
Basel Committee on Financial Crime and Money Laundering
NEW QUESTION # 25
Stafford Beers Viable System Model (VSM) has several implementation elements. Which of the following is not one of these?
- A. Governance
- B. Input
- C. Output
- D. Process
Answer: B
Explanation:
Stafford Beer's Viable System Model (VSM)
VSM is a cybernetic model designed to analyze and improve organizational structures.
It consists of five core subsystems that define governance and operations.
Why Answer B is Correct
The VSM does not explicitly include "Input" as a key component.
The key elements of VSM include Governance, Process, and Output, but it does not define "Input" as a standalone concept.
Why Other Answers Are Incorrect
Option
Explanation:
A . Governance
Correct - Governance is part of VSM and deals with decision-making and oversight.
C . Process
Correct - Process represents the operational functions within VSM.
D . Output
Correct - Output refers to the results of the system's operations.
PRMIA Reference for Verification
PRMIA Governance and Cybernetic Systems Guidelines
Stafford Beer's Viable System Model Framework
NEW QUESTION # 26
What are some of the properties of Bottom-Up KRIs?
- A. Selected by local management: tied to internal loss events at the legal entity, country, business and / or product level, reported daily, weekly or monthly.
- B. Selected by local management, based on key controls or weaknesses identified by audit reports, reported on quarterly.
- C. Are not used due to changes in regulations.
- D. Seated by senior management: tied to internal loss events at the legal entity, country, business and / or product level, reported.
daily, weekly or monthly.
Answer: A
Explanation:
Definition of Bottom-Up KRIs
Bottom-Up Key Risk Indicators (KRIs) are identified at the operational level, focusing on localized risks within business units.
They are tied to actual internal loss events and reported frequently (daily, weekly, or monthly) to capture ongoing trends.
Key Properties of Bottom-Up KRIs
Selected by local management → Ensures relevance to specific business areas.
Tied to internal loss events → Helps in tracking risk patterns within specific legal entities, countries, or business units.
Reported frequently → Allows for timely risk detection and mitigation.
Why Answer D is Correct
Bottom-up KRIs focus on localized risk exposure and are monitored frequently to track operational changes.
Why Other Answers Are Incorrect
Option
Explanation:
A . Seated by senior management: tied to internal loss events at the legal entity, country, business, and/or product level, reported daily, weekly, or monthly.
Incorrect - Senior management sets top-down KRIs, while bottom-up KRIs are managed locally.
B . Selected by local management, based on key controls or weaknesses identified by audit reports, reported quarterly.
Incorrect - While audit reports are useful, bottom-up KRIs are based on loss events, not just audit findings. Quarterly reporting is too infrequent.
C . Are not used due to changes in regulations.
Incorrect - Bottom-up KRIs remain essential despite regulatory changes.
PRMIA Reference for Verification
PRMIA Risk Indicator Best Practices
Basel Committee's Risk Measurement and Reporting Guidelines
NEW QUESTION # 27
For the Northern Rock case study, what was the low-probability-high-impact event that was most responsible for the loss event?
- A. The acquisition of Merrill Lynch by Bank of America.
- B. An exposure to real estate funds, heavily concentrated in Berlin.
- C. The Bank of England's withdrawal of Deposit Protection.
- D. Liquidity dried up in the inter-bank and commercial paper markets.
Answer: D
Explanation:
Step 1: Understanding the Northern Rock Case Study
Northern Rock was a UK bank that collapsed in 2007 due to its heavy reliance on short-term wholesale funding rather than customer deposits.
When the 2007 financial crisis hit, the inter-bank lending market and commercial paper market froze, cutting off Northern Rock's access to liquidity.
Step 2: Why Option C Is Correct
Northern Rock depended on short-term borrowing to fund long-term mortgage lending.
When the liquidity crisis hit, it couldn't refinance its debt, leading to a bank run and collapse.
The Bank of England had to intervene, and the UK government nationalized Northern Rock in 2008.
Step 3: Why the Other Options Are Incorrect
Option A ("Acquisition of Merrill Lynch") → Incorrect because this happened in 2008, after Northern Rock's failure.
Option B ("Withdrawal of Deposit Protection") → Incorrect because UK deposit protection remained in place.
