Pass the PRMIA PRM Certification 8020 Questions and answers with CertsForce

Introduction of Operational Risk in Basel Accords

Basel I (1988)→ Focusedonly on credit riskandmarket risk; operational risk wasnot yet included.

Basel II (2004)→ Introducedoperational risk as a separate category, subject tocapital requirements.

Basel III (2010)→ Strengthenedcapital and liquidity requirementsbut did not introduce operational risk.

Basel IV (2017, still evolving)→ Adjusts Basel III reforms but does not introduce operational risk as a new category.

Why Answer B is Correct

Basel II (2004) was the first to introduce operational risk as a risk requiring a capital charge.

Why Other Answers Are Incorrect

Option

Explanation

A. Basel I

Incorrect– Basel I focused oncredit risk and market risk, with no capital requirements for operational risk.

C. Basel III

Incorrect– Basel III strengthened Basel II but didnot introduce operational risk.

D. Basel IV

Incorrect– Basel IV refines Basel III but doesnot introduce operational risk as a new capital charge.

Basel II (2004) Operational Risk Framework

PRMIA Operational Risk Management Guidelines

PRMIA References for Verification

Risk capacityis the maximum level of risk a firm can bear based onfinancial resources, earnings, and capital structure.

Management canadjust risk capacityby modifyingrisk exposure, balance sheet size, or earnings retention.

Increasing dividends reduces retained earnings, whichlowers capital reservesandreduces risk capacity.

Firms seeking toimprove risk capacity should retain earnings, not distribute them.

Option A ("Reduce scale of risks")→Correctas reducing balance sheet size lowers risk exposure.

Option B ("Improve quality of risks")→Correctas taking onlower-risk assetsimproves stability.

Option D ("Improve retained earnings")→Correctas more capitalincreases risk capacity.

Step 1: Aligning Strategy with Risk CapacityStep 2: Why Option C Is IncorrectStep 3: Why the Other Options Are Correct

PRMIA Capital Management Framework– Defines risk capacity and earnings retention strategies.

Basel III Capital Standards– Stresses retained earnings as a key factor in risk capacity.

PRMIA Risk References Used:

Final Conclusion:Reducing retained earnings through dividends weakens risk capacity, makingOption C the correct answer.

Northern Rock was a UK bank that collapsed in 2007due to its heavy reliance onshort-term wholesale fundingrather than customer deposits.

When the2007 financial crisishit, theinter-bank lending market and commercial paper market froze, cutting off Northern Rock’s access to liquidity.

Northern Rock depended onshort-term borrowing to fund long-term mortgage lending.

When theliquidity crisis hit, itcouldn’t refinance its debt, leading toa bank run and collapse.

TheBank of England had to intervene, and the UK governmentnationalized Northern Rock in 2008.

Option A ("Acquisition of Merrill Lynch")→ Incorrect becausethis happened in 2008, after Northern Rock’s failure.

Option B ("Withdrawal of Deposit Protection")→ Incorrect becauseUK deposit protection remained in place.

Option D ("Real estate exposure in Berlin")→ Incorrect because Northern Rock'sproblem was funding liquidity, not real estate losses.

Step 1: Understanding the Northern Rock Case StudyStep 2: Why Option C Is CorrectStep 3: Why the Other Options Are Incorrect

PRMIA Liquidity Risk Management Framework– Describes howliquidity shocks impact banks like Northern Rock.

Basel III Liquidity Coverage Ratio (LCR) Standards– Created after Northern Rock toprevent similar liquidity crises.

PRMIA Risk References Used:

Final Conclusion:Thecollapse of the inter-bank and commercial paper marketswas the keylow-probability-high-impact eventthat led to Northern Rock’s failure, makingOption C the correct answer.

PRMIA and global financial regulators defineclimate riskas the financial, operational, and societal risks arising fromclimate change.

Climate risks impact businesses throughphysical risks(e.g., floods, wildfires) andtransition risks(e.g., regulatory changes, carbon pricing).

Option A ("Climate risk has been moved out of all risk taxonomies due to international agreement")

Incorrect becauseclimate risk is now a central part of risk taxonomies, as emphasized by PRMIA, Basel III, and TCFD.

Option B ("Climate risk refers to the growing impacts of credit risk on the business environment")

Incorrect because credit risk is justone aspectof climate risk, not the full definition.

Option C ("Climate risk refers to change in the business climate during a recession")

Incorrect becauseclimate risk is about environmental change, not economic cycles.

Step 1: Definition of Climate RiskStep 2: Why the Other Options Are Incorrect

PRMIA Climate Risk Guidelines– Defines climate risk as a financial and societal risk due to climate change.

TCFD (Task Force on Climate-Related Financial Disclosures)– Outlines regulatory expectations for climate risk management.

