[Mar 12, 2026] Fully Updated 8020 Dumps – 100% Same Q&A In Your Real Exam [Q32-Q56]

A Chief Risk Officer (CRO) plays a crucial role in shaping and strengthening the risk culture within an organization. PRMIA defines risk culture as the shared values, beliefs, knowledge, and understanding about risk that drive behaviors within an institution.
Setting a Clear Vision
The CRO should communicate a vision of risk management that aligns with organizational goals while ensuring that risk-taking remains within acceptable limits.
The vision should be achievable and realistic, rather than overly ambitious, which could incentivize reckless risk-taking.
Embedding Risk Awareness into Decision-Making
A strong risk culture ensures that risk considerations are embedded into business decision-making rather than treated as a separate compliance exercise.
This is supported by PRMIA’s Enterprise Risk Management (ERM) Framework, which stresses integrating risk management into strategy and operations.
Avoiding a Blame Culture
A risk-aware organization promotes accountability without fear, enabling employees to report risks without retribution.
Option B (Discourage personal accountability to avoid a blame culture) is incorrect because personal accountability is essential for a healthy risk culture.
Avoiding a Strict, Prescriptive Approach
A set of rigid objectives that must be followed by the executive team (Option C) does not foster a dynamic, evolving risk culture.
Instead, risk culture should be flexible and adaptive to emerging risks.
Balancing Incentives and Consequences
While balancing rewards with penalties (Option D) is part of governance, a strong risk culture is not built solely through fear of punishment.
PRMIA emphasizes positive reinforcement, such as linking risk management behaviors to performance evaluations and incentives.
PRMIA Reference for Verification
PRMIA Risk Governance Framework – Discusses the role of leadership in shaping risk culture.
PRMIA Standards on Enterprise Risk Management (ERM) – Covers best practices for embedding risk culture within organizations.

The Principles for Risk Governance, as established by PRMIA (Professional Risk Managers’ International Association), emphasize the Three Lines of Defense (3LoD) Model, which is widely used in risk management and governance frameworks.
Business Line Ownership of Risk (First Line of Defense)
The business units are responsible for identifying, assessing, managing, and monitoring risks within their operations.
Since they generate the risks through their activities, they must own the risk assessment process.
This aligns with PRMIA Governance Principles, which state that risk management should be embedded within business operations to ensure proactive risk identification and control.
Risk Management’s Role (Second Line of Defense)
The risk management function is not directly responsible for conducting risk assessments but plays a key role in designing and maintaining the risk assessment framework.
This includes setting standards, methodologies, and tools for assessing risks across business functions.
Risk management provides supervision and oversight, ensuring that risk assessments align with organizational policies and regulatory expectations.
Oversight from Senior Management & the Board (Third Line of Defense)
Internal audit (third line of defense) independently reviews and provides assurance that the risk management framework is effective and that risk assessments are conducted properly.
PRMIA’s Risk Governance Standards emphasize that internal audit should evaluate the effectiveness of the risk assessment framework without being involved in its direct execution.
Why Other Answers Are Incorrect
Option
Explanation:
A . Risk management, in its role as second line of defense, performs the risk assessment process from beginning to end. There is no business line involvement.
Incorrect – Risk management facilitates and oversees the risk assessment process, but the business must take ownership of the risks it generates.
C . Business owns the risk assessment process so risk management does not play a role in the process.
Incorrect – While the business owns the process, risk management plays a crucial role in developing the framework, setting policies, and providing oversight.
D . Business management’s role in the risk assessment process should be confined to oversight.
Incorrect – Business management is actively responsible for executing risk assessments, not just overseeing them.
PRMIA Reference for Verification
PRMIA Standards for Risk Governance – Establishes the Three Lines of Defense and the separation of responsibilities.
PRMIA Risk Management Framework (RMF) Guidelines – Defines the roles of business and risk management in risk assessment.
PRMIA Enterprise Risk Management Best Practices – Outlines how risk management facilitates risk assessments while the business retains ownership.
This answer is verified according to PRMIA’s official risk governance documents and best practices. Would you like additional clarification or supporting documentation references?