Option D ("Real estate exposure in Berlin") → Incorrect because Northern Rock's problem was funding liquidity, not real estate losses.
PRMIA Risk Reference Used:
PRMIA Liquidity Risk Management Framework - Describes how liquidity shocks impact banks like Northern Rock.
Basel III Liquidity Coverage Ratio (LCR) Standards - Created after Northern Rock to prevent similar liquidity crises.
Final Conclusion:
The collapse of the inter-bank and commercial paper markets was the key low-probability-high-impact event that led to Northern Rock's failure, making Option C the correct answer.
NEW QUESTION # 28
When a single operational risk event leads to losses in multiple business lines or impacts across several event types, how should these linked losses be treated?
- A. Allocate entire loss to the business line for which the loss is greatest.
- B. Pro-rate the loss across the affected business line.
- C. Each business line should take it's own discretion as to how the losses are treated.
- D. Either allocate entire loss to the business line for which the loss is greatest or pro-rate the loss across the affected business line.
Answer: D
Explanation:
Step 1: Understanding Linked Losses in Operational Risk
In operational risk events, a single event can impact multiple business lines or event types (e.g., IT failure affecting retail banking and wealth management).
Proper loss attribution is important for accurate risk reporting and regulatory compliance under Basel III.
Step 2: Why Option C is Correct
Basel III and PRMIA guidance allow institutions flexibility in how to allocate linked losses:
Entire loss can be allocated to the business line with the largest loss impact for simplified reporting.
Loss can be pro-rated across affected business lines for more accurate attribution.
Step 3: Why the Other Options Are Incorrect
Option A ("Allocate entire loss to the business line with the greatest loss") → Partially correct, but not always required-some firms prefer pro-rating.
Option B ("Pro-rate the loss") → Partially correct, but allocating to the largest impacted business line is also acceptable.
Option D ("Each business line decides how to treat losses") → Incorrect because loss allocation should follow a defined policy, not business line discretion.
PRMIA Risk Reference Used:
Basel III Operational Risk Framework - Discusses loss attribution for multi-line impact events.
PRMIA Loss Event Management Guidelines - Supports both full allocation and pro-rating.
Final Conclusion:
Firms can either allocate the full loss to the most impacted business line or pro-rate it across affected lines, making Option C the correct answer.
NEW QUESTION # 29
Two of the four key resources that are regarded as critical to maintain confidence and calibrate Risk Appetite to are?
- A. Capital expenditure and liquidity.
- B. Quality human resources and reputation.
- C. Net earnings and capital.
- D. Strong regulatory assessment and net earnings.
Answer: C
Explanation:
Key Resources for Calibrating Risk Appetite
Risk appetite defines how much risk an organization is willing to accept to achieve its objectives.
Two of the most critical resources for maintaining confidence and setting risk appetite are net earnings and capital.
Why Net Earnings and Capital are Critical
Net earnings reflect profitability and financial stability, influencing risk-taking capacity.
Capital ensures that the institution can absorb losses and meet regulatory requirements.
Basel III emphasizes capital adequacy as a core measure of financial resilience.
Why Answer B is Correct
Net earnings support operational stability, while capital determines how much risk an institution can bear.
Both are used to define and calibrate risk appetite levels.
Why Other Answers Are Incorrect
Option
Explanation:
A . Capital expenditure and liquidity.
Incorrect - Capital expenditure is an investment measure, not a direct risk appetite determinant.
C . Strong regulatory assessment and net earnings.
Incorrect - Regulatory assessments are important but do not directly set risk appetite.
D . Quality human resources and reputation.
Incorrect - HR and reputation are important for governance but do not directly influence risk capital and earnings stability.
PRMIA Reference for Verification
PRMIA Risk Appetite Framework
Basel III Capital and Earnings Management Guidelines
NEW QUESTION # 30
Governance can be defined as which of the following?
- A. Governance is a structure specifying the ways in which reporting is made to the primary regulator.
- B. Governance is being replaced by management in all firms that are regulated.
- C. Governance is a structure specifying the policies, principles, and procedures for making decisions about corporate direction.
- D. Governance is a structure specifying the daily operation of a firm.
