Quiz 8020: PRMIA ORM Certificate - 2023 Update

The Principles for Risk Governance, as established by PRMIA (Professional Risk Managers'
International Association), emphasize the Three Lines of Defense (3LoD) Model, which is widely used
in risk management and governance frameworks.
Business Line Ownership of Risk (First Line of Defense)
The business units are responsible for identifying, assessing, managing, and monitoring risks within
their operations.
Since they generate the risks through their activities, they must own the risk assessment process.
This aligns with PRMIA Governance Principles, which state that risk management should be
embedded within business operations to ensure proactive risk identification and control.
Risk Management’s Role (Second Line of Defense)
The risk management function is not directly responsible for conducting risk assessments but plays a
key role in designing and maintaining the risk assessment framework.
This includes setting standards, methodologies, and tools for assessing risks across business
functions.
Risk management provides supervision and oversight, ensuring that risk assessments align with
organizational policies and regulatory expectations.
Oversight from Senior Management & the Board (Third Line of Defense)
Internal audit (third line of defense) independently reviews and provides assurance that the risk
management framework is effective and that risk assessments are conducted properly.
PRMIA’s Risk Governance Standards emphasize that internal audit should evaluate the effectiveness
of the risk assessment framework without being involved in its direct execution.
Why Other Answers Are Incorrect
Option Explanation
A . Risk management, in its role as second line of Incorrect – Risk management facilitates and
defense, performs the risk assessment process from oversees the risk assessment process, but the
beginning to end. There is no business line business must take ownership of the risks it
involvement. generates.
Incorrect – While the business owns the process,
C . Business owns the risk assessment process so
risk management plays a crucial role in developing
risk management does not play a role in the
the framework, setting policies, and providing
process.
oversight.
Incorrect – Business management is actively
D . Business management's role in the risk
responsible for executing risk assessments, not just
assessment process should be confined to oversight.
overseeing them.
PRMIA Reference for Verification
PRMIA Standards for Risk Governance – Establishes the Three Lines of Defense and the separation of
responsibilities.
PRMIA Risk Management Framework (RMF) Guidelines – Defines the roles of business and risk
management in risk assessment.
PRMIA Enterprise Risk Management Best Practices – Outlines how risk management facilitates risk
assessments while the business retains ownership.
This answer is verified according to PRMIA’s official risk governance documents and best practices.
Would you like additional clarification or supporting documentation references?

When a control is found to be ineffective, the primary objective is to remediate the deficiency by
implementing corrective measures. PRMIA (Professional Risk Managers' International Association)
guidance, aligned with best practices in risk governance, emphasizes a structured approach to
handling control deficiencies. Below is a detailed breakdown based on PRMIA risk management
principles:
Step 1: Identify and Assess the Ineffective Control
A control is deemed ineffective when it fails to mitigate the identified risks to an acceptable level.
The root cause of the failure must be determined through a Control Effectiveness Review (CER).
PRMIA recommends control testing and incident analysis to assess the severity of the control failure.
Step 2: Develop an Action Plan to Address the Control Deficiency
PRMIA best practices state that risk management should prioritize corrective actions rather than
delaying remediation.
The organization must define an action plan to close the gap, which includes:
Revising or strengthening the control mechanisms.
Implementing new controls, if necessary.
Assigning responsibility for remediation to control owners.
Setting deadlines for resolution.
This step aligns with PRMIA’s Risk Governance Framework, which emphasizes proactive risk
management.
Step 3: Implement Corrective Measures and Monitor Progress
Once an action plan is designed, the organization should execute the corrective actions.
PRMIA’s Risk Monitoring Guidelines require regular follow-ups and testing to ensure the control is
functioning correctly.
The effectiveness of the remediation should be validated through post-implementation review and
ongoing control testing.
Step 4: Re-Assess Risks and Control Effectiveness
Once corrective measures are in place, the organization should re-evaluate risks to confirm that the
issue is resolved.
The risk assessment process should be updated to reflect the changes in the control environment.
Why the Other Options Are Incorrect?
Option A: "Risks should be re-assessed to determine if there is the appropriate level of control
assessment."
While risk re-assessment is a good practice, it does not directly address the ineffective control.
PRMIA guidelines prioritize closing the control gap first before reassessing risks.
Option C: "The controls should be re-assessed during the next cycle to determine if they are still
ineffective."
Waiting until the next assessment cycle delays remediation, which could expose the organization to
unmitigated risks.
PRMIA risk frameworks recommend immediate corrective action when a control is found to be
ineffective.
Option D: "Risks should be re-assessed to determine if there can be an exception for the level of
control assessment."
PRMIA does not support exceptions for ineffective controls unless there is a well-documented risk
acceptance process.
A control failure should be remediated rather than seeking exceptions.
PRMIA Risk Reference Used:
PRMIA Risk Governance Framework – Defines the importance of immediate corrective actions for
control failures.
PRMIA Risk Monitoring Guidelines – Stresses continuous monitoring and validation of controls.
PRMIA Risk Management Standards – Recommends a structured action plan for ineffective controls.
PRMIA Operational Risk Framework – Emphasizes the need to close control gaps to maintain a strong
risk posture.
Final Conclusion:
According to PRMIA risk management best practices, when a control is found to be ineffective, the
best course of action is to design and implement an action plan to remediate the issue (Option B).
This approach ensures that the organization mitigates risk promptly and maintains a strong control
environment.