Process Mapping is a risk management tool used to visualize workflows, identify inefficiencies, and detect control gaps. PRMIA defines process mapping as an essential operational risk management tool.
Step 1: Understanding Process Mapping
Helps analyze complex, process-intensive activities (Option A).
Reveals control weaknesses that could lead to operational risks (Option B).
Improves hand-offs and collaboration between teams (Option C).
Step 2: Why “All of the Above” is Correct
Process mapping serves multiple risk management purposes, making all listed options valid.
PRMIA Risk Reference Used:
PRMIA Operational Risk Management Guidelines – Recommends process mapping to identify inefficiencies and control gaps.
PRMIA Risk Governance Framework – Encourages visualization tools for process improvement.
Final Conclusion:
Process mapping improves risk awareness, identifies control gaps, and enhances operational workflows, making Option D the correct answer.

Definition of Key Risk Indicators (KRIs)
KRIs are quantitative metrics used to monitor risk levels and detect early warning signs of potential risk events.
Top-down KRIs are identified at the senior management level and focus on enterprise-wide risk exposure.
Key Properties of Top-Down KRIs
Selected by senior management to ensure alignment with strategic objectives.
Tied to material external and internal loss exposures to capture critical financial, operational, and strategic risks.
Used to manage changes in the business environment to ensure proactive risk response, especially under stress conditions.
Why Other Answers Are Incorrect
Option
Explanation:
B . Selected by senior management, used to manage changes in the business environment, especially under periods of stress, and reported on a daily basis.
Incorrect – Top-down KRIs are not reported daily; they are monitored periodically (e.g., quarterly).
C . Selected by junior management, used to manage changes in the business environment, especially under periods of stress, and reported on an annual basis.
Incorrect – Junior management does not define top-down KRIs; senior management does. Also, annual reporting is too infrequent.
D . Can only be selected by the board in line with risk ratings.
Incorrect – The board provides oversight, but senior risk management selects KRIs, not just the board.
PRMIA Reference for Verification
PRMIA Risk Indicator Guidelines
Basel Committee on Banking Supervision (BCBS) Principles for Effective Risk Data Aggregation

Impact Tolerance is a key concept in Operational Resilience, defined as the ability of a firm to withstand, respond to, and recover from disruptions. According to PRMIA and global regulatory frameworks (such as the Bank of England’s Operational Resilience Framework), impact tolerance is specifically tied to business services rather than processes.
Step 1: Defining Impact Tolerance
Impact tolerance is the maximum acceptable level of disruption to an important business service, beyond which there would be intolerable harm to customers, financial markets, or regulatory obligations.
It is not the same as risk appetite or risk capacity, as those deal with broader organizational risk exposure.
Step 2: Why Business Services Matter
PRMIA defines business services as end-to-end services delivered to clients and stakeholders, such as payments processing, trade execution, or loan approvals.
Disruptions to these services directly impact customers and financial stability, making business service resilience the core focus of impact tolerance.
Step 3: Why the Other Options Are Incorrect
Option A (“tolerance for disruption to a particular business process”)
Incorrect because impact tolerance applies to services, not just internal processes.
Option C (“a firm’s risk appetite statement”)
Incorrect because risk appetite focuses on how much risk a firm is willing to take, while impact tolerance is about surviving disruptions.
Option D (“a firm’s risk capacity statement”)
Incorrect because risk capacity is the maximum level of risk a firm can bear, which is broader than business service disruptions.
PRMIA Risk Reference Used:
PRMIA Operational Resilience Guidelines – Defines impact tolerance as a service-based metric.
Bank of England’s Operational Resilience Framework – Establishes impact tolerance as a limit on business service disruption.
Final Conclusion:
Impact tolerance focuses on business services, not just internal processes or risk appetite, making Option B the correct answer.