Answer: C
Explanation:
Definition of Governance
Governance refers to the framework of policies, principles, and processes used to guide corporate decision-making and strategic direction.
It ensures accountability, transparency, and risk oversight within an organization.
Key Elements of Governance
Risk oversight - Ensuring risks are properly identified and managed.
Accountability structures - Defining roles and responsibilities.
Decision-making frameworks - Establishing policies for long-term corporate success.
Why Other Answers Are Incorrect
Option
Explanation:
A . Governance is a structure specifying the daily operation of a firm.
Incorrect - Governance focuses on high-level corporate oversight, not day-to-day operations.
B . Governance is a structure specifying the ways in which reporting is made to the primary regulator.
Incorrect - Governance is broader than just regulatory reporting.
C . Governance is being replaced by management in all firms that are regulated.
Incorrect - Governance and management are separate but complementary; governance provides oversight, while management executes strategy.
PRMIA Reference for Verification
PRMIA 10 Principles of Good Governance
NEW QUESTION # 31
Which of the following best describes the role of the compliance department?
- A. The compliance department is responsible for providing oversight over the auditor's implementation of compliance risk management controls.
- B. The compliance department is responsible for implementing the first line's compliance risk management controls.
- C. The compliance department is responsible for providing oversight over the first line's implementation of compliance risk management controls.
- D. The compliance department is responsible for providing oversight over the board's implementation of compliance risk management controls.
Answer: C
Explanation:
Three Lines of Defense Model
The compliance department functions as the second line of defense, ensuring oversight over the first line's compliance controls.
It does not directly implement controls but monitors and advises on compliance risk management.
Responsibilities of the Compliance Department
Ensures regulatory compliance with laws, policies, and industry standards.
Monitors and enforces risk management controls within business operations.
Provides advisory and training on compliance risks.
Why Answer D is Correct
The first line of defense (business operations) is responsible for executing compliance controls.
The compliance department (second line) provides oversight and governance to ensure compliance adherence.
Why Other Answers Are Incorrect
Option
Explanation:
A . The compliance department is responsible for implementing the first line's compliance risk management controls.
Incorrect - The first line (business units) implement compliance controls, while compliance oversees.
B . The compliance department is responsible for providing oversight over the auditor's implementation of compliance risk management controls.
Incorrect - Internal audit is part of the third line of defense, not directly overseen by compliance.
C . The compliance department is responsible for providing oversight over the board's implementation of compliance risk management controls.
Incorrect - The board provides high-level governance; compliance ensures business adherence to regulations.
PRMIA Reference for Verification
PRMIA Governance & Compliance Oversight Framework
Basel Committee's Guidelines on Compliance Risk Management
NEW QUESTION # 32
For the FTX case study, what was the "backdoor" used for?
- A. It allowed currency traders to smooth profits and conceal losses for over two years.
- B. It allowed trading firm Alameda to borrow S65 billion of clients' money from the exchange without their permission.
- C. It allowed a rapid pace of acquisitions but poor integration of acquired companies.
- D. It allowed a stable coin to be removed from the ledger and added to the balance sheet.
Answer: B
Explanation:
The FTX collapse involved fraudulent fund mismanagement, where FTX executives created a "backdoor" to allow Alameda Research (FTX's sister trading firm) to borrow client funds without their consent.
Step 1: The "Backdoor" in FTX
The backdoor was a hidden code in FTX's system, allegedly created by Sam Bankman-Fried, which allowed Alameda to access customer deposits without triggering alerts to auditors or compliance teams.
Alameda used these funds for risky trading strategies and investments, leading to the eventual collapse of FTX when a liquidity crunch exposed the missing funds.
Step 2: Why the Other Options Are Incorrect
Option A ("allowed a stablecoin to be removed from the ledger and added to the balance sheet") Incorrect because FTX's fraud involved misuse of customer funds, not just a stablecoin misclassification.
Option C ("allowed currency traders to smooth profits and conceal losses for over two years") Incorrect because this sounds more like LIBOR-rigging scandals, whereas FTX misappropriated client funds.
Option D ("allowed a rapid pace of acquisitions but poor integration of acquired companies") Incorrect because FTX's collapse was due to financial fraud, not poor acquisition strategy.
