Question 1

Risk Capacity for a bank is defined as the:

AAmount of risk the bank wishes to take.

BAmount of risk the regulator sets for the bank.

CAbility to withstand an extreme event and make a profit.

DAbility to suffer an extreme event with an orderly wind up with only shareholders losing money.

Answer : D

Step 1: Definition of Risk Capacity

Risk Capacity refers to the maximum level of risk a bank can absorb while still maintaining orderly operations or, in extreme cases, conducting an orderly resolution.

PRMIA and Basel III define risk capacity as a bank's ability to absorb losses in a crisis without systemic consequences.

Step 2: Why Option D Is Correct

The ultimate test of a bank's risk capacity is whether it can survive an extreme shock without harming depositors or financial markets.

Regulators ensure that a bank can be wound up in an orderly manner so that only shareholders lose money, while depositors and creditors remain protected under resolution planning frameworks.

Step 3: Why the Other Options Are Incorrect

Option A ('Amount of risk the bank wishes to take')

Incorrect because this describes Risk Appetite, not Risk Capacity.

Option B ('Amount of risk the regulator sets for the bank')

Incorrect because regulators set capital requirements, but the bank's actual risk capacity is based on its own capital structure and business model.

Option C ('Ability to withstand an extreme event and make a profit')

Incorrect because risk capacity is about survival, not profit-making during extreme events.

PRMIA Risk Reference Used:

Basel III Risk Capacity Standards -- Defines the ability to absorb losses during crises.

PRMIA Risk Governance Framework -- Describes how banks should manage risk capacity through capital buffers.

Final Conclusion:

Banks must be able to withstand an extreme event and conduct an orderly wind-up if necessary, ensuring that only shareholders bear the loss, making Option D the correct answer.

Question 2

ISO 27000 relates to what topic / area?

AEnvironmental, social, and governance (ESG) investing.

BInformation Security Systems.

CInternational Risk Management.

DAuditing of financial controls.
Step 1: Definition of ISO 27000
ISO 27000 is a global standard for information security management systems (ISMS), issued by the International Organization for Standardization (ISO).
It provides a framework for protecting sensitive information through policies, controls, and risk management practices.
Step 2: Why Option B Is Correct
ISO 27001 (part of ISO 27000 series) is one of the most widely recognized certifications for information security governance.
It sets guidelines on risk assessment, incident response, and data protection.
Step 3: Why the Other Options Are Incorrect
Option A ('ESG investing')
Incorrect because ISO 27000 deals with cybersecurity, not environmental, social, and governance (ESG) issues.
Option C ('International Risk Management')
Incorrect because ISO 27000 focuses on information security, not general risk management.
Option D ('Auditing of financial controls')
Incorrect because financial auditing standards (e.g., SOX, COSO) are separate from information security standards.
PRMIA Risk Reference Used:
ISO 27000 Series Documentation -- Defines cybersecurity risk management practices.
PRMIA IT Risk Governance Framework -- Reference ISO 27001 as a cybersecurity standard.

Answer : B

Question 3

For the TSB case what was the cause of the outage at the heart of the case?

AA liquidity squeeze by a major hedge-fund via margin calls on trading positions resulted in the collapse of their website.

BSub-standard risk pricing and risk management left millions of people locked out of their accounts for weeks.

CA failed attempts to move customers to a new IT system left millions of people locked out of their accounts for weeks.

DTheir IT models did not work if prices were discontinuous.

Answer : C

Step 1: Understanding the TSB Case

The TSB outage in 2018 was caused by a failed IT migration from its old banking system to a new one.

The transition locked millions of customers out of their accounts for weeks, resulting in financial losses and reputational damage.

Step 2: Why Option C Is Correct

TSB attempted to move customer data to a new banking platform, but serious defects in the migration process led to service failures.

PRMIA and UK Financial Conduct Authority (FCA) reports confirmed that poor IT risk management was a key failure.

Step 3: Why the Other Options Are Incorrect

Option A ('Liquidity squeeze by hedge-fund')

Incorrect because TSB's failure was due to IT migration issues, not a liquidity crisis.

