Free Aug-2025 8020 Dumps are Available for Instant Access
View All 8020 Actual Exam Questions Answers and Explanations for Free
PRMIA 8020 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 35
ISO 27000 relates to what topic / area?
- A. Environmental, social, and governance (ESG) investing.
- B. Information Security Systems.
- C. Auditing of financial controls.
- D. International Risk Management.
Answer: B
Explanation:
Step 1: Definition of ISO 27000
ISO 27000 is a global standard for information security management systems (ISMS), issued by the International Organization for Standardization (ISO).
It provides a framework for protecting sensitive information through policies, controls, and risk management practices.
Step 2: Why Option B Is Correct
ISO 27001 (part of ISO 27000 series) is one of the most widely recognized certifications for information security governance.
It sets guidelines on risk assessment, incident response, and data protection.
Step 3: Why the Other Options Are Incorrect
Option A ("ESG investing")
Incorrect because ISO 27000 deals with cybersecurity, not environmental, social, and governance (ESG) issues.
Option C ("International Risk Management")
Incorrect because ISO 27000 focuses on information security, not general risk management.
Option D ("Auditing of financial controls")
Incorrect because financial auditing standards (e.g., SOX, COSO) are separate from information security standards.
PRMIA Risk Reference Used:
ISO 27000 Series Documentation - Defines cybersecurity risk management practices.
PRMIA IT Risk Governance Framework - Reference ISO 27001 as a cybersecurity standard.
NEW QUESTION # 36
In Operational Resilience, which of the following is not an important measure of whether a Business Service can be considered Critical?
- A. Whether a disruption to the provision of the service could cause material customer detriment.
- B. Whether a disruption to the provision of the service could exceed risk appetite.
- C. Whether a disruption to the provision of the service could harm market integrity.
- D. Whether a disruption to the provision of the service could threaten a firm's viability.
Answer: B
Explanation:
Step 1: Definition of a Critical Business Service in Operational Resilience A Critical Business Service is one whose failure could result in severe harm to customers, financial markets, or the firm's viability.
Regulators (e.g., Bank of England, Basel Committee, PRMIA) define three primary factors for identifying critical services:
Customer impact
Market integrity impact
Firm viability impact
Step 2: Why Option C Is Incorrect
Risk appetite is an internal business decision, not an external measure of criticality.
A service can be critical even if its disruption stays within risk appetite.
Criticality is based on external impacts, not just internal risk limits.
Step 3: Why the Other Options Are Correct
Option A ("Material customer detriment") → Correct as customer harm defines critical services.
Option B ("Harm to market integrity") → Correct as market stability is a regulatory priority.
Option D ("Threaten firm viability") → Correct as critical services often determine business survival.
PRMIA Risk Reference Used:
PRMIA Operational Resilience Framework - Defines criteria for critical business services.
Basel Committee Operational Risk Guidelines - Highlights customer, market, and firm viability as resilience factors.
Final Conclusion:
Risk appetite is an internal benchmark, not a measure of critical service designation, making Option C the correct answer.
NEW QUESTION # 37
In the Basel III standardized approach for operational risk, what is the Business Indicator?
- A. It is a scaling factor that is based on a bank's average historical losses.
- B. It is a non-financial-statement-based proxy for operational risk.
- C. It is a proxy for operational risks that relate to near-miss events.
- D. It is a financial-statement-based proxy for operational risk.
Answer: D
Explanation:
Step 1: Definition of the Business Indicator (BI) in Basel III
The Business Indicator (BI) is a financial-statement-based metric used in Basel III's Standardized Approach for Operational Risk.
It replaces previous approaches by using financial figures (e.g., revenue, fees, interest income) to estimate operational risk exposure.
Step 2: Why Option D Is Correct
The BI uses financial-statement data to calculate operational risk capital requirements.
It acts as a proxy for a bank's operational risk exposure by linking operational risk to its financial size and complexity.
Step 3: Why the Other Options Are Incorrect
Option A ("Proxy for near-miss events") → Incorrect because BI is based on financial data, not near-miss risk events.
Option B ("Non-financial-statement-based proxy") → Incorrect because BI is explicitly derived from financial statements.
Option C ("Scaling factor based on historical losses") → Incorrect because BI does not use historical losses directly-it relies on financial-statement inputs.
PRMIA Risk Reference Used:
Basel III Operational Risk Framework - Defines the Business Indicator as a financial-statement-based metric.