PRMIA Risk Reference Used:
PRMIA Financial Crime Risk Management - Discusses insider risk and fraudulent misappropriation of funds.
FTX Collapse Reports - SEC, CFTC, and DOJ filings confirm that Alameda had unauthorized access to client funds.
Final Conclusion:
FTX's backdoor enabled Alameda to take $65 billion in client funds without permission, making Option B the correct answer.
NEW QUESTION # 33
In operational resilience, what is impact tolerance?
- A. Impact tolerance is a firm's tolerance for disruption to a particular business service.
- B. Impact tolerance is a firm's risk appetite statement.
- C. Impact tolerance is a firm's risk capacity statement.
- D. Impact tolerance is a firm's tolerance for disruption to a particular business process.
Answer: A
NEW QUESTION # 34
Internal loss data (ILD) consists of what kind of data?
- A. It consists of the Key Risk Indicators of a bank.
- B. It consists of near miss operational loss incidents of a bank.
- C. It consists of historical operational loss incidents of a bank.
- D. It consists of scenario data develeloped to calcuate the future operational loss incidents of a bank.
Answer: C
Explanation:
Definition of Internal Loss Data (ILD)
Internal Loss Data (ILD) refers to historical records of actual operational losses incurred by a bank.
These losses are used for risk assessment, capital calculations, and trend analysis under Basel III's Operational Risk Framework.
Key Characteristics of ILD
Captures actual past loss events, such as fraud, system failures, and compliance breaches.
Supports the identification of risk trends and weak control areas.
Used for operational risk capital modeling, along with external loss data and scenario analysis.
Why Other Answers Are Incorrect
Option
Explanation:
A . It consists of near miss operational loss incidents of a bank.
Incorrect - ILD captures actual losses, while near misses are reported separately.
C . It consists of the Key Risk Indicators of a bank.
Incorrect - KRIs are forward-looking risk metrics, while ILD focuses on historical data.
D . It consists of scenario data developed to calculate the future operational loss incidents of a bank.
Incorrect - ILD is historical, whereas scenario data is used for predictive analysis.
PRMIA Reference for Verification
Basel III & PRMIA Operational Risk Data Framework
PRMIA Risk Management Standards for ILD
NEW QUESTION # 35
ISO 27000 relates to what topic / area?
- A. Auditing of financial controls.
- B. Information Security Systems.
- C. Environmental, social, and governance (ESG) investing.
- D. International Risk Management.
Answer: B
Explanation:
Step 1: Definition of ISO 27000
ISO 27000 is a global standard for information security management systems (ISMS), issued by the International Organization for Standardization (ISO).
It provides a framework for protecting sensitive information through policies, controls, and risk management practices.
Step 2: Why Option B Is Correct
ISO 27001 (part of ISO 27000 series) is one of the most widely recognized certifications for information security governance.
It sets guidelines on risk assessment, incident response, and data protection.
Step 3: Why the Other Options Are Incorrect
Option A ("ESG investing")
Incorrect because ISO 27000 deals with cybersecurity, not environmental, social, and governance (ESG) issues.
Option C ("International Risk Management")
Incorrect because ISO 27000 focuses on information security, not general risk management.
Option D ("Auditing of financial controls")
Incorrect because financial auditing standards (e.g., SOX, COSO) are separate from information security standards.
PRMIA Risk Reference Used:
ISO 27000 Series Documentation - Defines cybersecurity risk management practices.
PRMIA IT Risk Governance Framework - Reference ISO 27001 as a cybersecurity standard.
NEW QUESTION # 36
For the WorldCom case, what was one of the causes of the failure?
- A. A rapid pace of acquisitions and poor integration of acquired companies.
- B. Unauthorized trading in derivatives.
- C. Risk models that did not reflect loosened underwriting standards of mortgage originators.
- D. The lack of a CRO during the final IPO.
Answer: A
Explanation:
Step 1: Understanding the WorldCom Case
WorldCom was one of the largest U.S. telecom companies before its collapse in 2002 due to fraudulent accounting practices and poor risk management.
The company expanded aggressively through acquisitions but failed to integrate them properly, leading to financial mismanagement and accounting fraud.