A Chief Risk Officer (CRO) plays a crucial role in shaping and strengthening the risk culture within an
organization. PRMIA defines risk culture as the shared values, beliefs, knowledge, and understanding
about risk that drive behaviors within an institution.
Setting a Clear Vision
The CRO should communicate a vision of risk management that aligns with organizational goals
while ensuring that risk-taking remains within acceptable limits.
The vision should be achievable and realistic, rather than overly ambitious, which could incentivize
reckless risk-taking.
Embedding Risk Awareness into Decision-Making
A strong risk culture ensures that risk considerations are embedded into business decision-making
rather than treated as a separate compliance exercise.
This is supported by PRMIA’s Enterprise Risk Management (ERM) Framework, which stresses
integrating risk management into strategy and operations.
Avoiding a Blame Culture
A risk-aware organization promotes accountability without fear, enabling employees to report risks
without retribution.
Option B (Discourage personal accountability to avoid a blame culture) is incorrect because personal
accountability is essential for a healthy risk culture.
Avoiding a Strict, Prescriptive Approach
A set of rigid objectives that must be followed by the executive team (Option C) does not foster a
dynamic, evolving risk culture.
Instead, risk culture should be flexible and adaptive to emerging risks.
Balancing Incentives and Consequences
While balancing rewards with penalties (Option D) is part of governance, a strong risk culture is not
built solely through fear of punishment.
PRMIA emphasizes positive reinforcement, such as linking risk management behaviors to
performance evaluations and incentives.
PRMIA Reference for Verification
PRMIA Risk Governance Framework – Discusses the role of leadership in shaping risk culture.
PRMIA Standards on Enterprise Risk Management (ERM) – Covers best practices for embedding risk
culture within organizations.

Near Misses in Operational Risk
A near miss is an event that could have led to a loss but was avoided or mitigated before actual
financial impact occurred.
PRMIA emphasizes that near misses should be reported, recorded, and analyzed because they
provide valuable insights into potential vulnerabilities in risk controls.
However, since they did not result in actual financial losses, they are not included in the calculation
of Operational Risk Capital.
Opportunity Costs in Operational Risk
Opportunity costs refer to the loss of potential gains due to missed strategic opportunities.
These are not directly quantifiable as operational risk losses and are not included in Operational Risk
Capital calculations.
PRMIA’s Operational Risk Framework states that operational risk is about actual losses rather than
theoretical costs.
Why Other Answers Are Incorrect
Option Explanation
Incorrect – Near misses and opportunity costs provide valuable
A . Ignored.
insights into operational risk, so they should never be ignored.
Incorrect – While they should be recorded and analyzed, they
B . Recorded and Analyzed. Used in
are not included in Operational Risk Capital calculations
calculation of Operational Risk Capital.
because they do not result in actual losses.
D . Reported, Recorded, and Analyzed,
Incorrect – Reporting, recording, and analysis are correct, but
Used in calculation of Operational Risk
they should not be included in capital calculations.
Capital.
PRMIA Reference for Verification
PRMIA Operational Risk Management Standards – Defines near misses and opportunity costs.
Basel II & III Operational Risk Framework – Outlines the principles of operational risk capital
calculations.