PRMIA Operational Risk Guidelines - Explains the BI's role in capital calculations.
NEW QUESTION # 38
In operational resilience, what is impact tolerance?
- A. Impact tolerance is a firm's tolerance for disruption to a particular business process.
- B. Impact tolerance is a firm's risk capacity statement.
- C. Impact tolerance is a firm's risk appetite statement.
- D. Impact tolerance is a firm's tolerance for disruption to a particular business service.
Answer: D
Explanation:
Impact Tolerance is a key concept in Operational Resilience, defined as the ability of a firm to withstand, respond to, and recover from disruptions. According to PRMIA and global regulatory frameworks (such as the Bank of England's Operational Resilience Framework), impact tolerance is specifically tied to business services rather than processes.
Step 1: Defining Impact Tolerance
Impact tolerance is the maximum acceptable level of disruption to an important business service, beyond which there would be intolerable harm to customers, financial markets, or regulatory obligations.
It is not the same as risk appetite or risk capacity, as those deal with broader organizational risk exposure.
Step 2: Why Business Services Matter
PRMIA defines business services as end-to-end services delivered to clients and stakeholders, such as payments processing, trade execution, or loan approvals.
Disruptions to these services directly impact customers and financial stability, making business service resilience the core focus of impact tolerance.
Step 3: Why the Other Options Are Incorrect
Option A ("tolerance for disruption to a particular business process")
Incorrect because impact tolerance applies to services, not just internal processes.
Option C ("a firm's risk appetite statement")
Incorrect because risk appetite focuses on how much risk a firm is willing to take, while impact tolerance is about surviving disruptions.
Option D ("a firm's risk capacity statement")
Incorrect because risk capacity is the maximum level of risk a firm can bear, which is broader than business service disruptions.
PRMIA Risk Reference Used:
PRMIA Operational Resilience Guidelines - Defines impact tolerance as a service-based metric.
Bank of England's Operational Resilience Framework - Establishes impact tolerance as a limit on business service disruption.
Final Conclusion:
Impact tolerance focuses on business services, not just internal processes or risk appetite, making Option B the correct answer.
NEW QUESTION # 39
Which of the follow does the risk function typically have responsibility for?
- A. Creating a trial balance, balance sheet statement and cash flow statement.
- B. Putting in place the servers, firewalls and software to ensure cyber security.
- C. Documenting its activities, typically by operating and then recording the daily operation of controls.
- D. Documenting its activities, typically by developing a Risk Management Manual and set of Risk Policies.
Answer: D
Explanation:
Role of the Risk Function
The risk function is responsible for documenting, monitoring, and overseeing risk policies and frameworks.
It ensures the organization maintains structured risk governance, reporting, and compliance.
Key Responsibilities
Developing Risk Management Manuals to define risk appetite, risk frameworks, and risk governance structures.
Creating Risk Policies that align with regulatory standards and internal controls.
Why Answer B is Correct
The risk function primarily develops, implements, and maintains risk management frameworks, which include formal manuals and policies.
Why Other Answers Are Incorrect
Option
Explanation:
A . Documenting its activities, typically by operating and then recording the daily operation of controls.
Incorrect - The first line of defense (business units) handles daily operational controls, not the risk function.
C . Putting in place the servers, firewalls, and software to ensure cybersecurity.
Incorrect - Cybersecurity is an IT responsibility, while the risk function oversees cyber risk frameworks.
D . Creating a trial balance, balance sheet statement, and cash flow statement.
Incorrect - These are financial accounting responsibilities, not risk management duties.
PRMIA Reference for Verification
PRMIA Governance Framework for Risk Management
Basel Risk Management Principles
NEW QUESTION # 40
How can a chief risk officer encourage the governing body and executive management team to create a stronger risk culture?
- A. Establish a set of objectives that the board and executive team must adhere to.
- B. Having a vision of achievable but not excessive ambition.
- C. Balance rewarding success in profitability goals with punishment when there is a failure to achieve goals.
- D. Discourage personal accountability to avoid a blame culture.
Answer: B
Explanation:
A Chief Risk Officer (CRO) plays a crucial role in shaping and strengthening the risk culture within an organization. PRMIA defines risk culture as the shared values, beliefs, knowledge, and understanding about risk that drive behaviors within an institution.
Setting a Clear Vision
The CRO should communicate a vision of risk management that aligns with organizational goals while ensuring that risk-taking remains within acceptable limits.
The vision should be achievable and realistic, rather than overly ambitious, which could incentivize reckless risk-taking.