Step 1: Definition of a Critical Business Service in Operational Resilience A Critical Business Service is one whose failure could result in severe harm to customers, financial markets, or the firm’s viability.
Regulators (e.g., Bank of England, Basel Committee, PRMIA) define three primary factors for identifying critical services:
Customer impact
Market integrity impact
Firm viability impact
Step 2: Why Option C Is Incorrect
Risk appetite is an internal business decision, not an external measure of criticality.
A service can be critical even if its disruption stays within risk appetite.
Criticality is based on external impacts, not just internal risk limits.
Step 3: Why the Other Options Are Correct
Option A (“Material customer detriment”) → Correct as customer harm defines critical services.
Option B (“Harm to market integrity”) → Correct as market stability is a regulatory priority.
Option D (“Threaten firm viability”) → Correct as critical services often determine business survival.
PRMIA Risk Reference Used:
PRMIA Operational Resilience Framework – Defines criteria for critical business services.
Basel Committee Operational Risk Guidelines – Highlights customer, market, and firm viability as resilience factors.
Final Conclusion:
Risk appetite is an internal benchmark, not a measure of critical service designation, making Option C the correct answer.

PRMIA’s 10 Principles of Good Governance
PRMIA outlines 10 key principles that focus on risk governance, accountability, transparency, and risk management effectiveness.
These principles ensure strong risk governance structures for financial institutions.
Why Answer B is Correct
Holding the PRM Designation (Professional Risk Manager certification) is NOT a governance principle.
While PRMIA promotes risk education, governance principles focus on organizational risk structures, not individual certifications.
Why Other Answers Are Incorrect
Option
Explanation:
A . Risk appetite.
Correct – PRMIA governance principles include establishing a clear risk appetite.
C . External validation.
Correct – External audits and validation improve governance and risk transparency.
D . Clear accountability.
Correct – Governance principles emphasize clear accountability at all levels of management.
PRMIA Reference for Verification
PRMIA 10 Principles of Good Governance
Basel Corporate Governance Guidelines for Financial Institutions

Step 1: Definition of Risk Capacity
Risk Capacity refers to the maximum level of risk a bank can absorb while still maintaining orderly operations or, in extreme cases, conducting an orderly resolution.
PRMIA and Basel III define risk capacity as a bank’s ability to absorb losses in a crisis without systemic consequences.
Step 2: Why Option D Is Correct
The ultimate test of a bank’s risk capacity is whether it can survive an extreme shock without harming depositors or financial markets.
Regulators ensure that a bank can be wound up in an orderly manner so that only shareholders lose money, while depositors and creditors remain protected under resolution planning frameworks.
Step 3: Why the Other Options Are Incorrect
Option A (“Amount of risk the bank wishes to take”)
Incorrect because this describes Risk Appetite, not Risk Capacity.
Option B (“Amount of risk the regulator sets for the bank”)
Incorrect because regulators set capital requirements, but the bank’s actual risk capacity is based on its own capital structure and business model.
Option C (“Ability to withstand an extreme event and make a profit”)
Incorrect because risk capacity is about survival, not profit-making during extreme events.
PRMIA Risk Reference Used:
Basel III Risk Capacity Standards – Defines the ability to absorb losses during crises.
PRMIA Risk Governance Framework – Describes how banks should manage risk capacity through capital buffers.
Final Conclusion:
Banks must be able to withstand an extreme event and conduct an orderly wind-up if necessary, ensuring that only shareholders bear the loss, making Option D the correct answer.

