[Dec 19, 2025] 8020 Ultimate Study Guide – ActualCollection [Q37-Q61]

Step 1: Understanding the WorldCom Case
WorldCom was one of the largest U.S. telecom companies before its collapse in 2002 due to fraudulent accounting practices and poor risk management.
The company expanded aggressively through acquisitions but failed to integrate them properly, leading to financial mismanagement and accounting fraud.
Step 2: Why Option C is Correct
WorldCom acquired over 60 companies in a short period without proper integration.
This masked financial problems and led to $11 billion in fraudulent accounting adjustments.
PRMIA and risk management frameworks stress that poor integration after rapid acquisitions increases operational and financial risks.
Step 3: Why the Other Options Are Incorrect
Option A (“Risk models and mortgage underwriting”) → Incorrect because this describes the 2008 financial crisis, not WorldCom.
Option B (“Lack of a CRO during IPO”) → Incorrect because WorldCom was well-established before its fraud-CRO absence was not the main issue.
Option D (“Unauthorized derivatives trading”) → Incorrect because WorldCom’s failure was due to fraudulent accounting, not derivatives.
PRMIA Risk Reference Used:
PRMIA Corporate Governance Guidelines – Discusses risks of poor post-merger integration.
SEC Investigation on WorldCom (2002) – Identified fraudulent accounting due to failed acquisitions.

When a control is found to be ineffective, the primary objective is to remediate the deficiency by implementing corrective measures. PRMIA (Professional Risk Managers’ International Association) guidance, aligned with best practices in risk governance, emphasizes a structured approach to handling control deficiencies. Below is a detailed breakdown based on PRMIA risk management principles:
Step 1: Identify and Assess the Ineffective Control
A control is deemed ineffective when it fails to mitigate the identified risks to an acceptable level.
The root cause of the failure must be determined through a Control Effectiveness Review (CER).
PRMIA recommends control testing and incident analysis to assess the severity of the control failure.
Step 2: Develop an Action Plan to Address the Control Deficiency
PRMIA best practices state that risk management should prioritize corrective actions rather than delaying remediation.
The organization must define an action plan to close the gap, which includes:
Revising or strengthening the control mechanisms.
Implementing new controls, if necessary.
Assigning responsibility for remediation to control owners.
Setting deadlines for resolution.
This step aligns with PRMIA’s Risk Governance Framework, which emphasizes proactive risk management.
Step 3: Implement Corrective Measures and Monitor Progress
Once an action plan is designed, the organization should execute the corrective actions.
PRMIA’s Risk Monitoring Guidelines require regular follow-ups and testing to ensure the control is functioning correctly.
The effectiveness of the remediation should be validated through post-implementation review and ongoing control testing.
Step 4: Re-Assess Risks and Control Effectiveness
Once corrective measures are in place, the organization should re-evaluate risks to confirm that the issue is resolved.
The risk assessment process should be updated to reflect the changes in the control environment.
Why the Other Options Are Incorrect?
Option A: “Risks should be re-assessed to determine if there is the appropriate level of control assessment.” While risk re-assessment is a good practice, it does not directly address the ineffective control.
PRMIA guidelines prioritize closing the control gap first before reassessing risks.
Option C: “The controls should be re-assessed during the next cycle to determine if they are still ineffective.” Waiting until the next assessment cycle delays remediation, which could expose the organization to unmitigated risks.
PRMIA risk frameworks recommend immediate corrective action when a control is found to be ineffective.
Option D: “Risks should be re-assessed to determine if there can be an exception for the level of control assessment.” PRMIA does not support exceptions for ineffective controls unless there is a well-documented risk acceptance process.
A control failure should be remediated rather than seeking exceptions.
PRMIA Risk Reference Used:
PRMIA Risk Governance Framework – Defines the importance of immediate corrective actions for control failures.
PRMIA Risk Monitoring Guidelines – Stresses continuous monitoring and validation of controls.
PRMIA Risk Management Standards – Recommends a structured action plan for ineffective controls.
PRMIA Operational Risk Framework – Emphasizes the need to close control gaps to maintain a strong risk posture.
Final Conclusion:
According to PRMIA risk management best practices, when a control is found to be ineffective, the best course of action is to design and implement an action plan to remediate the issue (Option B). This approach ensures that the organization mitigates risk promptly and maintains a strong control environment.