Embedding Risk Awareness into Decision-Making
A strong risk culture ensures that risk considerations are embedded into business decision-making rather than treated as a separate compliance exercise.
This is supported by PRMIA's Enterprise Risk Management (ERM) Framework, which stresses integrating risk management into strategy and operations.
Avoiding a Blame Culture
A risk-aware organization promotes accountability without fear, enabling employees to report risks without retribution.
Option B (Discourage personal accountability to avoid a blame culture) is incorrect because personal accountability is essential for a healthy risk culture.
Avoiding a Strict, Prescriptive Approach
A set of rigid objectives that must be followed by the executive team (Option C) does not foster a dynamic, evolving risk culture.
Instead, risk culture should be flexible and adaptive to emerging risks.
Balancing Incentives and Consequences
While balancing rewards with penalties (Option D) is part of governance, a strong risk culture is not built solely through fear of punishment.
PRMIA emphasizes positive reinforcement, such as linking risk management behaviors to performance evaluations and incentives.
PRMIA Reference for Verification
PRMIA Risk Governance Framework - Discusses the role of leadership in shaping risk culture.
PRMIA Standards on Enterprise Risk Management (ERM) - Covers best practices for embedding risk culture within organizations.
NEW QUESTION # 41
Under the previous Basel II approach, which was not an approach for operational risk?
- A. Basic Indicator Approach (BIA).
- B. Alternative Measurement Approach (AMA).
- C. The Standardized Approach (TSA).
- D. Advanced Measurement Approach (AMA).
Answer: B
Explanation:
Overview of Basel II Approaches for Operational Risk
Basel II introduced three main approaches to calculating capital requirements for operational risk:
Basic Indicator Approach (BIA)
The Standardized Approach (TSA)
Advanced Measurement Approach (AMA)
Why Answer D is Correct
Alternative Measurement Approach (AMA) is not a recognized Basel II approach.
The correct term under Basel II was Advanced Measurement Approach (AMA).
Why Other Answers Are Incorrect
Option
Explanation:
A . Basic Indicator Approach (BIA).
Correct - A simple approach where capital is set as a fixed percentage of gross income.
B . The Standardized Approach (TSA).
Correct - Categorizes operational risk into business lines, each with assigned risk factors.
C . Advanced Measurement Approach (AMA).
Correct - Uses internal models to calculate capital requirements based on loss data, scenario analysis, and risk controls.
PRMIA Reference for Verification
Basel II Framework for Operational Risk (2004)
PRMIA Risk Management Guidelines
NEW QUESTION # 42
For the Barings case study, what external event may have accelerated the discovery of the loss event?
- A. The collapse of Lehman Brothers into bankruptcy in 2002.
- B. The Kobe earthquake of January 17th 1995.
- C. The Singapore earthquake of January 17th 1995.
- D. The collapse of Lehman Brothers into bankruptcy m 2008.
Answer: B
Explanation:
Background of the Barings Case Study
The Barings Bank collapse occurred due to unauthorized derivatives trading by Nick Leeson in Singapore.
Leeson concealed losses, and his trading positions became unmanageable.
How the Kobe Earthquake Affected Barings
On January 17, 1995, the Kobe earthquake caused extreme market volatility.
Leeson's unauthorized trades were highly exposed to the Nikkei 225 index, and the earthquake triggered heavy losses.
The event accelerated the exposure of Leeson's fraudulent activities, leading to Barings' collapse.
Why Answer D is Correct
The Kobe earthquake created market turmoil, forcing Barings to confront its financial position, ultimately revealing the hidden losses.
Why Other Answers Are Incorrect
Option
Explanation:
A . The collapse of Lehman Brothers into bankruptcy in 2002.
Incorrect - Lehman Brothers collapsed in 2008, not 2002.
B . The Singapore earthquake of January 17th, 1995.
Incorrect - No significant earthquake occurred in Singapore on that date.
C . The collapse of Lehman Brothers into bankruptcy in 2008.
Incorrect - Barings collapsed in 1995, not related to Lehman Brothers' 2008 failure.
PRMIA Reference for Verification
PRMIA Case Study on Barings Bank Collapse
Basel Committee Principles on Risk Oversight and Fraud Prevention
NEW QUESTION # 43
For the National Australia Bank - FX Options case study, large and unusual transaction activity was a concern for what reason?
- A. Deep-in-the-money options and other complex structured transactions aided in the smoothing of profits and losses.
