PRMIA 8020 - ORM Certificate - 2023 Update

TheFTX collapseinvolvedfraudulent fund mismanagement, where FTX executives created a "backdoor" to allowAlameda Research (FTX’s sister trading firm) to borrow client funds without their consent.

The backdoor wasa hidden code in FTX’s system, allegedly created bySam Bankman-Fried, which allowed Alameda to accesscustomer depositswithout triggering alerts to auditors or compliance teams.

Alameda used these fundsfor risky trading strategies and investments, leading to the eventual collapse of FTX when a liquidity crunch exposed the missing funds.

Option A ("allowed a stablecoin to be removed from the ledger and added to the balance sheet")

Incorrect because FTX’s fraud involvedmisuse of customer funds, not just a stablecoin misclassification.

Option C ("allowed currency traders to smooth profits and conceal losses for over two years")

Incorrect because this sounds more likeLIBOR-rigging scandals, whereas FTX misappropriated client funds.

Option D ("allowed a rapid pace of acquisitions but poor integration of acquired companies")

Incorrect because FTX's collapse was due tofinancial fraud, not poor acquisition strategy.

Step 1: The "Backdoor" in FTXStep 2: Why the Other Options Are Incorrect

PRMIA Financial Crime Risk Management– Discusses insider risk and fraudulent misappropriation of funds.

FTX Collapse Reports– SEC, CFTC, and DOJ filings confirm that Alameda had unauthorized access to client funds.

PRMIA Risk References Used:

Final Conclusion:FTX’s backdoorenabled Alameda to take $65 billion in client funds without permission, makingOption B the correct answer.

Three Lines of Defense Model

Thecompliance department functions as the second line of defense, ensuringoversight over the first line’s compliance controls.

It doesnot directly implement controlsbutmonitors and adviseson compliance risk management.

Responsibilities of the Compliance Department

Ensures regulatory compliancewith laws, policies, and industry standards.

Monitors and enforces risk management controlswithin business operations.

Provides advisory and trainingon compliance risks.

Why Answer D is Correct

Thefirst line of defense (business operations)is responsible for executing compliance controls.

Thecompliance department (second line)providesoversight and governanceto ensure compliance adherence.

Why Other Answers Are Incorrect

Option

Explanation

A. The compliance department is responsible for implementing the first line's compliance risk management controls.

Incorrect– Thefirst line (business units)implement compliance controls, while compliance oversees.

B. The compliance department is responsible for providing oversight over the auditor's implementation of compliance risk management controls.

Incorrect– Internal audit is part of thethird line of defense, not directly overseen by compliance.

C. The compliance department is responsible for providing oversight over the board's implementation of compliance risk management controls.

Incorrect– The board provideshigh-level governance; compliance ensures business adherence to regulations.

PRMIA Governance & Compliance Oversight Framework

Basel Committee’s Guidelines on Compliance Risk Management

PRMIA References for Verification

Overview of Basel II Approaches for Operational Risk

Basel IIintroducedthreemain approaches tocalculating capital requirements for operational risk:

Basic Indicator Approach (BIA)

The Standardized Approach (TSA)

Advanced Measurement Approach (AMA)

Why Answer D is Correct

Alternative Measurement Approach (AMA)isnot a recognized Basel II approach.

The correct term under Basel II wasAdvanced Measurement Approach (AMA).

Why Other Answers Are Incorrect

Option

Explanation

A. Basic Indicator Approach (BIA).

Correct– A simple approach where capital is set as a fixed percentage of gross income.

B. The Standardized Approach (TSA).

Correct– Categorizes operational risk into business lines, each with assigned risk factors.

C. Advanced Measurement Approach (AMA).

Correct– Usesinternal modelsto calculate capital requirements based on loss data, scenario analysis, and risk controls.

Basel II Framework for Operational Risk (2004)

PRMIA Risk Management Guidelines

PRMIA References for Verification

Credit Risk: Risk ofloss due to borrower default.

Operational Risk: Risk ofloss due to failed internal processes, fraud, or misconduct.

Ponzi Schemes: Fraudulent investment scamsdisguise credit risk as legitimate lendingbut collapse when new funds dry up.

Rogue Trading: Traderstake unauthorized risksthat can lead tocredit defaultsor massive financial losses.

Option A ("Failure in loan approval process")→ This is anOperational Risk issue, but does not always create Credit Risk.

Option B ("Ponzi Schemes")→ Partially correct, but does not includeRogue Trading, which is also a credit risk-related operational failure.

Option C ("Rogue Trading")→ Partially correct, but does not includePonzi Schemes, which are another key example.

Step 1: Understanding Credit Risk with an Operational Risk ComponentStep 2: Why Option D is CorrectStep 3: Why the Other Options Are Incorrect

PRMIA Operational Risk Framework– Highlights fraud-based Credit Risk events.

Basel II/III Operational Risk Guidelines– Discussestrading misconduct and credit risk misrepresentation.

PRMIA Risk References Used:

Final Conclusion:BothPonzi Schemes and Rogue Tradinginvolvecredit risk failures caused by operational misconduct, makingOption D the correct answer.

Definition of Bottom-Up Key Risk Indicators (KRIs)

Bottom-up KRIsaregenerated from operational-level datarather than high-level strategic indicators.

They areuseful for monitoring localized risksbutmay fail to capture broad risk drivers.

Key Deficiencies of Bottom-Up KRIs

Lack of clarity on causal relationships– These indicators may detect risk trends butfail to explain root causes.

Focus on micro-level risks– They maymiss systemic or enterprise-wide risk interactions.

Why Answer B is Correct

Bottom-up KRIs may indicate changes in risk levels butlack insight into the underlying causes, leading toreactive rather than proactive risk management.