Step 1: Understanding the TSB Case
The TSB outage in 2018 was caused by a failed IT migration from its old banking system to a new one.
The transition locked millions of customers out of their accounts for weeks, resulting in financial losses and reputational damage.
Step 2: Why Option C Is Correct
TSB attempted to move customer data to a new banking platform, but serious defects in the migration process led to service failures.
PRMIA and UK Financial Conduct Authority (FCA) reports confirmed that poor IT risk management was a key failure.
Step 3: Why the Other Options Are Incorrect
Option A (“Liquidity squeeze by hedge-fund”)
Incorrect because TSB’s failure was due to IT migration issues, not a liquidity crisis.
Option B (“Sub-standard risk pricing and risk management”)
Incorrect because pricing models were not the cause-it was an IT system failure.
Option D (“IT models did not work if prices were discontinuous”)
Incorrect as this issue is more common in high-frequency trading failures, not banking system outages.
PRMIA Risk Reference Used:
UK FCA Investigation on TSB Incident – Confirms IT migration failure as root cause.
PRMIA IT Risk Management Framework – Highlights risks of major IT transitions.
Final Conclusion:
The TSB outage was caused by a failed IT migration, making Option C the correct answer.

Step 1: Role of a Risk Function
A Risk Function ensures that an organization follows best practices in risk governance, assessment, and control implementation.
It should be aligned with the board’s risk strategy and ensure independent oversight.
Step 2: Why Option B is Correct
The board sets the overall risk strategy, and the risk function implements risk controls accordingly.
PRMIA emphasizes board oversight as the guiding force behind risk management.
Step 3: Why the Other Options Are Incorrect
Option A (“Implement management’s direction”) → Incorrect because risk oversight should be board-driven, not solely management-driven.
Option C (“Ensure opinions are listened to”) → Incorrect because risk functions enforce policies, not just share opinions.
Option D (“Lower risk-taking to zero”) → Incorrect because risk-taking is necessary for growth-excessive risk aversion harms business.
PRMIA Risk Reference Used:
PRMIA Risk Governance Framework – Highlights board oversight in risk management.
Basel III Risk Management Standards – Emphasizes board-driven risk controls.
Final Conclusion:
The Risk Function must follow the board’s direction in implementing risk controls, making Option B the correct answer.

Step 1: Definition of Climate Risk
PRMIA and global financial regulators define climate risk as the financial, operational, and societal risks arising from climate change.
Climate risks impact businesses through physical risks (e.g., floods, wildfires) and transition risks (e.g., regulatory changes, carbon pricing).
Step 2: Why the Other Options Are Incorrect
Option A (“Climate risk has been moved out of all risk taxonomies due to international agreement”) Incorrect because climate risk is now a central part of risk taxonomies, as emphasized by PRMIA, Basel III, and TCFD.
Option B (“Climate risk refers to the growing impacts of credit risk on the business environment”) Incorrect because credit risk is just one aspect of climate risk, not the full definition.
Option C (“Climate risk refers to change in the business climate during a recession”) Incorrect because climate risk is about environmental change, not economic cycles.
PRMIA Risk Reference Used:
PRMIA Climate Risk Guidelines – Defines climate risk as a financial and societal risk due to climate change.
TCFD (Task Force on Climate-Related Financial Disclosures) – Outlines regulatory expectations for climate risk management.
Final Conclusion:
Climate risk involves physical and transition risks from climate change, making Option D the correct answer.

Overview of the National Australia Bank (NAB) FX Options Case Study
Traders at National Australia Bank (NAB) engaged in unauthorized foreign exchange (FX) options trading.
They smoothed profits and concealed losses using fictitious transactions and manipulated reporting.
This led to a major financial scandal and loss of investor confidence.
Key Findings of the Investigation
Traders artificially smoothed profits to avoid drawing attention to large fluctuations.
Losses were concealed from internal risk controls by manipulating trade records.
The bank’s risk management and governance controls failed to detect and prevent these activities.
Why Other Answers Are Incorrect
Option
Explanation:
A . Currency traders were allowed access to the risk system by the CEO.
Incorrect – No evidence suggests CEO involvement in granting system access.
B . Currency traders concealed losses using back-office knowledge.
Incorrect – While they concealed losses, they also smoothed profits to manipulate earnings trends.
D . Currency traders were able to complete a Management Buy Out (MBO).
Incorrect – This event was not related to a Management Buyout (MBO); it was a trading scandal.
PRMIA Reference for Verification
PRMIA Fraud and Risk Management Case Studies
Basel Principles on Market Risk and Internal Control Failures