- B. Deep-in-the-money options aided in the smoothing of losses.
- C. Complex structured transactions aided in the smoothing of losses.
- D. Deep-in-the-money options and other complex structured transactions aided in the smoothing of losses.
Answer: A
Explanation:
The National Australia Bank (NAB) FX Options Case Study is a well-known example of operational risk, fraud, and governance failure.
What Happened?
Traders engaged in unauthorized foreign exchange (FX) options trading, using deep-in-the-money options and other complex instruments.
They manipulated profits and losses to smooth earnings and mislead risk managers and auditors.
Why Answer C is Correct
The traders smoothed both profits and losses to avoid detection and ensure continued trading bonuses.
This aligns with PRMIA's Operational Risk Management Guidelines, which highlight that hidden trading losses and smoothing techniques increase financial crime risk.
Why Other Answers Are Incorrect
Option
Explanation:
A . Complex structured transactions aided in the smoothing of losses.
Incorrect - Smoothing occurred with both profits and losses, not just losses.
B . Deep-in-the-money options and other complex structured transactions aided in the smoothing of losses.
Incorrect - Profits were also manipulated, making this answer incomplete.
D . Deep-in-the-money options aided in the smoothing of losses.
Incorrect - This focuses only on deep-in-the-money options and ignores other structured transactions involved in the fraud.
PRMIA Reference for Verification
PRMIA Fraud and Risk Management Case Studies
Basel Principles on Market Risk and Internal Control Failures
NEW QUESTION # 44
Internal loss data (ILD) consists of what kind of data?
- A. It consists of historical operational loss incidents of a bank.
- B. It consists of near miss operational loss incidents of a bank.
- C. It consists of the Key Risk Indicators of a bank.
- D. It consists of scenario data develeloped to calcuate the future operational loss incidents of a bank.
Answer: A
Explanation:
Definition of Internal Loss Data (ILD)
Internal Loss Data (ILD) refers to historical records of actual operational losses incurred by a bank.
These losses are used for risk assessment, capital calculations, and trend analysis under Basel III's Operational Risk Framework.
Key Characteristics of ILD
Captures actual past loss events, such as fraud, system failures, and compliance breaches.
Supports the identification of risk trends and weak control areas.
Used for operational risk capital modeling, along with external loss data and scenario analysis.
Why Other Answers Are Incorrect
Option
Explanation:
A . It consists of near miss operational loss incidents of a bank.
Incorrect - ILD captures actual losses, while near misses are reported separately.
C . It consists of the Key Risk Indicators of a bank.
Incorrect - KRIs are forward-looking risk metrics, while ILD focuses on historical data.
D . It consists of scenario data developed to calculate the future operational loss incidents of a bank.
Incorrect - ILD is historical, whereas scenario data is used for predictive analysis.
PRMIA Reference for Verification
Basel III & PRMIA Operational Risk Data Framework
PRMIA Risk Management Standards for ILD
NEW QUESTION # 45
The The Task Force on Climate-related Financial Disclosures (TCFD) was founded by which body?
- A. The European Commission (EC).
- B. The Financial Stability Board (FSB).
- C. The World Bank (WB).
- D. The United Nations (UN).
Answer: B
NEW QUESTION # 46
For the Barings case study, segregation of duties was an issue. How did this present itself in this case?
- A. A trader was responsible for managing the front-office.
- B. A trader was responsible for managing the expense account.
- C. A risk manager was responsible for managing the back-office
- D. A trader was responsible for managing the back-office.
Answer: D
Explanation:
Background of the Barings Case Study
Nick Leeson, a trader at Barings Bank, caused the collapse of the institution due to unauthorized trading in derivatives.
A critical failure was the lack of segregation of duties, allowing Leeson to both execute trades (front-office) and oversee trade settlement (back-office).
How Segregation of Duties Failed
Proper segregation of duties ensures that no single individual has unchecked control over trading and settlement.
Leeson was responsible for both trading (front-office) and settlement (back-office), meaning he could hide losses without detection.
Why Answer A is Correct
A trader (Leeson) should never have been managing back-office functions.
His dual role allowed him to manipulate records and bypass controls, leading to $1.3 billion in losses and the bank's collapse.
Why Other Answers Are Incorrect
Option
Explanation:
B . A trader was responsible for managing the front-office.
Incorrect - Traders are supposed to manage the front-office; the issue was their involvement in back-office functions.
C . A risk manager was responsible for managing the back-office.