Step 2: Why Option C is Correct
WorldCom acquired over 60 companies in a short period without proper integration.
This masked financial problems and led to $11 billion in fraudulent accounting adjustments.
PRMIA and risk management frameworks stress that poor integration after rapid acquisitions increases operational and financial risks.
Step 3: Why the Other Options Are Incorrect
Option A ("Risk models and mortgage underwriting") → Incorrect because this describes the 2008 financial crisis, not WorldCom.
Option B ("Lack of a CRO during IPO") → Incorrect because WorldCom was well-established before its fraud-CRO absence was not the main issue.
Option D ("Unauthorized derivatives trading") → Incorrect because WorldCom's failure was due to fraudulent accounting, not derivatives.
PRMIA Risk Reference Used:
PRMIA Corporate Governance Guidelines - Discusses risks of poor post-merger integration.
SEC Investigation on WorldCom (2002) - Identified fraudulent accounting due to failed acquisitions.
NEW QUESTION # 37
For which of the following reasons did the Turnbull Report have a significant impact on risk governance?
- A. It was a report that led to the establishment of the US Federal Reserve.
- B. It was the first report to list the board as a proposed governance structure.
- C. It defined the concept of risk governance for the insurance industry.
- D. It was the first report to require a board to take specific account of risks and control systems for risks.
Answer: D
Explanation:
Step 1: What Is the Turnbull Report?
The Turnbull Report (1999) was a UK corporate governance report that set risk management expectations for boards.
It required companies to assess and manage risks effectively as part of corporate governance.
Step 2: Why Option C is Correct
Turnbull was the first report to mandate that boards must consider risk management in corporate governance.
This report established risk assessment as a board-level responsibility.
Step 3: Why the Other Options Are Incorrect
Option A ("Defined risk governance for insurance") → Incorrect because Turnbull applied to all sectors, not just insurance.
Option B ("First report to propose board structure") → Incorrect because corporate boards existed long before Turnbull.
Option D ("Led to the US Federal Reserve") → Incorrect because the Federal Reserve was established in 1913, long before Turnbull.
PRMIA Risk Reference Used:
PRMIA Corporate Governance Guidelines - Highlights Turnbull's role in board-level risk oversight.
UK Corporate Governance Code - Turnbull contributed to defining board risk responsibilities.
Final Conclusion:
The Turnbull Report was the first to require boards to consider risks in corporate governance, making Option C the correct answer.
NEW QUESTION # 38
Which of the following is a correct statement about control rating scales?
- A. A control rating scale should consider both control effectiveness and control performance.
- B. A control rating scale should consider control effectiveness but not control performance.
- C. They are enhanced by the use of software that includes inherent risk.
- D. A control rating scale should consider neither control effectiveness or control performance.
Answer: A
Explanation:
Definition of Control Rating Scales
Control rating scales measure the effectiveness and performance of risk management controls.
They help organizations evaluate control strength and identify weaknesses.
Key Components
Control effectiveness → Measures how well the control mitigates risks.
Control performance → Assesses whether the control operates as designed in practice.
Why Answer C is Correct
Both effectiveness and performance are crucial for assessing control reliability.
A control may be designed effectively but fail in execution, making both factors essential.
Why Other Answers Are Incorrect
Option
Explanation:
A . They are enhanced by the use of software that includes inherent risk.
Incorrect - Software can improve ratings, but control scales are based on evaluation criteria, not just software tools.
B . A control rating scale should consider control effectiveness but not control performance.
Incorrect - Ignoring performance could lead to misjudging actual control reliability.
D . A control rating scale should consider neither control effectiveness nor control performance.
Incorrect - This would render the control rating scale useless.
PRMIA Reference for Verification
PRMIA Governance and Control Framework
Basel Operational Risk Management Guidelines
NEW QUESTION # 39
Confidence Accounting can be defined as:
- A. An approach that encourages companies and audit firms to have diverse boards.
- B. An approach that encourages companies and audit firms to use ranges, rather than discrete numbers, for major accounting entries.
- C. An approach that encourages companies and audit firms to use regular statements in their Al software.
- D. An approach that encourages companies and audit firms to stop using figures and maths.
Answer: B
Explanation:
Definition of Confidence Accounting
Confidence Accounting challenges traditional accounting by introducing probability distributions and ranges rather than fixed numbers for financial reporting.
This approach improves transparency and risk awareness by acknowledging uncertainty in financial figures.
Why Answer B is Correct
Encourages using ranges (confidence intervals) instead of discrete values to better reflect uncertainty.
Used in risk-sensitive industries where financial estimates vary due to external factors (e.g., credit risk, market fluctuations).
Why Other Answers Are Incorrect
Option
Explanation:
A . An approach that encourages companies and audit firms to have diverse boards.
Incorrect - Board diversity is unrelated to Confidence Accounting.
C . An approach that encourages companies and audit firms to use regular statements in their AI software.
Incorrect - AI may use probability models, but Confidence Accounting is an accounting methodology, not an AI approach.
D . An approach that encourages companies and audit firms to stop using figures and maths.
Incorrect - Confidence Accounting still relies on mathematical models; it does not eliminate numerical analysis.
PRMIA Reference for Verification
PRMIA Financial Risk Reporting Standards
IFRS (International Financial Reporting Standards) Guidelines on Probability-Based Accounting
NEW QUESTION # 40
How can a chief risk officer encourage the governing body and executive management team to create a stronger risk culture?
- A. Balance rewarding success in profitability goals with punishment when there is a failure to achieve goals.
- B. Discourage personal accountability to avoid a blame culture.
- C. Having a vision of achievable but not excessive ambition.
- D. Establish a set of objectives that the board and executive team must adhere to.
Answer: C
Explanation:
A Chief Risk Officer (CRO) plays a crucial role in shaping and strengthening the risk culture within an organization. PRMIA defines risk culture as the shared values, beliefs, knowledge, and understanding about risk that drive behaviors within an institution.
Setting a Clear Vision
The CRO should communicate a vision of risk management that aligns with organizational goals while ensuring that risk-taking remains within acceptable limits.
The vision should be achievable and realistic, rather than overly ambitious, which could incentivize reckless risk-taking.
Embedding Risk Awareness into Decision-Making
A strong risk culture ensures that risk considerations are embedded into business decision-making rather than treated as a separate compliance exercise.
This is supported by PRMIA's Enterprise Risk Management (ERM) Framework, which stresses integrating risk management into strategy and operations.
Avoiding a Blame Culture
A risk-aware organization promotes accountability without fear, enabling employees to report risks without retribution.
Option B (Discourage personal accountability to avoid a blame culture) is incorrect because personal accountability is essential for a healthy risk culture.
Avoiding a Strict, Prescriptive Approach
A set of rigid objectives that must be followed by the executive team (Option C) does not foster a dynamic, evolving risk culture.
Instead, risk culture should be flexible and adaptive to emerging risks.
Balancing Incentives and Consequences
While balancing rewards with penalties (Option D) is part of governance, a strong risk culture is not built solely through fear of punishment.
PRMIA emphasizes positive reinforcement, such as linking risk management behaviors to performance evaluations and incentives.
PRMIA Reference for Verification
PRMIA Risk Governance Framework - Discusses the role of leadership in shaping risk culture.
PRMIA Standards on Enterprise Risk Management (ERM) - Covers best practices for embedding risk culture within organizations.
NEW QUESTION # 41
For the National Australia Bank - FX Options case study, large and unusual transaction activity was a concern for what reason?
- A. Complex structured transactions aided in the smoothing of losses.
- B. Deep-in-the-money options and other complex structured transactions aided in the smoothing of profits and losses.
- C. Deep-in-the-money options and other complex structured transactions aided in the smoothing of losses.
- D. Deep-in-the-money options aided in the smoothing of losses.
Answer: B
Explanation:
The National Australia Bank (NAB) FX Options Case Study is a well-known example of operational risk, fraud, and governance failure.
What Happened?
Traders engaged in unauthorized foreign exchange (FX) options trading, using deep-in-the-money options and other complex instruments.
They manipulated profits and losses to smooth earnings and mislead risk managers and auditors.
Why Answer C is Correct
The traders smoothed both profits and losses to avoid detection and ensure continued trading bonuses.