Definition of Governance
Governance refers to the framework of policies, principles, and processes used to guide corporate decision-making and strategic direction.
It ensures accountability, transparency, and risk oversight within an organization.
Key Elements of Governance
Risk oversight – Ensuring risks are properly identified and managed.
Accountability structures – Defining roles and responsibilities.
Decision-making frameworks – Establishing policies for long-term corporate success.
Why Other Answers Are Incorrect
Option
Explanation:
A . Governance is a structure specifying the daily operation of a firm.
Incorrect – Governance focuses on high-level corporate oversight, not day-to-day operations.
B . Governance is a structure specifying the ways in which reporting is made to the primary regulator.
Incorrect – Governance is broader than just regulatory reporting.
C . Governance is being replaced by management in all firms that are regulated.
Incorrect – Governance and management are separate but complementary; governance provides oversight, while management executes strategy.
PRMIA Reference for Verification
PRMIA 10 Principles of Good Governance

Definition of Confidence Accounting
Confidence Accounting challenges traditional accounting by introducing probability distributions and ranges rather than fixed numbers for financial reporting.
This approach improves transparency and risk awareness by acknowledging uncertainty in financial figures.
Why Answer B is Correct
Encourages using ranges (confidence intervals) instead of discrete values to better reflect uncertainty.
Used in risk-sensitive industries where financial estimates vary due to external factors (e.g., credit risk, market fluctuations).
Why Other Answers Are Incorrect
Option
Explanation:
A . An approach that encourages companies and audit firms to have diverse boards.
Incorrect – Board diversity is unrelated to Confidence Accounting.
C . An approach that encourages companies and audit firms to use regular statements in their AI software.
Incorrect – AI may use probability models, but Confidence Accounting is an accounting methodology, not an AI approach.
D . An approach that encourages companies and audit firms to stop using figures and maths.
Incorrect – Confidence Accounting still relies on mathematical models; it does not eliminate numerical analysis.
PRMIA Reference for Verification
PRMIA Financial Risk Reporting Standards
IFRS (International Financial Reporting Standards) Guidelines on Probability-Based Accounting

Third-Party Risk Management (TPRM)
PRMIA highlights the importance of conducting thorough due diligence on third-party vendors and service providers.
This includes evaluating compliance programs, risk management frameworks, financial stability, strategic objectives, and operational history.
Key Areas of Third-Party Risk Assessment
Compliance and Risk Infrastructure → Ensures that the provider meets regulatory and security requirements.
Financial Health → Determines whether the provider has the financial stability to support long-term service delivery.
Business Strategy → Helps assess alignment with the organization’s risk appetite and goals.
Operating History → Evaluates experience and reliability in delivering services.
Why Other Answers Are Incorrect
Option
Explanation:
B . An assessment of a third party should not include its compliance and risk infrastructure, financials, business strategy, and operating history.
Incorrect – Ignoring these critical factors increases the risk of working with an unreliable vendor.
C . Onsite visits are not advantageous for understanding the third party’s risks and control environment.
Incorrect – Onsite visits are highly valuable as they provide first-hand insights into operational controls. PRMIA encourages risk managers to conduct site visits.
D . A review of the pay levels of the staff supporting the service.
Incorrect – Employee salaries are not a primary risk factor in vendor assessments. The focus should be on the vendor’s security, compliance, and operational risks.
PRMIA Reference for Verification
PRMIA Third-Party Risk Management (TPRM) Guidelines – Details best practices for vendor risk assessments.
Basel Principles on Outsourcing and Third-Party Risk – Provides regulatory guidance on evaluating third-party service providers.