Incorrect - The issue was lack of oversight on the trader, not risk managers handling back-office duties.
D . A trader was responsible for managing the expense account.
Incorrect - The main issue was the trader's control over trade settlement, not expense accounts.
PRMIA Reference for Verification
PRMIA Case Study on Barings Bank Collapse
Basel Principles on Segregation of Duties in Risk Management
NEW QUESTION # 47
Risk Sensitive pricing is required for several good reasons. Which one of the following is not relevant to the Management's evaluation of the correct approach to Risk Sensitive pricing?
- A. To avoid the build-up of a skewed quality property portfolio.
- B. To adequately reward the investors for the capital they gave us to put at risk.
- C. To ensure the income targets can be met or exceeded.
- D. To link personal targets to risk-adjusted return requirements would reinforce the desired risk aware, culture.
Answer: C
Explanation:
Risk-sensitive pricing ensures that financial institutions and businesses properly account for risk in their pricing strategies to maintain stability and sustainability. PRMIA's Risk Pricing and Capital Adequacy Guidelines define the importance of risk-sensitive pricing in ensuring fair compensation for risk exposure and avoiding risk concentration issues.
Step 1: Why Risk-Sensitive Pricing Is Important
Aligns risk with return: Pricing should be designed to reflect the underlying risk and return trade-off.
Protects investors: Investors expect compensation for capital at risk (Option A is correct).
Reinforces risk-aware culture: PRMIA promotes linking incentives to risk-adjusted returns (Option B is correct).
Prevents adverse selection: Proper risk pricing prevents low-quality assets from accumulating (Option C is correct).
Step 2: Why Option D Is Incorrect
Income targets are business-driven, not risk-driven.
Risk-sensitive pricing aims to balance risk and reward, not just maximize revenue.
PRMIA discourages profit-seeking behavior at the expense of risk considerations.
PRMIA Risk Reference Used:
PRMIA Risk Pricing Guidelines - Defines the principles of risk-sensitive pricing.
PRMIA Risk-Adjusted Return Standards - Stresses linking incentives to risk-aware decisions.
PRMIA Capital Adequacy Framework - Highlights the role of risk-sensitive pricing in portfolio management.
Final Conclusion:
Risk-sensitive pricing is designed to align returns with risk exposure, not simply to meet or exceed income targets, making Option D the correct answer.
NEW QUESTION # 48
The DORA act's full name is which of the following?
- A. Digital Operational Risk Act.
- B. Digital Operational Resilience Act.
- C. Daily Operational Resilience Act.
- D. Domain for Operational Risk Act.
Answer: B
Explanation:
Definition of DORA
The Digital Operational Resilience Act (DORA) is a regulation by the European Union (EU) aimed at strengthening the digital resilience of financial institutions.
It establishes a regulatory framework for managing information and communication technology (ICT) risks in the financial sector.
Key Objectives of DORA
Ensures that financial institutions can withstand, respond to, and recover from cyber threats and ICT-related disruptions.
Introduces standards for risk management, incident reporting, and third-party ICT risk oversight.
Why Other Answers Are Incorrect
Option
Explanation:
A . Domain for Operational Risk Act.
Incorrect - No such regulation exists under this name.
B . Digital Operational Risk Act.
Incorrect - The official name is Digital Operational Resilience Act (DORA).
C . Daily Operational Resilience Act.
Incorrect - DORA is not focused on daily operations but rather long-term digital resilience.
PRMIA Reference for Verification
PRMIA Risk Governance & Digital Resilience Standards
European Commission's Official DORA Regulation
NEW QUESTION # 49
For credit risk losses containing operational risk elements that have been historically included in an organizations' credit risk database how should the loss amount be treated?
- A. The entire loss amount is treated as credit risk, but the loss is entered as a memorandum within the operational loss database and not used for capital modeling purposes.
- B. The entire loss amount is treated as credit risk
- C. The entire loss amount is treated as operational risk.
- D. The loss amount is split into credit and operational risk components.
Answer: D
Explanation:
Understanding Credit Risk and Operational Risk Overlap
In some cases, credit risk losses contain elements of operational risk, such as fraud, documentation errors, or IT failures affecting credit transactions.
Basel II and III frameworks require institutions to distinguish between pure credit risk losses and operational risk components within those losses.
Treatment of Losses
The credit-related portion is accounted for under credit risk capital calculations.
The operational risk portion (e.g., fraud-related losses) should be classified separately and included in operational risk databases for risk measurement.