Step 1: What Is the Turnbull Report?
The Turnbull Report (1999) was a UK corporate governance report that set risk management expectations for boards.
It required companies to assess and manage risks effectively as part of corporate governance.
Step 2: Why Option C is Correct
Turnbull was the first report to mandate that boards must consider risk management in corporate governance.
This report established risk assessment as a board-level responsibility.
Step 3: Why the Other Options Are Incorrect
Option A (“Defined risk governance for insurance”) → Incorrect because Turnbull applied to all sectors, not just insurance.
Option B (“First report to propose board structure”) → Incorrect because corporate boards existed long before Turnbull.
Option D (“Led to the US Federal Reserve”) → Incorrect because the Federal Reserve was established in 1913, long before Turnbull.
PRMIA Risk Reference Used:
PRMIA Corporate Governance Guidelines – Highlights Turnbull’s role in board-level risk oversight.
UK Corporate Governance Code – Turnbull contributed to defining board risk responsibilities.
Final Conclusion:
The Turnbull Report was the first to require boards to consider risks in corporate governance, making Option C the correct answer.

Team supervisors play a critical role in shaping and maintaining an organization’s risk culture. PRMIA’s Risk Governance Framework and Risk Culture Principles emphasize that supervisors act as the link between risk policies and frontline employees, ensuring that risk-aware behaviors are consistently followed.
Step 1: Role of Supervisors in Risk Culture Development
Supervisors engage with employees daily, providing guidance on risk-based decision-making.
They reinforce risk policies, standards, and expectations set by senior management.
Supervisors identify behavioral trends that may indicate risk culture weaknesses.
Step 2: Supervisors as Enforcers of Risk Culture
PRMIA’s Risk Culture Framework stresses that risk culture must be embedded into daily operations through supervisor-led enforcement.
Supervisors monitor, correct non-compliant behaviors, and provide ongoing risk awareness training.
Their proximity to employees allows them to detect early warning signs of risk issues.
Step 3: Why the Other Options Are Incorrect
Option A: “More experienced than the employees that report to them.”
Experience alone does not establish or maintain a risk culture.
A risk culture is about behaviors and practices, not just expertise.
Option B: “Visible to regulators and can describe the firm’s risk culture to inspection teams.” While supervisors may interact with regulators, their primary role is to engage with employees daily rather than acting as spokespersons.
Option D: “Visible to regulators and can describe the firm’s risk culture to their board.” Boards typically rely on Chief Risk Officers (CROs) or senior executives to communicate risk culture, not direct supervisors.
PRMIA Risk Reference Used:
PRMIA Risk Culture Framework – Highlights the role of supervisors in ensuring risk-aware behaviors.
PRMIA Risk Governance Framework – Stresses that frontline supervisors must enforce risk management policies.
PRMIA Risk Awareness Guidelines – Reinforces daily interaction as a key factor in maintaining a strong risk culture.
Final Conclusion:
Supervisors directly influence employees’ behaviors and ensure that risk culture is consistently followed, making Option C the correct answer.

The Internal Loss Multiplier (ILM) is a key component of the Basel III Standardized Approach for Operational Risk. It is designed to adjust capital requirements based on a bank’s historical loss experience.
Definition of ILM
ILM is a scaling factor that adjusts the operational risk capital requirement based on a bank’s internal loss history.
It is derived using a formula that incorporates historical operational risk losses relative to a bank’s revenue.
Why ILM Exists in Basel III
Basel III replaced the Advanced Measurement Approach (AMA) with a Standardized Approach that includes ILM to ensure that banks with high historical losses hold more capital for operational risk.
Why Other Answers Are Incorrect
Option
Explanation:
A . It is a financial-statement-based proxy for operational risk.
Incorrect – ILM is not a general financial statement proxy; it specifically adjusts capital based on past operational losses.
B . It is a non-financial factor that is based on a bank’s average historical losses.
Incorrect – ILM is financial in nature because it directly influences capital requirements.
D . It is uniform, and is used for indicating consistent incidents on an average return basis.
Incorrect – ILM is not uniform; it is bank-specific and varies based on loss history.
PRMIA Reference for Verification
PRMIA Operational Risk Standards
Basel III Standardized Approach for Operational Risk

