Charta is on Google Play: practise on the go. Get the app
Charta

Identify the approaches a firm ought to adopt to reduce the damage when an operational risk event occurs, and describe them.

FRM® Part II · Operational Risk and Resilience · Risk Mitigation · FRM2.ORR.5.f

The idea

When an operational risk event happens the aim is to limit the damage and recover quickly. Firms prepare an incident response and crisis management structure with clear roles and escalation, a business continuity plan with alternative sites, people and systems, and an IT disaster recovery capability. Two targets drive the design. The recovery time objective, RTO, is the longest acceptable time to restore a service. The recovery point objective, RPO, is the greatest amount of data, measured in time, that can be lost. Backup frequency must fit the RPO and failover speed must fit the RTO. Communication to customers, regulators and the public must be timely and factual. Afterwards firms recover losses, for example through insurance claims or legal action, and review the causes. Plans only work if tested through exercises. A common weakness is a backup that shares the same failure as the primary.

A practice question

From the question bank, with the reason each wrong option is wrong.

Which activity gives the most assurance that a business continuity plan will work in a real disruption?

  1. An annual review of the plan document's wordingWhy not: A document review does not show whether the plan can be executed under stress.
  2. Regular exercises and simulations that test the plan, with lessons acted upon - correct
  3. Storing the only copy of the plan on the primary production systemWhy not: If the primary system is down, the plan cannot be accessed when needed.
  4. Obtaining a written assurance from the main vendor that it will recover in a disruptionWhy not: A vendor's assurance is not a test of the firm's own ability to respond.

A plan that has never been exercised may fail through gaps, stale contacts or untested dependencies. Exercises expose these and train the people involved.

A harder one

A firm's critical system has an RPO of 1 hour and an RTO of 8 hours. Data is replicated to an offsite location every 4 hours. Does this meet the objectives?

  1. No, up to 4 hours of data could be lost, which exceeds the 1 hour RPO - correct
  2. Yes, because 4 hours is shorter than the 8 hour RTOWhy not: Confuses RPO with RTO; the replication interval governs data loss, not restoration time.
  3. Yes, because the copy is held offsiteWhy not: Location protects against site loss but says nothing about how recent the copy is.
  4. Yes, because the interval matters only for systems whose RTO is below 4 hoursWhy not: Replication frequency determines the data-loss window whatever the RTO.

With replication every 4 hours, a failure just before the next copy loses up to 4 hours of data. That is more than the 1 hour the firm can tolerate, so replication must be more frequent.

The hardest tier

Outages at a trading platform cost USD 0.5 million per hour of downtime. The probability of a major outage in a year is 4%. Without a standby site the recovery time is 36 hours; with a standby site costing USD 0.45 million per year it is 6 hours. The net annual expected benefit of the standby site is closest to:

  1. USD 0.60 millionWhy not: Counts the expected saving of 0.04 x 0.5 x 30 but ignores the annual cost of the standby site.
  2. USD 0.15 million - correct
  3. USD 14.55 millionWhy not: Ignores the 4% probability and treats the 30 hours saved as certain (15 - 0.45).
  4. USD 0.27 millionWhy not: Uses the full 36 hours instead of the 30 hours saved, giving 0.04 x 0.5 x 36 - 0.45.

Hours saved = 36 - 6 = 30. Expected annual saving = 0.04 x 0.5 x 30 = 0.60 million. Net of the 0.45 million cost this is 0.15 million.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Risk Mitigation