Why Answer C is Correct
Basel III and PRMIA recommend a clear split between credit risk and operational risk components to ensure accurate risk modeling.
If operational risk elements are ignored, an organization may underestimate its true operational risk exposure.
Why Other Answers Are Incorrect
Option
Explanation:
A . The entire loss amount is treated as credit risk.
Incorrect - This ignores operational risk components that should be accounted for separately.
B . The entire loss amount is treated as operational risk.
Incorrect - Credit risk losses are typically dominant in lending-related losses and should not be fully classified as operational risk.
D . The entire loss amount is treated as credit risk, but the loss is entered as a memorandum within the operational loss database and not used for capital modeling purposes.
Incorrect - The operational risk portion must be considered for capital modeling, not just recorded as a memo.
PRMIA Reference for Verification
Basel II & III Guidelines on Credit and Operational Risk Integration
PRMIA Operational Risk Framework
NEW QUESTION # 50
When a control is found to be ineffective, which of the following steps should be take next?
- A. The controls should be re-assessed during the next cycle to determine if they are still ineffective.
- B. Risks should be re-assessed to determine if there can be an exception for the level of control assessment.
- C. An action plan should be designed to close the gap.
- D. Risks should be re-assessed to determine if there is the appropriate level of control assessment.
Answer: C
Explanation:
When a control is found to be ineffective, the primary objective is to remediate the deficiency by implementing corrective measures. PRMIA (Professional Risk Managers' International Association) guidance, aligned with best practices in risk governance, emphasizes a structured approach to handling control deficiencies. Below is a detailed breakdown based on PRMIA risk management principles:
Step 1: Identify and Assess the Ineffective Control
A control is deemed ineffective when it fails to mitigate the identified risks to an acceptable level.
The root cause of the failure must be determined through a Control Effectiveness Review (CER).
PRMIA recommends control testing and incident analysis to assess the severity of the control failure.
Step 2: Develop an Action Plan to Address the Control Deficiency
PRMIA best practices state that risk management should prioritize corrective actions rather than delaying remediation.
The organization must define an action plan to close the gap, which includes:
Revising or strengthening the control mechanisms.
Implementing new controls, if necessary.
Assigning responsibility for remediation to control owners.
Setting deadlines for resolution.
This step aligns with PRMIA's Risk Governance Framework, which emphasizes proactive risk management.
Step 3: Implement Corrective Measures and Monitor Progress
Once an action plan is designed, the organization should execute the corrective actions.
PRMIA's Risk Monitoring Guidelines require regular follow-ups and testing to ensure the control is functioning correctly.
The effectiveness of the remediation should be validated through post-implementation review and ongoing control testing.
Step 4: Re-Assess Risks and Control Effectiveness
Once corrective measures are in place, the organization should re-evaluate risks to confirm that the issue is resolved.
The risk assessment process should be updated to reflect the changes in the control environment.
Why the Other Options Are Incorrect?
Option A: "Risks should be re-assessed to determine if there is the appropriate level of control assessment." While risk re-assessment is a good practice, it does not directly address the ineffective control.
PRMIA guidelines prioritize closing the control gap first before reassessing risks.
Option C: "The controls should be re-assessed during the next cycle to determine if they are still ineffective." Waiting until the next assessment cycle delays remediation, which could expose the organization to unmitigated risks.
PRMIA risk frameworks recommend immediate corrective action when a control is found to be ineffective.
Option D: "Risks should be re-assessed to determine if there can be an exception for the level of control assessment." PRMIA does not support exceptions for ineffective controls unless there is a well-documented risk acceptance process.
A control failure should be remediated rather than seeking exceptions.
PRMIA Risk Reference Used:
PRMIA Risk Governance Framework - Defines the importance of immediate corrective actions for control failures.
PRMIA Risk Monitoring Guidelines - Stresses continuous monitoring and validation of controls.
PRMIA Risk Management Standards - Recommends a structured action plan for ineffective controls.
PRMIA Operational Risk Framework - Emphasizes the need to close control gaps to maintain a strong risk posture.
Final Conclusion:
According to PRMIA risk management best practices, when a control is found to be ineffective, the best course of action is to design and implement an action plan to remediate the issue (Option B). This approach ensures that the organization mitigates risk promptly and maintains a strong control environment.
NEW QUESTION # 51
In relation to financial crime. OFAC is a definition for which organization?
- A. Office of Foreign Asset Control.
- B. Office of Foreigner and other Control.