Definition of Consumer Protection in Risk Management
Consumer protection ensures ethical business practices, transparency, and regulatory compliance.
It builds trust with customers and reduces legal and reputational risks.
Key Principles of Consumer Protection
Treating customers fairly → Ensures honest and ethical financial services.
Prioritizing customer interests → Prevents conflicts of interest and unfair treatment.
Honoring commitments → Strengthens customer confidence and regulatory trust.
Why Answer C is Correct
Following these principles ensures regulatory compliance, customer satisfaction, and risk mitigation.
Why Other Answers Are Incorrect
Option
Explanation:
A . Engage with consumers once there are enough complaints.
Incorrect – Proactive engagement is essential; waiting for complaints is a reactive and poor risk management approach.
B . Add a consumer protection section to all reports.
Incorrect – Documentation alone does not ensure fair treatment; actions matter more.
D . This risk cannot be managed.
Incorrect – Consumer protection risks can and should be actively managed.
PRMIA Reference for Verification
PRMIA Consumer Protection & Fair Treatment Standards
Financial Conduct Authority (FCA) Consumer Duty Guidelines

A Chief Risk Officer (CRO) plays a crucial role in shaping and strengthening the risk culture within an organization. PRMIA defines risk culture as the shared values, beliefs, knowledge, and understanding about risk that drive behaviors within an institution.
Setting a Clear Vision
The CRO should communicate a vision of risk management that aligns with organizational goals while ensuring that risk-taking remains within acceptable limits.
The vision should be achievable and realistic, rather than overly ambitious, which could incentivize reckless risk-taking.
Embedding Risk Awareness into Decision-Making
A strong risk culture ensures that risk considerations are embedded into business decision-making rather than treated as a separate compliance exercise.
This is supported by PRMIA’s Enterprise Risk Management (ERM) Framework, which stresses integrating risk management into strategy and operations.
Avoiding a Blame Culture
A risk-aware organization promotes accountability without fear, enabling employees to report risks without retribution.
Option B (Discourage personal accountability to avoid a blame culture) is incorrect because personal accountability is essential for a healthy risk culture.
Avoiding a Strict, Prescriptive Approach
A set of rigid objectives that must be followed by the executive team (Option C) does not foster a dynamic, evolving risk culture.
Instead, risk culture should be flexible and adaptive to emerging risks.
Balancing Incentives and Consequences
While balancing rewards with penalties (Option D) is part of governance, a strong risk culture is not built solely through fear of punishment.
PRMIA emphasizes positive reinforcement, such as linking risk management behaviors to performance evaluations and incentives.
PRMIA Reference for Verification
PRMIA Risk Governance Framework – Discusses the role of leadership in shaping risk culture.
PRMIA Standards on Enterprise Risk Management (ERM) – Covers best practices for embedding risk culture within organizations.

Step 1: Definition of Material Customer Detriment
Material customer detriment refers to service disruptions that cause financial loss, inability to access essential services, or significant hardship.
PRMIA and UK FCA Operational Resilience Standards define “significant harm” as going beyond inconvenience to include monetary or operational distress.
Step 2: Why Option D is Correct
Significant harm occurs when customers face tangible financial or service losses, not just reputational inconvenience.
Regulatory frameworks (e.g., Basel, FCA, PRMIA) require banks to protect customers from material disruptions.
Step 3: Why the Other Options Are Incorrect
Option A (“Low threshold, any complaint”) → Incorrect because not all complaints indicate material detriment.
Option B (“Inconvenience and reputational damage”) → Incorrect because true material harm is more than just inconvenience.
Option C (“Financial system resilience”) → Incorrect because this describes systemic financial stability, not customer impact.
PRMIA Risk Reference Used:
PRMIA Operational Resilience Framework – Defines material customer detriment.
UK FCA Operational Resilience Guidelines – Requires firms to minimize severe harm to customers.
Final Conclusion:
Material customer detriment involves actual financial hardship, not just inconvenience, making Option D the correct answer.

Impact Tolerance is a key concept in Operational Resilience, defined as the ability of a firm to withstand, respond to, and recover from disruptions. According to PRMIA and global regulatory frameworks (such as the Bank of England’s Operational Resilience Framework), impact tolerance is specifically tied to business services rather than processes.
Step 1: Defining Impact Tolerance
Impact tolerance is the maximum acceptable level of disruption to an important business service, beyond which there would be intolerable harm to customers, financial markets, or regulatory obligations.
It is not the same as risk appetite or risk capacity, as those deal with broader organizational risk exposure.
Step 2: Why Business Services Matter
PRMIA defines business services as end-to-end services delivered to clients and stakeholders, such as payments processing, trade execution, or loan approvals.
Disruptions to these services directly impact customers and financial stability, making business service resilience the core focus of impact tolerance.
Step 3: Why the Other Options Are Incorrect
Option A (“tolerance for disruption to a particular business process”)
Incorrect because impact tolerance applies to services, not just internal processes.
Option C (“a firm’s risk appetite statement”)
Incorrect because risk appetite focuses on how much risk a firm is willing to take, while impact tolerance is about surviving disruptions.
Option D (“a firm’s risk capacity statement”)
Incorrect because risk capacity is the maximum level of risk a firm can bear, which is broader than business service disruptions.
PRMIA Risk Reference Used:
PRMIA Operational Resilience Guidelines – Defines impact tolerance as a service-based metric.
Bank of England’s Operational Resilience Framework – Establishes impact tolerance as a limit on business service disruption.
Final Conclusion:
Impact tolerance focuses on business services, not just internal processes or risk appetite, making Option B the correct answer.

Definition of DORA
The Digital Operational Resilience Act (DORA) is a regulation by the European Union (EU) aimed at strengthening the digital resilience of financial institutions.
It establishes a regulatory framework for managing information and communication technology (ICT) risks in the financial sector.
Key Objectives of DORA
Ensures that financial institutions can withstand, respond to, and recover from cyber threats and ICT-related disruptions.
Introduces standards for risk management, incident reporting, and third-party ICT risk oversight.
Why Other Answers Are Incorrect
Option
Explanation:
A . Domain for Operational Risk Act.
Incorrect – No such regulation exists under this name.
B . Digital Operational Risk Act.
Incorrect – The official name is Digital Operational Resilience Act (DORA).
C . Daily Operational Resilience Act.
Incorrect – DORA is not focused on daily operations but rather long-term digital resilience.
PRMIA Reference for Verification
PRMIA Risk Governance & Digital Resilience Standards
European Commission’s Official DORA Regulation

PRMIA’s 10 Principles of Good Governance
PRMIA outlines 10 key principles that focus on risk governance, accountability, transparency, and risk management effectiveness.
These principles ensure strong risk governance structures for financial institutions.
Why Answer B is Correct
Holding the PRM Designation (Professional Risk Manager certification) is NOT a governance principle.
While PRMIA promotes risk education, governance principles focus on organizational risk structures, not individual certifications.
Why Other Answers Are Incorrect
Option
Explanation:
A . Risk appetite.
Correct – PRMIA governance principles include establishing a clear risk appetite.
C . External validation.
Correct – External audits and validation improve governance and risk transparency.
D . Clear accountability.
Correct – Governance principles emphasize clear accountability at all levels of management.
PRMIA Reference for Verification
PRMIA 10 Principles of Good Governance
Basel Corporate Governance Guidelines for Financial Institutions

Step 1: Compliance Function and the Three Lines of Defense Model
The Three Lines of Defense (3LoD) model ensures that risk management responsibilities are properly segregated:
First Line: Business units (own and manage risk).
Second Line: Compliance and risk management (independent oversight).
Third Line: Internal audit (provides assurance).
Step 2: Why Compliance Must Be Independent
PRMIA and Basel Compliance Principles state that compliance should not report to business units, as this creates a conflict of interest.
Compliance must be independent to ensure objective oversight of regulatory adherence.
Step 3: Why the Other Options Are Incorrect
Option A (“Report to the business”) → Incorrect because compliance must provide independent oversight, not report to business units.
Option C (“Outsource compliance if risk function exists”) → Incorrect because compliance and risk functions have distinct roles.
Option D (“Outsource risk if compliance exists”) → Incorrect because risk management is a core function, not an outsourcing candidate.
PRMIA Risk Reference Used:
PRMIA Compliance Risk Governance – States compliance must be independent under the Three Lines of Defense model.
Basel Compliance Principles – Recommends separate reporting structures for compliance and business units.
Final Conclusion:
Compliance must be independent from the business to avoid conflicts of interest, making Option B the correct answer.

Step 1: Role of a Risk Assessment Facilitator
The facilitator’s main role is to guide discussions without bias, ensuring objective risk identification.
PRMIA’s Risk Governance Framework highlights neutral facilitation as key to effective risk workshops.
Step 2: Why Option C Is Correct
Objectivity ensures unbiased risk assessment.
Expressing personal opinions can influence risk ratings, leading to distorted outcomes.
Step 3: Why the Other Options Are Incorrect
Option A (“Guide the workshop toward a pre-determined conclusion”)
Incorrect because risk workshops should discover risks, not confirm pre-set beliefs.
Option B (“Attendees can override results”)
Incorrect as risk results should be evidence-based, not subject to override.
Option D (“Attend via video connection”)
Incorrect as facilitators must engage actively, making remote facilitation less effective.
PRMIA Risk Reference Used:
PRMIA Risk Governance Framework – Stresses objectivity in risk assessment facilitation.
PRMIA Risk Identification Best Practices – Encourages unbiased workshops.
Final Conclusion:
Facilitators must remain neutral and objective, making Option C the correct answer.

Process Mapping is a risk management tool used to visualize workflows, identify inefficiencies, and detect control gaps. PRMIA defines process mapping as an essential operational risk management tool.
Step 1: Understanding Process Mapping
Helps analyze complex, process-intensive activities (Option A).
Reveals control weaknesses that could lead to operational risks (Option B).
Improves hand-offs and collaboration between teams (Option C).
Step 2: Why “All of the Above” is Correct
Process mapping serves multiple risk management purposes, making all listed options valid.
PRMIA Risk Reference Used:
PRMIA Operational Risk Management Guidelines – Recommends process mapping to identify inefficiencies and control gaps.
PRMIA Risk Governance Framework – Encourages visualization tools for process improvement.
Final Conclusion:
Process mapping improves risk awareness, identifies control gaps, and enhances operational workflows, making Option D the correct answer.

Definition of DORA
The Digital Operational Resilience Act (DORA) is a regulation by the European Union (EU) aimed at strengthening the digital resilience of financial institutions.
It establishes a regulatory framework for managing information and communication technology (ICT) risks in the financial sector.
Key Objectives of DORA
Ensures that financial institutions can withstand, respond to, and recover from cyber threats and ICT-related disruptions.
Introduces standards for risk management, incident reporting, and third-party ICT risk oversight.
Why Other Answers Are Incorrect
Option
Explanation:
A . Domain for Operational Risk Act.
Incorrect – No such regulation exists under this name.
B . Digital Operational Risk Act.
Incorrect – The official name is Digital Operational Resilience Act (DORA).
C . Daily Operational Resilience Act.
Incorrect – DORA is not focused on daily operations but rather long-term digital resilience.
PRMIA Reference for Verification
PRMIA Risk Governance & Digital Resilience Standards
European Commission’s Official DORA Regulation

Best Practices for Policy Development
Policies should be clearly written, well-structured, and accompanied by training to ensure employees understand their responsibilities.
PRMIA governance principles emphasize the need for training to enhance compliance and operational effectiveness.
Why Answer D is Correct
Training ensures policy adoption and understanding across the organization.
Integrating policies into new employee training helps embed governance and compliance culture.
Why Other Answers Are Incorrect
Option
Explanation:
A . Policies should be divided into a large number of short topics to enhance accessibility.
Incorrect – While policies should be structured for readability, excessive fragmentation can lead to confusion and inefficiency.
B . Policy owners must ensure that policies are read by the regulator and then the shareholders.
Incorrect – Policies are internal governance tools, not primarily for regulators or shareholders.
C . Hard copies of a new policy should be placed in a central library of governance documents at the CRO’s home.
Incorrect – Policies should be centrally available within the organization, not at a personal location.
PRMIA Reference for Verification
PRMIA Governance Best Practices
ISO 31000 Risk Management Standards

Step 1: Definition of the Business Indicator (BI) in Basel III
The Business Indicator (BI) is a financial-statement-based metric used in Basel III’s Standardized Approach for Operational Risk.
It replaces previous approaches by using financial figures (e.g., revenue, fees, interest income) to estimate operational risk exposure.
Step 2: Why Option D Is Correct
The BI uses financial-statement data to calculate operational risk capital requirements.
It acts as a proxy for a bank’s operational risk exposure by linking operational risk to its financial size and complexity.
Step 3: Why the Other Options Are Incorrect
Option A (“Proxy for near-miss events”) → Incorrect because BI is based on financial data, not near-miss risk events.
Option B (“Non-financial-statement-based proxy”) → Incorrect because BI is explicitly derived from financial statements.
Option C (“Scaling factor based on historical losses”) → Incorrect because BI does not use historical losses directly-it relies on financial-statement inputs.
PRMIA Risk Reference Used:
Basel III Operational Risk Framework – Defines the Business Indicator as a financial-statement-based metric.
PRMIA Operational Risk Guidelines – Explains the BI’s role in capital calculations.