This aligns with PRMIA's Operational Risk Management Guidelines, which highlight that hidden trading losses and smoothing techniques increase financial crime risk.
Why Other Answers Are Incorrect
Option
Explanation:
A . Complex structured transactions aided in the smoothing of losses.
Incorrect - Smoothing occurred with both profits and losses, not just losses.
B . Deep-in-the-money options and other complex structured transactions aided in the smoothing of losses.
Incorrect - Profits were also manipulated, making this answer incomplete.
D . Deep-in-the-money options aided in the smoothing of losses.
Incorrect - This focuses only on deep-in-the-money options and ignores other structured transactions involved in the fraud.
PRMIA Reference for Verification
PRMIA Fraud and Risk Management Case Studies
Basel Principles on Market Risk and Internal Control Failures
NEW QUESTION # 42
The DORA act's full name is which of the following?
- A. Daily Operational Resilience Act.
- B. Digital Operational Resilience Act.
- C. Digital Operational Risk Act.
- D. Domain for Operational Risk Act.
Answer: B
Explanation:
Definition of DORA
The Digital Operational Resilience Act (DORA) is a regulation by the European Union (EU) aimed at strengthening the digital resilience of financial institutions.
It establishes a regulatory framework for managing information and communication technology (ICT) risks in the financial sector.
Key Objectives of DORA
Ensures that financial institutions can withstand, respond to, and recover from cyber threats and ICT-related disruptions.
Introduces standards for risk management, incident reporting, and third-party ICT risk oversight.
Why Other Answers Are Incorrect
Option
Explanation:
A . Domain for Operational Risk Act.
Incorrect - No such regulation exists under this name.
B . Digital Operational Risk Act.
Incorrect - The official name is Digital Operational Resilience Act (DORA).
C . Daily Operational Resilience Act.
Incorrect - DORA is not focused on daily operations but rather long-term digital resilience.
PRMIA Reference for Verification
PRMIA Risk Governance & Digital Resilience Standards
European Commission's Official DORA Regulation
NEW QUESTION # 43
Ideally, which of the following should be completed as part of the risk assessments of service providers?
- A. A review of the pay levels of the staff supporting the service.
- B. An assessment of a third party should not include its compliance and risk infrastructure, financials, business strategy and operating history.
- C. An assessment of a third party should include its compliance and risk infrastructure, financials, business strategy and operating history.
- D. Onsite visits are not advantageous for understanding the third party's risks and control environment.
Answer: C
Explanation:
Third-Party Risk Management (TPRM)
PRMIA highlights the importance of conducting thorough due diligence on third-party vendors and service providers.
This includes evaluating compliance programs, risk management frameworks, financial stability, strategic objectives, and operational history.
Key Areas of Third-Party Risk Assessment
Compliance and Risk Infrastructure → Ensures that the provider meets regulatory and security requirements.
Financial Health → Determines whether the provider has the financial stability to support long-term service delivery.
Business Strategy → Helps assess alignment with the organization's risk appetite and goals.
Operating History → Evaluates experience and reliability in delivering services.
Why Other Answers Are Incorrect
Option
Explanation:
B . An assessment of a third party should not include its compliance and risk infrastructure, financials, business strategy, and operating history.
Incorrect - Ignoring these critical factors increases the risk of working with an unreliable vendor.
C . Onsite visits are not advantageous for understanding the third party's risks and control environment.
Incorrect - Onsite visits are highly valuable as they provide first-hand insights into operational controls. PRMIA encourages risk managers to conduct site visits.
D . A review of the pay levels of the staff supporting the service.
Incorrect - Employee salaries are not a primary risk factor in vendor assessments. The focus should be on the vendor's security, compliance, and operational risks.
PRMIA Reference for Verification
PRMIA Third-Party Risk Management (TPRM) Guidelines - Details best practices for vendor risk assessments.
Basel Principles on Outsourcing and Third-Party Risk - Provides regulatory guidance on evaluating third-party service providers.
NEW QUESTION # 44
......
Top PRMIA 8020 Courses Online: https://killexams.practicevce.com/PRMIA/8020-practice-exam-dumps.html