- C. Office of Financial Asset Control.
- D. Office for Asset Control.
Answer: A
Explanation:
Step 1: Understanding OFAC
OFAC (Office of Foreign Assets Control) is a U.S. Treasury Department agency responsible for enforcing economic and trade sanctions based on U.S. foreign policy and national security goals.
It prevents financial crime by restricting transactions with sanctioned individuals, entities, and countries.
Step 2: Role of OFAC in Financial Crime Prevention
OFAC administers sanctions to prevent money laundering, terrorism financing, and other illicit activities.
Financial institutions must comply with OFAC regulations to avoid heavy fines and reputational damage.
PRMIA's Financial Crime Risk Guidelines emphasize the importance of OFAC compliance in risk management.
Step 3: Why the Other Options Are Incorrect
Option A ("Office of Financial Asset Control") - Incorrect wording; OFAC deals with foreign assets, not just financial assets.
Option B ("Office of Foreigner and Other Control") - OFAC does not regulate foreigners broadly; it targets specific foreign assets and transactions.
Option C ("Office for Asset Control") - Missing "Foreign", which is critical to OFAC's function.
PRMIA Risk Reference Used:
PRMIA Financial Crime Risk Management Guidelines - Emphasizes regulatory compliance with OFAC.
PRMIA Compliance and Sanctions Risk Standards - Stresses the role of OFAC in preventing illicit financial activities.
Final Conclusion:
OFAC stands for the Office of Foreign Assets Control, making Option D the correct answer.
NEW QUESTION # 52
Which of the following principles is critical when creating the optimum policy range and content'?
- A. Policies should be divided into a large number of short topics to enhance accessibility.
- B. New policies should be accompanied by Citable training for the target audience and added to the content of new employee training.
- C. Hard copies of a new policy should be placed in a central library of governance documents at the CRO's home.
- D. Policy owners must ensure that policies are read by the regulator and then the shareholders.
Answer: B
Explanation:
Best Practices for Policy Development
Policies should be clearly written, well-structured, and accompanied by training to ensure employees understand their responsibilities.
PRMIA governance principles emphasize the need for training to enhance compliance and operational effectiveness.
Why Answer D is Correct
Training ensures policy adoption and understanding across the organization.
Integrating policies into new employee training helps embed governance and compliance culture.
Why Other Answers Are Incorrect
Option
Explanation:
A . Policies should be divided into a large number of short topics to enhance accessibility.
Incorrect - While policies should be structured for readability, excessive fragmentation can lead to confusion and inefficiency.
B . Policy owners must ensure that policies are read by the regulator and then the shareholders.
Incorrect - Policies are internal governance tools, not primarily for regulators or shareholders.
C . Hard copies of a new policy should be placed in a central library of governance documents at the CRO's home.
Incorrect - Policies should be centrally available within the organization, not at a personal location.
PRMIA Reference for Verification
PRMIA Governance Best Practices
ISO 31000 Risk Management Standards
NEW QUESTION # 53
Compliance departments traditionally provide policy, oversight, and set the standards for monitoring personal dealing. Which control below would assist in implementing such policies?
- A. Watch lists of stocks that are not allowed to be traded for a period of time, for instance, ahead of a securities offering that the firm is managing.
- B. Outsourcing of the policy writing to an accounting firm at least once every 5 years.
- C. A list of approved suppliers that have been added to the outsourcing policy.
- D. Outsourcing of the policy writing to an accounting firm at least once every 3 years.
Answer: A
Explanation:
Definition of DORA
The Digital Operational Resilience Act (DORA) is a regulation by the European Union (EU) aimed at strengthening the digital resilience of financial institutions.
It establishes a regulatory framework for managing information and communication technology (ICT) risks in the financial sector.
Key Objectives of DORA
Ensures that financial institutions can withstand, respond to, and recover from cyber threats and ICT-related disruptions.
Introduces standards for risk management, incident reporting, and third-party ICT risk oversight.
Why Other Answers Are Incorrect
Option
Explanation:
A . Domain for Operational Risk Act.
Incorrect - No such regulation exists under this name.
B . Digital Operational Risk Act.
Incorrect - The official name is Digital Operational Resilience Act (DORA).
C . Daily Operational Resilience Act.
Incorrect - DORA is not focused on daily operations but rather long-term digital resilience.
PRMIA Reference for Verification
PRMIA Risk Governance & Digital Resilience Standards
European Commission's Official DORA Regulation
NEW QUESTION # 54
Stafford Beers Viable System Model (VSM) has several implementation elements. Which of the following is not one of these?