The National Australia Bank (NAB) FX Options Case Study is a well-known example of operational risk, fraud, and governance failure.
What Happened?
Traders engaged in unauthorized foreign exchange (FX) options trading, using deep-in-the-money options and other complex instruments.
They manipulated profits and losses to smooth earnings and mislead risk managers and auditors.
Why Answer C is Correct
The traders smoothed both profits and losses to avoid detection and ensure continued trading bonuses.
This aligns with PRMIA’s Operational Risk Management Guidelines, which highlight that hidden trading losses and smoothing techniques increase financial crime risk.
Why Other Answers Are Incorrect
Option
Explanation:
A . Complex structured transactions aided in the smoothing of losses.
Incorrect – Smoothing occurred with both profits and losses, not just losses.
B . Deep-in-the-money options and other complex structured transactions aided in the smoothing of losses.
Incorrect – Profits were also manipulated, making this answer incomplete.
D . Deep-in-the-money options aided in the smoothing of losses.
Incorrect – This focuses only on deep-in-the-money options and ignores other structured transactions involved in the fraud.
PRMIA Reference for Verification
PRMIA Fraud and Risk Management Case Studies
Basel Principles on Market Risk and Internal Control Failures

Step 1: Understanding the Northern Rock Case Study
Northern Rock was a UK bank that collapsed in 2007 due to its heavy reliance on short-term wholesale funding rather than customer deposits.
When the 2007 financial crisis hit, the inter-bank lending market and commercial paper market froze, cutting off Northern Rock’s access to liquidity.
Step 2: Why Option C Is Correct
Northern Rock depended on short-term borrowing to fund long-term mortgage lending.
When the liquidity crisis hit, it couldn’t refinance its debt, leading to a bank run and collapse.
The Bank of England had to intervene, and the UK government nationalized Northern Rock in 2008.
Step 3: Why the Other Options Are Incorrect
Option A (“Acquisition of Merrill Lynch”) → Incorrect because this happened in 2008, after Northern Rock’s failure.
Option B (“Withdrawal of Deposit Protection”) → Incorrect because UK deposit protection remained in place.
Option D (“Real estate exposure in Berlin”) → Incorrect because Northern Rock’s problem was funding liquidity, not real estate losses.
PRMIA Risk Reference Used:
PRMIA Liquidity Risk Management Framework – Describes how liquidity shocks impact banks like Northern Rock.
Basel III Liquidity Coverage Ratio (LCR) Standards – Created after Northern Rock to prevent similar liquidity crises.
Final Conclusion:
The collapse of the inter-bank and commercial paper markets was the key low-probability-high-impact event that led to Northern Rock’s failure, making Option C the correct answer.

Step 1: What is the TCFD?
The Task Force on Climate-related Financial Disclosures (TCFD) was established to develop climate-related financial risk disclosure recommendations to help investors, lenders, and regulators make informed decisions.
Step 2: Who Founded the TCFD?
The Financial Stability Board (FSB), an international organization that monitors and makes recommendations about the global financial system, founded the TCFD in 2015.
The FSB recognized climate risk as a financial stability issue and launched the TCFD to standardize reporting.
Step 3: Why the Other Options Are Incorrect
Option A (“World Bank”) → Incorrect because the World Bank supports climate initiatives but did not create the TCFD.
Option B (“United Nations”) → Incorrect because the UN has climate programs like the UNFCCC, but not the TCFD.
Option D (“European Commission”) → Incorrect because the EC develops its own sustainability regulations (e.g., SFDR, CSRD), separate from the TCFD.
PRMIA Risk Reference Used:
PRMIA Climate Risk Guidelines – Cites FSB’s role in founding the TCFD.
FSB Official Reports (2015) – Confirms that the FSB established the TCFD.
Final Conclusion:
The FSB founded the TCFD in 2015, making Option C the correct answer.