Why Other Answers Are Incorrect

Option

Explanation

A. Mandates from a board that are too restrictive to implement.

Incorrect– Board mandates apply totop-downgovernance, not bottom-up KRIs.

C. Not reported frequently enough.

Incorrect– Reporting frequency is an issue butnot the primary deficiency; rather, it’s the lack of causal insight.

D. Lack of granularity.

Incorrect– Bottom-up KRIs tend to behighly detailed (granular), making this answer incorrect.

PRMIA Key Risk Indicator Best Practices

Basel Committee’s Risk Measurement and Reporting Framework

PRMIA References for Verification

TheThree Lines of Defense (3LoD) modelensures thatrisk management responsibilities are properly segregated:

First Line: Business units (own and manage risk).

Second Line: Compliance and risk management (independent oversight).

Third Line: Internal audit (provides assurance).

PRMIA andBasel Compliance Principlesstate that compliance shouldnot report to business units, as this creates aconflict of interest.

Compliance must beindependent to ensure objective oversightof regulatory adherence.

Option A ("Report to the business")→ Incorrect becausecompliance must provide independent oversight, not report to business units.

Option C ("Outsource compliance if risk function exists")→ Incorrect becausecompliance and risk functions have distinct roles.

Option D ("Outsource risk if compliance exists")→ Incorrect becauserisk management is a core function, not an outsourcing candidate.

Step 1: Compliance Function and the Three Lines of Defense ModelStep 2: Why Compliance Must Be IndependentStep 3: Why the Other Options Are Incorrect

PRMIA Compliance Risk Governance– States compliance must beindependentunder the Three Lines of Defense model.

Basel Compliance Principles– Recommends separate reporting structures for compliance and business units.

PRMIA Risk References Used:

Final Conclusion:Compliance must be independent from the business to avoid conflicts of interest, makingOption B the correct answer.

Inoperational risk events, a single event canimpact multiple business lines or event types(e.g., IT failure affecting retail banking and wealth management).

Proper loss attribution isimportant for accurate risk reporting and regulatory complianceunder Basel III.

Basel III and PRMIA guidanceallow institutions flexibilityin how to allocate linked losses:

Entire loss can be allocated to the business line with the largest loss impactforsimplified reporting.

Loss can be pro-ratedacross affected business linesfor more accurate attribution.

Option A ("Allocate entire loss to the business line with the greatest loss")→Partially correct, butnot always required—some firms prefer pro-rating.

Option B ("Pro-rate the loss")→Partially correct, butallocating to the largest impacted business line is also acceptable.

Option D ("Each business line decides how to treat losses")→Incorrectbecauseloss allocation should follow a defined policy, not business line discretion.

Step 1: Understanding Linked Losses in Operational RiskStep 2: Why Option C is CorrectStep 3: Why the Other Options Are Incorrect

Basel III Operational Risk Framework– Discusses loss attribution for multi-line impact events.

PRMIA Loss Event Management Guidelines– Supports both full allocation and pro-rating.

PRMIA Risk References Used:

Final Conclusion:Firms can either allocate the full loss to the most impacted business line or pro-rate it across affected lines, makingOption C the correct answer.

Definition of Confidence Accounting

Confidence Accountingchallenges traditional accountingby introducingprobability distributions and rangesrather than fixed numbers for financial reporting.

This approach improvestransparency and risk awarenessby acknowledginguncertainty in financial figures.

Why Answer B is Correct

Encourages usingranges (confidence intervals)instead of discrete values to better reflect uncertainty.

Used inrisk-sensitive industrieswherefinancial estimates varydue to external factors (e.g., credit risk, market fluctuations).

Why Other Answers Are Incorrect

Option

Explanation

A. An approach that encourages companies and audit firms to have diverse boards.

Incorrect– Board diversity is unrelated to Confidence Accounting.

C. An approach that encourages companies and audit firms to use regular statements in their AI software.

Incorrect– AI may use probability models, but Confidence Accounting is anaccounting methodology, not an AI approach.

D. An approach that encourages companies and audit firms to stop using figures and maths.

Incorrect– Confidence Accounting stillrelies on mathematical models; itdoes not eliminate numerical analysis.

PRMIA Financial Risk Reporting Standards

IFRS (International Financial Reporting Standards) Guidelines on Probability-Based Accounting

PRMIA References for Verification

WorldCom was one of the largest U.S. telecom companies before its collapse in 2002due tofraudulent accounting practices and poor risk management.

The companyexpanded aggressively through acquisitionsbutfailed to integrate them properly, leading tofinancial mismanagement and accounting fraud.

WorldComacquired over 60 companies in a short periodwithout proper integration.

Thismasked financial problemsand led to$11 billion in fraudulent accounting adjustments.

PRMIA and risk management frameworks stress thatpoor integration after rapid acquisitions increases operational and financial risks.

Option A ("Risk models and mortgage underwriting")→ Incorrect becausethis describes the 2008 financial crisis, not WorldCom.

Option B ("Lack of a CRO during IPO")→ Incorrect becauseWorldCom was well-established before its fraud—CRO absence was not the main issue.

Option D ("Unauthorized derivatives trading")→ Incorrect becauseWorldCom’s failure was due to fraudulent accounting, not derivatives.

Step 1: Understanding the WorldCom CaseStep 2: Why Option C is CorrectStep 3: Why the Other Options Are Incorrect

PRMIA Corporate Governance Guidelines– Discusses risks of poor post-merger integration.

SEC Investigation on WorldCom (2002)– Identified fraudulent accounting due to failed acquisitions.

PRMIA Risk References Used: