Choice ' a ' is the correct answer. Refer to the detailed loss event type classification under Basel II (see Annex 9 of the accord). You should know the exact names of all loss event types, and examples of each.

Component VaR measures the proportion of total VaR that can be allocated to each asset in the portfolio. It is based upon the covariance matrix multiplied by the weights, and each row represents the component VaR for the asset in question. Since the total of such a matrix is the total VaR, component VaR is additive. Component VaR is used to assess the contribution of each asset in the portfolio to total risk and has the useful property of being additive so some sense can be made of the contribution of each asset to total risk.

Incremental VaR, conditional VaR and VaR are sub-additive by definition, and therefore not the correct answer.

Choice ' d ' is the correct answer, as laid down in the Basel II document. The other choices are incorrect.

While conceptually VaR is a fairly straightforward concept, a number of decisions need to be made to select between the different choices available for the exact mechanism to be used for the calculations.

There is more than one way to calculate returns. Absolute returns may be relevant for risk factors where the size of the movement is unrelated to its current value. For other risk factors, the returns might scale with the size of the existing value of the risk factor, eg equity prices. The right return definition needs to be adopted for each risk factor, therefore ' I ' is a correct choice.

The risk analyst has a Choice ' b ' etween parametric VaR, Monte Carlo, and historical simulation based VaR. ' II ' therefore is one of the decisions that needs to be made (though historical simulation is the choice most often made).

The decision as to what to include in a portfolio is not a decision that is affected by choices made for VaR calculations. ' III ' is therefore not a correct answer.

There are multiple ways to calculate volatility - including decisions on how long back in time to go for the data, and whether volatility clustering needs to be accounted for using EWMA or GARCH. Therefore ' IV ' is a correct answer.

A CFP is indeed a disaster recovery plan to deal with a liquidity crisis. Therefore statement I is correct.

A CFP should consider market stress conditions, including wide scale failures of payment and settlement systems. Statement II is not correct.

It is true that reputational damage may result if a firm has to activate its CFP - therefore the plan should consider internal and external communications, the timing of information release and the groups within the firm who need to know about the implementation of the plan. Reputational damage can only make any existing liquidity problems worse. Statement III is correct.

Sources of emergency funding should not include funding from the central bank - unless as part of a regular lending facility. Its role as a lender of last resort can not be considered in a CFP. Statement IV is incorrect.

Therefore only statements I and III are correct.

A recap would be in order here: calculating operational risk capital is a multi-step process.

First, we fit curves to estimate the parameters to our chosen distribution types for frequency (eg, Poisson), and severity (eg, lognormal). Note that these curves are fitted at the UoM level - which is the lowest level of granularity at which modeling is carried out. Since there are many UoMs, there are are many frequency and severity distributions. However what we are interested in is the loss distribution for the entire bank from which the 99.9th percentile loss can be calculated. From the multiple frequency and severity distributions we have calculated, this becomes a two step process:

- Step 1: Calculate the aggregate loss distribution for each UoM. Each loss distribution is based upon and underlying frequency and severity distribution.

- Step 2: Combine the multiple loss distributions after considering the dependence between the different UoMs. The ' dependence ' recognizes that the various UoMs are not completely independent, ie the loss distributions are not additive, and that there is a sort of diversification benefit in the sense that not all types of losses can occur at once and the joint probabilities of the different losses make the sum less than the sum of the parts.

Step 1 requires simulating a number, say n, of the number of losses that occur in a given year from a frequency distribution. Then n losses are picked from the severity distribution, and the total loss for the year is a summation of these losses. This becomes one data point. This process of simulating the number of losses and then identifying that number of losses is carried out a large number of times to get the aggregate loss distribution for a UoM.

Step 2 requires taking the different loss distributions from Step 1 and combining them considering the dependence between the events. The correlations between the losses are described by a ' copula ' , and combined together mathematically to get a single loss distribution for the entire bank. This allows the 99.9th percentile loss to be calculated.

The square root of time rule cannot be applied here because the returns across the periods are not independent. (Recall that the square root of time rule requires returns to be iid, independent and identically distributed.) Here there is a ' autocorrelation ' in play, which means one period ' s returns affect the returns of the other period.

VaR is merely a multiple of volatility, or standard deviation, using the factor for the desired confidence level. VaR across time periods can be combined using the square root of time rule, in fact if returns were independent we could have easily calculated the VaR for the 20-day period as equal to $100m*SQRT(20/10) = $141.4m

But in this case we need to account for the autocorrelation. We can do this akin to the way we combine the VaR of different assets that have a given correlation. Since we know that:

Variance (A + B) = Variance(A) + Variance(B) + 2*Correlation*StdDev(A)*StdDev(B).

The standard deviation, which the VaR is a multiple of, can be calculated by taking the square root of the variance.

Therefore the combined VaR over the two months will be equal to =SQRT( (100^2) + (100^2) + 2*0.2*100*100 )= $154.92m. All other answers are incorrect.

The greatest model risk when calculating operational risk capital comes from incorrect assumptions about correlations between different operational risks for which standalone risk calculations have been made. Generally, the correlation can be expected to be positive, and would therefore vary between 0 and 1. These two values determine the ' bounds ' between which the total operational risk capital would lie, and these bounds are generally quite far apart. Therefore the total value of the operational risk capital is very sensitive to the value chosen for the correlation, and this is the source of the biggest model risk under the AMA.

Suppose during a historical event interest rates rose from 2% to 2.25%. This can be understood as a change of either 25 basis points, or a change of 12.5%. When applied to the current portfolio when interest rates are 0.50%, we may model this ' shock ' as either a rise to 0.75%, or 0.5625% (ie a rise of 12.5% over existing levels). The former is called an absolute shock, and the latter a relative shock.

I is true as relative shocks can never change the sign of a risk factor. Yet interest rate changes are modeled as absolute changes as relative shocks can get artificially amplified or attenuated if the current level of interest rates is too different from those that existed during the crisis being modeled. Therefore II is true. III and IV are false as volatility is modeled as a relative shock and spreads are modeled as absolute shocks.

Governance structures specify the policies, principles and procedures for making decisions about corporate direction. They distribute rights and responsibiliies among stakeholders that typically include executive management, employees, the board etc. Statement I is therefore correct.

" Cybernetics is a transdisciplinary approach for exploring regulatory systems, their structures, constraints, and possibilities. In the 21st century, the term is often used in a rather loose way to imply " control of any system using technology " (Wikipedia). Governance literature has been affected by cybernetics, which is not the same thing as information security or cyber security. Statement II is incorrect.

Corporate governance includes risk governance, and not the other way round. Therefore statement III is incorrect.

The Cadbury Report, titled Financial Aspects of Corporate Governance, was a report issued in the UK in December 1992 by " The Committee on the Financial Aspects of Corporate Governance " . The report is eponymous with the chair of the committee, and set out recommendations on the arrangement of company boards and accounting systems to mitigate corporate governance risks and failures. Statement IV is therefore correct.