Risk-sensitive pricing ensures that financial institutions and businesses properly account for risk in their pricing strategies to maintain stability and sustainability. PRMIA’s Risk Pricing and Capital Adequacy Guidelines define the importance of risk-sensitive pricing in ensuring fair compensation for risk exposure and avoiding risk concentration issues.
Step 1: Why Risk-Sensitive Pricing Is Important
Aligns risk with return: Pricing should be designed to reflect the underlying risk and return trade-off.
Protects investors: Investors expect compensation for capital at risk (Option A is correct).
Reinforces risk-aware culture: PRMIA promotes linking incentives to risk-adjusted returns (Option B is correct).
Prevents adverse selection: Proper risk pricing prevents low-quality assets from accumulating (Option C is correct).
Step 2: Why Option D Is Incorrect
Income targets are business-driven, not risk-driven.
Risk-sensitive pricing aims to balance risk and reward, not just maximize revenue.
PRMIA discourages profit-seeking behavior at the expense of risk considerations.
PRMIA Risk Reference Used:
PRMIA Risk Pricing Guidelines – Defines the principles of risk-sensitive pricing.
PRMIA Risk-Adjusted Return Standards – Stresses linking incentives to risk-aware decisions.
PRMIA Capital Adequacy Framework – Highlights the role of risk-sensitive pricing in portfolio management.
Final Conclusion:
Risk-sensitive pricing is designed to align returns with risk exposure, not simply to meet or exceed income targets, making Option D the correct answer.

Overview of Basel II Approaches for Operational Risk
Basel II introduced three main approaches to calculating capital requirements for operational risk:
Basic Indicator Approach (BIA)
The Standardized Approach (TSA)
Advanced Measurement Approach (AMA)
Why Answer D is Correct
Alternative Measurement Approach (AMA) is not a recognized Basel II approach.
The correct term under Basel II was Advanced Measurement Approach (AMA).
Why Other Answers Are Incorrect
Option
Explanation:
A . Basic Indicator Approach (BIA).
Correct – A simple approach where capital is set as a fixed percentage of gross income.
B . The Standardized Approach (TSA).
Correct – Categorizes operational risk into business lines, each with assigned risk factors.
C . Advanced Measurement Approach (AMA).
Correct – Uses internal models to calculate capital requirements based on loss data, scenario analysis, and risk controls.
PRMIA Reference for Verification
Basel II Framework for Operational Risk (2004)
PRMIA Risk Management Guidelines

Definition of Internal Loss Data (ILD)
Internal Loss Data (ILD) refers to historical records of actual operational losses incurred by a bank.
These losses are used for risk assessment, capital calculations, and trend analysis under Basel III’s Operational Risk Framework.
Key Characteristics of ILD
Captures actual past loss events, such as fraud, system failures, and compliance breaches.
Supports the identification of risk trends and weak control areas.
Used for operational risk capital modeling, along with external loss data and scenario analysis.
Why Other Answers Are Incorrect
Option
Explanation:
A . It consists of near miss operational loss incidents of a bank.
Incorrect – ILD captures actual losses, while near misses are reported separately.
C . It consists of the Key Risk Indicators of a bank.
Incorrect – KRIs are forward-looking risk metrics, while ILD focuses on historical data.
D . It consists of scenario data developed to calculate the future operational loss incidents of a bank.
Incorrect – ILD is historical, whereas scenario data is used for predictive analysis.
PRMIA Reference for Verification
Basel III & PRMIA Operational Risk Data Framework
PRMIA Risk Management Standards for ILD

