PRMIA 8020 - ORM Certificate - 2023 Update

Role of the Risk Function

Therisk functionis responsible fordocumenting, monitoring, and overseeing risk policies and frameworks.

It ensures the organizationmaintains structured risk governance, reporting, and compliance.

Key Responsibilities

Developing Risk Management Manualsto definerisk appetite, risk frameworks, and risk governance structures.

Creating Risk Policiesthat align withregulatory standards and internal controls.

Why Answer B is Correct

The risk function primarilydevelops, implements, and maintains risk management frameworks, which include formalmanuals and policies.

Why Other Answers Are Incorrect

Option

Explanation

A. Documenting its activities, typically by operating and then recording the daily operation of controls.

Incorrect– The first line of defense (business units) handles daily operational controls, not the risk function.

C. Putting in place the servers, firewalls, and software to ensure cybersecurity.

Incorrect– Cybersecurity is anIT responsibility, while the risk functionoversees cyber risk frameworks.

D. Creating a trial balance, balance sheet statement, and cash flow statement.

Incorrect– These arefinancial accounting responsibilities, not risk management duties.

PRMIA Governance Framework for Risk Management

Basel Risk Management Principles

PRMIA References for Verification

Near Misses in Operational Risk

Anear missis an event that could have led to a loss but wasavoided or mitigatedbefore actual financial impact occurred.

PRMIA emphasizes that near misses should bereported, recorded, and analyzedbecause they provide valuable insights intopotential vulnerabilitiesin risk controls.

However, since they did not result in actual financial losses,they are not included in the calculation of Operational Risk Capital.

Opportunity Costs in Operational Risk

Opportunity costsrefer to theloss of potential gainsdue to missed strategic opportunities.

These arenot directly quantifiable as operational risk lossesand are not included in Operational Risk Capital calculations.

PRMIA’sOperational Risk Frameworkstates thatoperational risk is about actual lossesrather than theoretical costs.

Why Other Answers Are Incorrect

Option

Explanation

A. Ignored.

Incorrect– Near misses and opportunity costs provide valuable insights into operational risk, so they should never be ignored.

B. Recorded and Analyzed. Used in calculation of Operational Risk Capital.

Incorrect– While they should be recorded and analyzed, they arenot included in Operational Risk Capital calculationsbecause they do not result in actual losses.

D. Reported, Recorded, and Analyzed, Used in calculation of Operational Risk Capital.

Incorrect– Reporting, recording, and analysis are correct, but theyshould not be included in capital calculations.

PRMIA Operational Risk Management Standards– Defines near misses and opportunity costs.

Basel II & III Operational Risk Framework– Outlines the principles of operational risk capital calculations.

PRMIA References for Verification

Understanding Credit Risk and Operational Risk Overlap

In some cases,credit risk lossescontain elements ofoperational risk, such as fraud, documentation errors, or IT failures affecting credit transactions.

Basel II and III frameworksrequire institutions todistinguish between pure credit risk losses and operational risk componentswithin those losses.

Treatment of Losses

Thecredit-related portionis accounted for undercredit risk capital calculations.

Theoperational risk portion(e.g., fraud-related losses) should beclassified separatelyand included inoperational risk databasesfor risk measurement.

Why Answer C is Correct

Basel III and PRMIArecommend a clear splitbetweencredit risk and operational risk componentsto ensure accurate risk modeling.

If operational risk elements are ignored, an organizationmay underestimate its true operational risk exposure.

Why Other Answers Are Incorrect

Option

Explanation

A. The entire loss amount is treated as credit risk.

Incorrect– This ignores operational risk components that should be accounted for separately.

B. The entire loss amount is treated as operational risk.

Incorrect– Credit risk losses are typically dominant in lending-related losses and should not be fully classified as operational risk.

D. The entire loss amount is treated as credit risk, but the loss is entered as a memorandum within the operational loss database and not used for capital modeling purposes.

Incorrect– The operational risk portionmust be considered for capital modeling, not just recorded as a memo.

Basel II & III Guidelines on Credit and Operational Risk Integration

PRMIA Operational Risk Framework

PRMIA References for Verification

The Business Indicator (BI) is a financial-statement-based metricused inBasel III's Standardized Approach for Operational Risk.

It replacesprevious approachesby usingfinancial figures (e.g., revenue, fees, interest income)to estimate operational risk exposure.

The BI uses financial-statementdatato calculateoperational risk capital requirements.

It acts as aproxy for a bank’s operational risk exposureby linking operational risk to itsfinancial size and complexity.

Option A ("Proxy for near-miss events")→ Incorrect because BI is based onfinancial data, not near-miss risk events.

Option B ("Non-financial-statement-based proxy")→ Incorrect becauseBI is explicitly derived from financial statements.

Option C ("Scaling factor based on historical losses")→ Incorrect becauseBI does not use historical losses directly—it relies on financial-statement inputs.

Step 1: Definition of the Business Indicator (BI) in Basel IIIStep 2: Why Option D Is CorrectStep 3: Why the Other Options Are Incorrect

Basel III Operational Risk Framework– Defines the Business Indicator as a financial-statement-based metric.

PRMIA Operational Risk Guidelines– Explains the BI’s role in capital calculations.