Overview of the National Australia Bank (NAB) FX Options Case Study
Traders at National Australia Bank (NAB) engaged in unauthorized foreign exchange (FX) options trading.
They smoothed profits and concealed losses using fictitious transactions and manipulated reporting.
This led to a major financial scandal and loss of investor confidence.
Key Findings of the Investigation
Traders artificially smoothed profits to avoid drawing attention to large fluctuations.
Losses were concealed from internal risk controls by manipulating trade records.
The bank’s risk management and governance controls failed to detect and prevent these activities.
Why Other Answers Are Incorrect
Option
Explanation:
A . Currency traders were allowed access to the risk system by the CEO.
Incorrect – No evidence suggests CEO involvement in granting system access.
B . Currency traders concealed losses using back-office knowledge.
Incorrect – While they concealed losses, they also smoothed profits to manipulate earnings trends.
D . Currency traders were able to complete a Management Buy Out (MBO).
Incorrect – This event was not related to a Management Buyout (MBO); it was a trading scandal.
PRMIA Reference for Verification
PRMIA Fraud and Risk Management Case Studies
Basel Principles on Market Risk and Internal Control Failures

Step 1: Understanding OFAC
OFAC (Office of Foreign Assets Control) is a U.S. Treasury Department agency responsible for enforcing economic and trade sanctions based on U.S. foreign policy and national security goals.
It prevents financial crime by restricting transactions with sanctioned individuals, entities, and countries.
Step 2: Role of OFAC in Financial Crime Prevention
OFAC administers sanctions to prevent money laundering, terrorism financing, and other illicit activities.
Financial institutions must comply with OFAC regulations to avoid heavy fines and reputational damage.
PRMIA’s Financial Crime Risk Guidelines emphasize the importance of OFAC compliance in risk management.
Step 3: Why the Other Options Are Incorrect
Option A (“Office of Financial Asset Control”) – Incorrect wording; OFAC deals with foreign assets, not just financial assets.
Option B (“Office of Foreigner and Other Control”) – OFAC does not regulate foreigners broadly; it targets specific foreign assets and transactions.
Option C (“Office for Asset Control”) – Missing “Foreign”, which is critical to OFAC’s function.
PRMIA Risk Reference Used:
PRMIA Financial Crime Risk Management Guidelines – Emphasizes regulatory compliance with OFAC.
PRMIA Compliance and Sanctions Risk Standards – Stresses the role of OFAC in preventing illicit financial activities.
Final Conclusion:
OFAC stands for the Office of Foreign Assets Control, making Option D the correct answer.

Step 1: Key Elements of a Well-Designed Policy Document
A well-designed policy should include:
Scope – Who the policy applies to.
Exception Handling – How and where exceptions should be requested.
Accountability – Who is responsible for enforcement.
Step 2: Why Option C is Correct
A policy must clearly define exceptions and the process for requesting them.
It should also define areas where the policy does not apply to avoid confusion.
Step 3: Why the Other Options Are Incorrect
Option A (“List of exceptions for board members’ families”) → Incorrect because policies should apply consistently to all stakeholders.
Option B (“List of acceptable fonts and margin types”) → Incorrect because formatting is secondary to content clarity.
Option D (“To whom the policy applies and an additional management report”) → Incorrect because policy scope should not include unnecessary reports.
PRMIA Risk Reference Used:
PRMIA Policy Writing Guidelines – Defines policy structure and exception handling.
ISO 19600 Compliance Management Standard – Supports clear, well-documented policies.
Final Conclusion:
A well-designed policy clearly defines exceptions and their handling process, making Option C the correct answer.

Definition of Key Risk Indicators (KRIs)
KRIs are quantitative metrics used to monitor risk levels and detect early warning signs of potential risk events.
Top-down KRIs are identified at the senior management level and focus on enterprise-wide risk exposure.
Key Properties of Top-Down KRIs
Selected by senior management to ensure alignment with strategic objectives.
Tied to material external and internal loss exposures to capture critical financial, operational, and strategic risks.
Used to manage changes in the business environment to ensure proactive risk response, especially under stress conditions.
Why Other Answers Are Incorrect
Option
Explanation:
B . Selected by senior management, used to manage changes in the business environment, especially under periods of stress, and reported on a daily basis.
Incorrect – Top-down KRIs are not reported daily; they are monitored periodically (e.g., quarterly).
C . Selected by junior management, used to manage changes in the business environment, especially under periods of stress, and reported on an annual basis.
Incorrect – Junior management does not define top-down KRIs; senior management does. Also, annual reporting is too infrequent.
D . Can only be selected by the board in line with risk ratings.
Incorrect – The board provides oversight, but senior risk management selects KRIs, not just the board.
PRMIA Reference for Verification
PRMIA Risk Indicator Guidelines
Basel Committee on Banking Supervision (BCBS) Principles for Effective Risk Data Aggregation