Step 1: Understanding the WorldCom Case
WorldCom was one of the largest U.S. telecom companies before its collapse in 2002 due to fraudulent accounting practices and poor risk management.
The company expanded aggressively through acquisitions but failed to integrate them properly, leading to financial mismanagement and accounting fraud.
Step 2: Why Option C is Correct
WorldCom acquired over 60 companies in a short period without proper integration.
This masked financial problems and led to $11 billion in fraudulent accounting adjustments.
PRMIA and risk management frameworks stress that poor integration after rapid acquisitions increases operational and financial risks.
Step 3: Why the Other Options Are Incorrect
Option A (“Risk models and mortgage underwriting”) → Incorrect because this describes the 2008 financial crisis, not WorldCom.
Option B (“Lack of a CRO during IPO”) → Incorrect because WorldCom was well-established before its fraud-CRO absence was not the main issue.
Option D (“Unauthorized derivatives trading”) → Incorrect because WorldCom’s failure was due to fraudulent accounting, not derivatives.
PRMIA Risk Reference Used:
PRMIA Corporate Governance Guidelines – Discusses risks of poor post-merger integration.
SEC Investigation on WorldCom (2002) – Identified fraudulent accounting due to failed acquisitions.

Step 1: What Is a Risk Assessment Workshop?
A risk assessment workshop is a structured session where key stakeholders identify, evaluate, and prioritize risks.
Effective workshops require preparation, clear objectives, and structured discussions to ensure meaningful risk analysis.
Step 2: Why Option B is Correct
PRMIA and best practices recommend thorough preparation, including:
Setting objectives
Defining risk categories
Ensuring participation from risk, compliance, and business units
Providing risk assessment tools/templates
Step 3: Why the Other Options Are Incorrect
Option A (“Run spontaneously”) → Incorrect because lack of preparation leads to poor discussions and missed risks.
Option C (“Risk management should not attend”) → Incorrect because risk managers provide key expertise to guide discussions.
Option D (“Compliance experts should not attend”) → Incorrect because compliance provides regulatory insights essential to risk assessment.
PRMIA Risk Reference Used:
PRMIA Risk Assessment Framework – Recommends structured, well-prepared workshops.
ISO 31000 Risk Management Standard – Supports proactive workshop planning.
Final Conclusion:
Risk assessment workshops should be well-prepared to ensure meaningful discussions and effective risk identification, making Option B the correct answer.

Financial Crime Risk Management
Managing financial crime requires implementing controls, monitoring, and reporting systems to detect and prevent illegal activities.
Developing red flags and monitoring scenarios allows firms to detect suspicious transactions related to money laundering, fraud, and terrorist financing.
Why Answer C is Correct
PRMIA emphasizes that effective risk management requires proactive monitoring of transactions using red flags, transaction patterns, and anomaly detection systems.
This is aligned with Anti-Money Laundering (AML) and Counter-Terrorism Financing (CTF) regulatory requirements.
Why Other Answers Are Incorrect
Option
Explanation:
A . Having the business be a cash-only business and not report any transactions.
Incorrect – Cash-only businesses with no reporting are high-risk for financial crime.
B . The requirements to trace all transactions when they are entered into spreadsheets.
Incorrect – While transaction tracing is important, spreadsheets alone are not an effective control mechanism for financial crime.
D . Local regulations that allow a bank to not report transactions by family members of the board.
Incorrect – This would violate AML and financial crime regulations, increasing corruption risk.
PRMIA Reference for Verification
PRMIA Financial Crime and AML Risk Guidelines
Basel Committee on Financial Crime and Money Laundering