PRMIA Risk References Used:

AChief Risk Officer (CRO)plays a crucial role inshaping and strengthening the risk culturewithin an organization. PRMIA defines risk culture as the shared values, beliefs, knowledge, and understanding about risk that drive behaviors within an institution.

Setting a Clear Vision

The CRO should communicate avision of risk managementthat aligns withorganizational goalswhile ensuring that risk-taking remains within acceptable limits.

The vision should beachievable and realistic, rather than overly ambitious, which could incentivize reckless risk-taking.

Embedding Risk Awareness into Decision-Making

A strong risk culture ensures that risk considerations are embedded into business decision-making rather than treated as a separate compliance exercise.

This is supported byPRMIA’s Enterprise Risk Management (ERM) Framework, which stresses integrating risk management into strategy and operations.

Avoiding a Blame Culture

A risk-aware organization promotesaccountability without fear, enabling employees to report risks without retribution.

Option B (Discourage personal accountability to avoid a blame culture) isincorrectbecause personal accountability is essential for a healthy risk culture.

Avoiding a Strict, Prescriptive Approach

Aset of rigid objectivesthat must be followed by the executive team (Option C) does not foster a dynamic, evolving risk culture.

Instead, risk culture should be flexible and adaptive to emerging risks.

Balancing Incentives and Consequences

Whilebalancing rewards with penalties(Option D) is part of governance, a strong risk culture isnotbuilt solely through fear of punishment.

PRMIA emphasizespositive reinforcement, such as linking risk management behaviors to performance evaluations and incentives.

PRMIA Risk Governance Framework– Discusses the role of leadership in shaping risk culture.

PRMIA Standards on Enterprise Risk Management (ERM)– Covers best practices for embedding risk culture within organizations.

PRMIA References for Verification

Arisk assessment workshopis a structured session where key stakeholdersidentify, evaluate, and prioritize risks.

Effective workshops requirepreparation, clear objectives, and structured discussionsto ensure meaningful risk analysis.

PRMIA and best practices recommendthorough preparation, including:

Setting objectives

Defining risk categories

Ensuring participation from risk, compliance, and business units

Providing risk assessment tools/templates

Option A ("Run spontaneously")→ Incorrect becauselack of preparation leads to poor discussions and missed risks.

Option C ("Risk management should not attend")→ Incorrect becauserisk managers provide key expertise to guide discussions.

Option D ("Compliance experts should not attend")→ Incorrect becausecompliance provides regulatory insights essential to risk assessment.

Step 1: What Is a Risk Assessment Workshop?Step 2: Why Option B is CorrectStep 3: Why the Other Options Are Incorrect

PRMIA Risk Assessment Framework– Recommends structured, well-prepared workshops.

ISO 31000 Risk Management Standard– Supports proactive workshop planning.

PRMIA Risk References Used:

Final Conclusion:Risk assessment workshops should be well-prepared to ensure meaningful discussions and effective risk identification, makingOption B the correct answer.

TheTask Force on Climate-related Financial Disclosures (TCFD)was established todevelop climate-related financial risk disclosure recommendationsto help investors, lenders, and regulators make informed decisions.

TheFinancial Stability Board (FSB), an international organization that monitors and makes recommendations about the global financial system, founded theTCFD in 2015.

The FSB recognizedclimate risk as a financial stability issueand launched the TCFD to standardize reporting.

Option A ("World Bank")→ Incorrect because theWorld Bank supports climate initiativesbut did not create the TCFD.

Option B ("United Nations")→ Incorrect because theUN has climate programs like the UNFCCC, but not the TCFD.

Option D ("European Commission")→ Incorrect becausethe EC develops its own sustainability regulations (e.g., SFDR, CSRD), separate from the TCFD.

Step 1: What is the TCFD?Step 2: Who Founded the TCFD?Step 3: Why the Other Options Are Incorrect

PRMIA Climate Risk Guidelines– Cites FSB's role in founding the TCFD.

FSB Official Reports (2015)– Confirms that the FSB established the TCFD.

PRMIA Risk References Used:

Final Conclusion:TheFSB founded the TCFD in 2015, makingOption C the correct answer.

TheTSB outagein 2018 was caused by afailed IT migrationfrom its old banking system to a new one.

The transitionlocked millions of customers out of their accounts for weeks, resulting infinancial losses and reputational damage.

TSB attempted tomove customer data to a new banking platform, butserious defects in the migration processled to service failures.

PRMIA andUK Financial Conduct Authority (FCA) reportsconfirmed thatpoor IT risk managementwas a key failure.

Option A ("Liquidity squeeze by hedge-fund")

Incorrect because TSB's failure was due toIT migration issues, not a liquidity crisis.

Option B ("Sub-standard risk pricing and risk management")

Incorrect becausepricing models were not the cause—it was anIT system failure.

Option D ("IT models did not work if prices were discontinuous")

Incorrect as this issue ismore common in high-frequency trading failures, not banking system outages.

Step 1: Understanding the TSB CaseStep 2: Why Option C Is CorrectStep 3: Why the Other Options Are Incorrect

UK FCA Investigation on TSB Incident– Confirms IT migration failure as root cause.

PRMIA IT Risk Management Framework– Highlights risks of major IT transitions.

PRMIA Risk References Used:

Final Conclusion:TheTSB outage was caused by a failed IT migration, makingOption C the correct answer.