PRMIA Risk References Used:

Final Conclusion:Climate risk involvesphysical and transition risks from climate change, makingOption D the correct answer.

ISO 27000is aglobal standard for information security management systems (ISMS), issued by theInternational Organization for Standardization (ISO).

It provides aframework for protecting sensitive informationthrough policies, controls, and risk management practices.

ISO 27001 (part of ISO 27000 series)is one of the most widely recognized certifications forinformation security governance.

It sets guidelines onrisk assessment, incident response, and data protection.

Option A ("ESG investing")

Incorrect becauseISO 27000 deals with cybersecurity, not environmental, social, and governance (ESG) issues.

Option C ("International Risk Management")

Incorrect because ISO 27000 focuses oninformation security, notgeneral risk management.

Option D ("Auditing of financial controls")

Incorrect becausefinancial auditing standards (e.g., SOX, COSO) are separate from information security standards.

Step 1: Definition of ISO 27000Step 2: Why Option B Is CorrectStep 3: Why the Other Options Are Incorrect

ISO 27000 Series Documentation– Defines cybersecurity risk management practices.

PRMIA IT Risk Governance Framework– References ISO 27001 as a cybersecurity standard.

PRMIA Risk References Used:

Overview of the National Australia Bank (NAB) FX Options Case Study

Traders atNational Australia Bank (NAB)engaged inunauthorized foreign exchange (FX) options trading.

Theysmoothed profits and concealed lossesusingfictitious transactions and manipulated reporting.

This led toa major financial scandal and loss of investor confidence.

Key Findings of the Investigation

Tradersartificially smoothed profitsto avoid drawing attention to large fluctuations.

Losses wereconcealed from internal risk controlsby manipulating trade records.

The bank’srisk management and governance controls failedto detect and prevent these activities.

Why Other Answers Are Incorrect

Option

Explanation

A. Currency traders were allowed access to the risk system by the CEO.

Incorrect– No evidence suggests CEO involvement in granting system access.

B. Currency traders concealed losses using back-office knowledge.

Incorrect– While they concealed losses, they alsosmoothed profitsto manipulate earnings trends.

D. Currency traders were able to complete a Management Buy Out (MBO).

Incorrect– This event wasnot related to a Management Buyout (MBO); it was atrading scandal.

PRMIA Fraud and Risk Management Case Studies

Basel Principles on Market Risk and Internal Control Failures

PRMIA References for Verification

Role of the Risk Function

Therisk functionis responsible fordocumenting, monitoring, and overseeing risk policies and frameworks.

It ensures the organizationmaintains structured risk governance, reporting, and compliance.

Key Responsibilities

Developing Risk Management Manualsto definerisk appetite, risk frameworks, and risk governance structures.

Creating Risk Policiesthat align withregulatory standards and internal controls.

Why Answer B is Correct

The risk function primarilydevelops, implements, and maintains risk management frameworks, which include formalmanuals and policies.

Why Other Answers Are Incorrect

Option

Explanation

A. Documenting its activities, typically by operating and then recording the daily operation of controls.

Incorrect– The first line of defense (business units) handles daily operational controls, not the risk function.

C. Putting in place the servers, firewalls, and software to ensure cybersecurity.

Incorrect– Cybersecurity is anIT responsibility, while the risk functionoversees cyber risk frameworks.

D. Creating a trial balance, balance sheet statement, and cash flow statement.

Incorrect– These arefinancial accounting responsibilities, not risk management duties.

PRMIA Governance Framework for Risk Management

Basel Risk Management Principles

PRMIA References for Verification

Arisk assessment workshopis a structured session where key stakeholdersidentify, evaluate, and prioritize risks.

Effective workshops requirepreparation, clear objectives, and structured discussionsto ensure meaningful risk analysis.

PRMIA and best practices recommendthorough preparation, including:

Setting objectives

Defining risk categories

Ensuring participation from risk, compliance, and business units

Providing risk assessment tools/templates

Option A ("Run spontaneously")→ Incorrect becauselack of preparation leads to poor discussions and missed risks.

Option C ("Risk management should not attend")→ Incorrect becauserisk managers provide key expertise to guide discussions.

Option D ("Compliance experts should not attend")→ Incorrect becausecompliance provides regulatory insights essential to risk assessment.

Step 1: What Is a Risk Assessment Workshop?Step 2: Why Option B is CorrectStep 3: Why the Other Options Are Incorrect

PRMIA Risk Assessment Framework– Recommends structured, well-prepared workshops.

ISO 31000 Risk Management Standard– Supports proactive workshop planning.

PRMIA Risk References Used:

Final Conclusion:Risk assessment workshops should be well-prepared to ensure meaningful discussions and effective risk identification, makingOption B the correct answer.