Option B ('Sub-standard risk pricing and risk management')

Incorrect because pricing models were not the cause---it was an IT system failure.

Option D ('IT models did not work if prices were discontinuous')

Incorrect as this issue is more common in high-frequency trading failures, not banking system outages.

PRMIA Risk Reference Used:

UK FCA Investigation on TSB Incident -- Confirms IT migration failure as root cause.

PRMIA IT Risk Management Framework -- Highlights risks of major IT transitions.

Final Conclusion:

The TSB outage was caused by a failed IT migration, making Option C the correct answer.

Question 4

Compliance departments traditionally provide policy, oversight, and set the standards for monitoring personal dealing. Which control below would assist in implementing such policies?

AA list of approved suppliers that have been added to the outsourcing policy.

BOutsourcing of the policy writing to an accounting firm at least once every 5 years.

CWatch lists of stocks that are not allowed to be traded for a period of time, for instance, ahead of a securities offering that the firm is managing.

DOutsourcing of the policy writing to an accounting firm at least once every 3 years.

Answer : C

Definition of DORA

The Digital Operational Resilience Act (DORA) is a regulation by the European Union (EU) aimed at strengthening the digital resilience of financial institutions.

It establishes a regulatory framework for managing information and communication technology (ICT) risks in the financial sector.

Key Objectives of DORA

Ensures that financial institutions can withstand, respond to, and recover from cyber threats and ICT-related disruptions.

Introduces standards for risk management, incident reporting, and third-party ICT risk oversight.

Why Other Answers Are Incorrect

Option

Explanation

A . Domain for Operational Risk Act.

Incorrect -- No such regulation exists under this name.

B . Digital Operational Risk Act.

Incorrect -- The official name is Digital Operational Resilience Act (DORA).

C . Daily Operational Resilience Act.

Incorrect -- DORA is not focused on daily operations but rather long-term digital resilience.

PRMIA Reference for Verification

PRMIA Risk Governance & Digital Resilience Standards

European Commission's Official DORA Regulation

Question 5

For credit risk losses containing operational risk elements that have been historically included in an organizations' credit risk database how should the loss amount be treated?

AThe entire loss amount is treated as credit risk

BThe entire loss amount is treated as operational risk.

CThe loss amount is split into credit and operational risk components.

DThe entire loss amount is treated as credit risk, but the loss is entered as a memorandum within the operational loss database and not used for capital modeling purposes.

Answer : C

Understanding Credit Risk and Operational Risk Overlap

In some cases, credit risk losses contain elements of operational risk, such as fraud, documentation errors, or IT failures affecting credit transactions.

Basel II and III frameworks require institutions to distinguish between pure credit risk losses and operational risk components within those losses.

Treatment of Losses

The credit-related portion is accounted for under credit risk capital calculations.

The operational risk portion (e.g., fraud-related losses) should be classified separately and included in operational risk databases for risk measurement.

Why Answer C is Correct

Basel III and PRMIA recommend a clear split between credit risk and operational risk components to ensure accurate risk modeling.

If operational risk elements are ignored, an organization may underestimate its true operational risk exposure.

Why Other Answers Are Incorrect

Option

Explanation

A . The entire loss amount is treated as credit risk.

Incorrect -- This ignores operational risk components that should be accounted for separately.

B . The entire loss amount is treated as operational risk.

Incorrect -- Credit risk losses are typically dominant in lending-related losses and should not be fully classified as operational risk.

D . The entire loss amount is treated as credit risk, but the loss is entered as a memorandum within the operational loss database and not used for capital modeling purposes.

Incorrect -- The operational risk portion must be considered for capital modeling, not just recorded as a memo.

PRMIA Reference for Verification

Basel II & III Guidelines on Credit and Operational Risk Integration

PRMIA Operational Risk Framework

Free Practice Questions for PRMIA 8020 Exam

Question 1

Question 2

Question 3

Question 4

Question 5