The National Australia Bank (NAB) FX Options Case Study is a well-known example of operational risk, fraud, and governance failure.
What Happened?
Traders engaged in unauthorized foreign exchange (FX) options trading, using deep-in-the-money options and other complex instruments.
They manipulated profits and losses to smooth earnings and mislead risk managers and auditors.
Why Answer C is Correct
The traders smoothed both profits and losses to avoid detection and ensure continued trading bonuses.
This aligns with PRMIA’s Operational Risk Management Guidelines, which highlight that hidden trading losses and smoothing techniques increase financial crime risk.
Why Other Answers Are Incorrect
Option
Explanation:
A . Complex structured transactions aided in the smoothing of losses.
Incorrect – Smoothing occurred with both profits and losses, not just losses.
B . Deep-in-the-money options and other complex structured transactions aided in the smoothing of losses.
Incorrect – Profits were also manipulated, making this answer incomplete.
D . Deep-in-the-money options aided in the smoothing of losses.
Incorrect – This focuses only on deep-in-the-money options and ignores other structured transactions involved in the fraud.
PRMIA Reference for Verification
PRMIA Fraud and Risk Management Case Studies
Basel Principles on Market Risk and Internal Control Failures

Three Lines of Defense Model
The compliance department functions as the second line of defense, ensuring oversight over the first line’s compliance controls.
It does not directly implement controls but monitors and advises on compliance risk management.
Responsibilities of the Compliance Department
Ensures regulatory compliance with laws, policies, and industry standards.
Monitors and enforces risk management controls within business operations.
Provides advisory and training on compliance risks.
Why Answer D is Correct
The first line of defense (business operations) is responsible for executing compliance controls.
The compliance department (second line) provides oversight and governance to ensure compliance adherence.
Why Other Answers Are Incorrect
Option
Explanation:
A . The compliance department is responsible for implementing the first line’s compliance risk management controls.
Incorrect – The first line (business units) implement compliance controls, while compliance oversees.
B . The compliance department is responsible for providing oversight over the auditor’s implementation of compliance risk management controls.
Incorrect – Internal audit is part of the third line of defense, not directly overseen by compliance.
C . The compliance department is responsible for providing oversight over the board’s implementation of compliance risk management controls.
Incorrect – The board provides high-level governance; compliance ensures business adherence to regulations.
PRMIA Reference for Verification
PRMIA Governance & Compliance Oversight Framework
Basel Committee’s Guidelines on Compliance Risk Management

Definition of DORA
The Digital Operational Resilience Act (DORA) is a regulation by the European Union (EU) aimed at strengthening the digital resilience of financial institutions.
It establishes a regulatory framework for managing information and communication technology (ICT) risks in the financial sector.
Key Objectives of DORA
Ensures that financial institutions can withstand, respond to, and recover from cyber threats and ICT-related disruptions.
Introduces standards for risk management, incident reporting, and third-party ICT risk oversight.
Why Other Answers Are Incorrect
Option
Explanation:
A . Domain for Operational Risk Act.
Incorrect – No such regulation exists under this name.
B . Digital Operational Risk Act.
Incorrect – The official name is Digital Operational Resilience Act (DORA).
C . Daily Operational Resilience Act.
Incorrect – DORA is not focused on daily operations but rather long-term digital resilience.
PRMIA Reference for Verification
PRMIA Risk Governance & Digital Resilience Standards
European Commission’s Official DORA Regulation

Step 1: Role of a Risk Assessment Facilitator
The facilitator’s main role is to guide discussions without bias, ensuring objective risk identification.
PRMIA’s Risk Governance Framework highlights neutral facilitation as key to effective risk workshops.
Step 2: Why Option C Is Correct
Objectivity ensures unbiased risk assessment.
Expressing personal opinions can influence risk ratings, leading to distorted outcomes.
Step 3: Why the Other Options Are Incorrect
Option A (“Guide the workshop toward a pre-determined conclusion”)
Incorrect because risk workshops should discover risks, not confirm pre-set beliefs.
Option B (“Attendees can override results”)
Incorrect as risk results should be evidence-based, not subject to override.
Option D (“Attend via video connection”)
Incorrect as facilitators must engage actively, making remote facilitation less effective.
PRMIA Risk Reference Used:
PRMIA Risk Governance Framework – Stresses objectivity in risk assessment facilitation.
PRMIA Risk Identification Best Practices – Encourages unbiased workshops.
Final Conclusion:
Facilitators must remain neutral and objective, making Option C the correct answer.