Third-Party Risk Management (TPRM)
PRMIA highlights the importance of conducting thorough due diligence on third-party vendors and
service providers.
This includes evaluating compliance programs, risk management frameworks, financial stability,
strategic objectives, and operational history.
Key Areas of Third-Party Risk Assessment
Compliance and Risk Infrastructure → Ensures that the provider meets regulatory and security
requirements.
Financial Health → Determines whether the provider has the financial stability to support long-term
service delivery.
Business Strategy → Helps assess alignment with the organization’s risk appetite and goals.
Operating History → Evaluates experience and reliability in delivering services.
Why Other Answers Are Incorrect
Option Explanation
B . An assessment of a third party should not
Incorrect – Ignoring these critical factors increases
include its compliance and risk infrastructure,
the risk of working with an unreliable vendor.
financials, business strategy, and operating history.
Incorrect – Onsite visits are highly valuable as they
C . Onsite visits are not advantageous for
provide first-hand insights into operational controls.
understanding the third party's risks and control
PRMIA encourages risk managers to conduct site
environment.
visits.
Incorrect – Employee salaries are not a primary risk
D . A review of the pay levels of the staff supporting
factor in vendor assessments. The focus should be
the service.
on the vendor’s security, compliance, and
operational risks.
PRMIA Reference for Verification
PRMIA Third-Party Risk Management (TPRM) Guidelines – Details best practices for vendor risk
assessments.
Basel Principles on Outsourcing and Third-Party Risk – Provides regulatory guidance on evaluating
third-party service providers.

Team supervisors play a critical role in shaping and maintaining an organization's risk culture.
PRMIA's Risk Governance Framework and Risk Culture Principles emphasize that supervisors act as
the link between risk policies and frontline employees, ensuring that risk-aware behaviors are
consistently followed.
Step 1: Role of Supervisors in Risk Culture Development
Supervisors engage with employees daily, providing guidance on risk-based decision-making.
They reinforce risk policies, standards, and expectations set by senior management.
Supervisors identify behavioral trends that may indicate risk culture weaknesses.
Step 2: Supervisors as Enforcers of Risk Culture
PRMIA’s Risk Culture Framework stresses that risk culture must be embedded into daily operations
through supervisor-led enforcement.
Supervisors monitor, correct non-compliant behaviors, and provide ongoing risk awareness training.
Their proximity to employees allows them to detect early warning signs of risk issues.
Step 3: Why the Other Options Are Incorrect
Option A: "More experienced than the employees that report to them."
Experience alone does not establish or maintain a risk culture.
A risk culture is about behaviors and practices, not just expertise.
Option B: "Visible to regulators and can describe the firm's risk culture to inspection teams."
While supervisors may interact with regulators, their primary role is to engage with employees daily
rather than acting as spokespersons.
Option D: "Visible to regulators and can describe the firm's risk culture to their board."
Boards typically rely on Chief Risk Officers (CROs) or senior executives to communicate risk culture,
not direct supervisors.
PRMIA Risk Reference Used:
PRMIA Risk Culture Framework – Highlights the role of supervisors in ensuring risk-aware behaviors.
PRMIA Risk Governance Framework – Stresses that frontline supervisors must enforce risk
management policies.
PRMIA Risk Awareness Guidelines – Reinforces daily interaction as a key factor in maintaining a
strong risk culture.
Final Conclusion:
Supervisors directly influence employees' behaviors and ensure that risk culture is consistently
followed, making Option C the correct answer.

Risk-sensitive pricing ensures that financial institutions and businesses properly account for risk in
their pricing strategies to maintain stability and sustainability. PRMIA’s Risk Pricing and Capital
Adequacy Guidelines define the importance of risk-sensitive pricing in ensuring fair compensation
for risk exposure and avoiding risk concentration issues.
Step 1: Why Risk-Sensitive Pricing Is Important
Aligns risk with return: Pricing should be designed to reflect the underlying risk and return trade-off.
Protects investors: Investors expect compensation for capital at risk (Option A is correct).
Reinforces risk-aware culture: PRMIA promotes linking incentives to risk-adjusted returns (Option B
is correct).
Prevents adverse selection: Proper risk pricing prevents low-quality assets from accumulating
(Option C is correct).
Step 2: Why Option D Is Incorrect
Income targets are business-driven, not risk-driven.
Risk-sensitive pricing aims to balance risk and reward, not just maximize revenue.
PRMIA discourages profit-seeking behavior at the expense of risk considerations.
PRMIA Risk Reference Used:
PRMIA Risk Pricing Guidelines – Defines the principles of risk-sensitive pricing.
PRMIA Risk-Adjusted Return Standards – Stresses linking incentives to risk-aware decisions.
PRMIA Capital Adequacy Framework – Highlights the role of risk-sensitive pricing in portfolio
management.
Final Conclusion:
Risk-sensitive pricing is designed to align returns with risk exposure, not simply to meet or exceed
income targets, making Option D the correct answer.