- A. Output
- B. Input
- C. Governance
- D. Process
Answer: B
Explanation:
Stafford Beer's Viable System Model (VSM)
VSM is a cybernetic model designed to analyze and improve organizational structures.
It consists of five core subsystems that define governance and operations.
Why Answer B is Correct
The VSM does not explicitly include "Input" as a key component.
The key elements of VSM include Governance, Process, and Output, but it does not define "Input" as a standalone concept.
Why Other Answers Are Incorrect
Option
Explanation:
A . Governance
Correct - Governance is part of VSM and deals with decision-making and oversight.
C . Process
Correct - Process represents the operational functions within VSM.
D . Output
Correct - Output refers to the results of the system's operations.
PRMIA Reference for Verification
PRMIA Governance and Cybernetic Systems Guidelines
Stafford Beer's Viable System Model Framework
NEW QUESTION # 55
What are the objectives of conducting an internal loss investigation?
- A. Increase understanding of root causes, focus attention on remediation, and improve the quality of scenario analysis and risk assessments.
- B. Increase understanding of root causes, focus attention on remediation, and ascertain responsibility for the loss event.
- C. Increase understanding of root causes, focus attention on who caused the issue, and improve the quality of scenario analysis and risk assessments.
- D. This is determined on a case by case basis by the HR team.
Answer: A
Explanation:
tep 1: Purpose of Internal Loss Investigations
Internal loss investigations analyze past loss events to identify root causes, improve controls, and enhance risk assessments.
Step 2: Why Option A Is Correct
Root Cause Analysis: Identifying why the loss occurred.
Focus on Remediation: Implementing corrective measures to prevent recurrence.
Scenario Analysis Improvement: Using lessons learned to enhance risk scenario modeling.
Step 3: Why the Other Options Are Incorrect
Option B ("Focus on who caused the issue") → Incorrect because loss investigations are about systemic issues, not assigning blame.
Option C ("Ascertain responsibility for the loss event") → Incorrect because the focus is on process improvements, not individual accountability.
Option D ("Determined by HR on a case-by-case basis") → Incorrect because HR does not dictate risk investigations-risk and compliance functions do.
PRMIA Risk Reference Used:
PRMIA Operational Risk Framework - Emphasizes loss investigations for systemic risk management.
Basel III Risk Governance Standards - Defines loss event analysis as a key risk management tool.
NEW QUESTION # 56
Managing financial crime is a part of risk and compliance for many firms. Which of the following is a useful control to help reduce this risk?
- A. Local regulations that allow a bank to not report transactions by family members of the board.
- B. The requirements to trace all transactions when they are entered into spreadsheets.
- C. Development of scenarios and red flags that are used to monitor transactions and identify suspicious customers and activities.
- D. Having the business be a cash only business and not report any transactions.
Answer: C
Explanation:
Financial Crime Risk Management
Managing financial crime requires implementing controls, monitoring, and reporting systems to detect and prevent illegal activities.
Developing red flags and monitoring scenarios allows firms to detect suspicious transactions related to money laundering, fraud, and terrorist financing.
Why Answer C is Correct
PRMIA emphasizes that effective risk management requires proactive monitoring of transactions using red flags, transaction patterns, and anomaly detection systems.
This is aligned with Anti-Money Laundering (AML) and Counter-Terrorism Financing (CTF) regulatory requirements.
Why Other Answers Are Incorrect
Option
Explanation:
A . Having the business be a cash-only business and not report any transactions.
Incorrect - Cash-only businesses with no reporting are high-risk for financial crime.
B . The requirements to trace all transactions when they are entered into spreadsheets.
Incorrect - While transaction tracing is important, spreadsheets alone are not an effective control mechanism for financial crime.
D . Local regulations that allow a bank to not report transactions by family members of the board.
Incorrect - This would violate AML and financial crime regulations, increasing corruption risk.
PRMIA Reference for Verification
PRMIA Financial Crime and AML Risk Guidelines
Basel Committee on Financial Crime and Money Laundering
NEW QUESTION # 57
......
The Most In-Demand 8020 Pass Guaranteed Quiz : https://www.preppdf.com/PRMIA/8020-prepaway-exam-dumps.html
New Version 8020 Certificate & Helpful Exam Dumps is Online: https://drive.google.com/open?id=15Sr6Z1eUClehzOGWEkvP2AVCslYLdiUd