Step 1: Understanding OFAC
OFAC (Office of Foreign Assets Control) is a U.S. Treasury Department agency responsible for
enforcing economic and trade sanctions based on U.S. foreign policy and national security goals.
It prevents financial crime by restricting transactions with sanctioned individuals, entities, and
countries.
Step 2: Role of OFAC in Financial Crime Prevention
OFAC administers sanctions to prevent money laundering, terrorism financing, and other illicit
activities.
Financial institutions must comply with OFAC regulations to avoid heavy fines and reputational
damage.
PRMIA’s Financial Crime Risk Guidelines emphasize the importance of OFAC compliance in risk
management.
Step 3: Why the Other Options Are Incorrect
Option A ("Office of Financial Asset Control") – Incorrect wording; OFAC deals with foreign assets, not
just financial assets.
Option B ("Office of Foreigner and Other Control") – OFAC does not regulate foreigners broadly; it
targets specific foreign assets and transactions.
Option C ("Office for Asset Control") – Missing "Foreign", which is critical to OFAC’s function.
PRMIA Risk Reference Used:
PRMIA Financial Crime Risk Management Guidelines – Emphasizes regulatory compliance with OFAC.
PRMIA Compliance and Sanctions Risk Standards – Stresses the role of OFAC in preventing illicit
financial activities.
Final Conclusion:
OFAC stands for the Office of Foreign Assets Control, making Option D the correct answer.

The Internal Loss Multiplier (ILM) is a key component of the Basel III Standardized Approach for
Operational Risk. It is designed to adjust capital requirements based on a bank’s historical loss
experience.
Definition of ILM
ILM is a scaling factor that adjusts the operational risk capital requirement based on a bank’s internal
loss history.
It is derived using a formula that incorporates historical operational risk losses relative to a bank’s
revenue.
Why ILM Exists in Basel III
Basel III replaced the Advanced Measurement Approach (AMA) with a Standardized Approach that
includes ILM to ensure that banks with high historical losses hold more capital for operational risk.
Why Other Answers Are Incorrect
Option Explanation
Incorrect – ILM is not a general financial statement proxy;
A . It is a financial-statement-based proxy for
it specifically adjusts capital based on past operational
operational risk.
losses.
B . It is a non-financial factor that is based on a Incorrect – ILM is financial in nature because it directly
bank's average historical losses. influences capital requirements.
D . It is uniform, and is used for indicating
Incorrect – ILM is not uniform; it is bank-specific and
consistent incidents on an average return
varies based on loss history.
basis.
PRMIA Reference for Verification
PRMIA Operational Risk Standards
Basel III Standardized Approach for Operational Risk

The National Australia Bank (NAB) FX Options Case Study is a well-known example of operational
risk, fraud, and governance failure.
What Happened?
Traders engaged in unauthorized foreign exchange (FX) options trading, using deep-in-the-money
options and other complex instruments.
They manipulated profits and losses to smooth earnings and mislead risk managers and auditors.
Why Answer C is Correct
The traders smoothed both profits and losses to avoid detection and ensure continued trading
bonuses.
This aligns with PRMIA’s Operational Risk Management Guidelines, which highlight that hidden
trading losses and smoothing techniques increase financial crime risk.
Why Other Answers Are Incorrect
Option Explanation
A . Complex structured transactions aided in the Incorrect – Smoothing occurred with both profits and
smoothing of losses. losses, not just losses.
B . Deep-in-the-money options and other
Incorrect – Profits were also manipulated, making this
complex structured transactions aided in the
answer incomplete.
smoothing of losses.
Incorrect – This focuses only on deep-in-the-money
D . Deep-in-the-money options aided in the
options and ignores other structured transactions
smoothing of losses.
involved in the fraud.
PRMIA Reference for Verification
PRMIA Fraud and Risk Management Case Studies
Basel Principles on Market Risk and Internal Control Failures