The point that this question is trying to emphasize is the independence of the risk management function. The risk function should be segregated from the risk taking functions as to maintain independence and objectivity.

Choice 'd', Choice 'c' and Choice 'a' run contrary to this requirement of independence, and are therefore not correct. The risk function should report directly to senior levels, for example directly to the audit committee, and not be a part of the risk taking functions.

In the Standardized Approach, banks’ activities are divided into eight business lines: corporate finance, trading & sales, retail banking, commercial banking, payment & settlement, agency services, asset management, and retail brokerage. Therefore Choice 'c' is the correct answer.

Strong management of collateral, both receivable and payable, is emerging as an area requiring significant investment by financial institutions and asset managers in IT infrastructures and business processes. A bank needs to make collateral calls daily, based upon the P & L of the previous day, and likewise receives collateral calls from its counterparties. Just like cash, a bank needs to make sure that it does not run out of collateral to post when a call is received. Interestingly, based upon the agreements between banks and their mutual understanding, only certain types of instruments often qualify as valid collateral - and in such cases even cash is not acceptable if the right type of bond or other agreed security is not available to post. The operational challenges of managing collateral increase manifold due to 'rehypothecation', ie when collateral received from one counterparty gets posted out as collateral where it is due. In such cases, the bank should have the mechanisms to receive the right assets back in a timely way in case rehypothecated assets are to be returned. The systems should be able to deal with delays, failures without impacting the ability of the bank to post collateral as needed. All of this requires major investments in IT and processes.

Statement I is not true as a bank is bound to post collateral to third parties when needed regardless of the failure of its counterparties to post collateral to it when owed. In the markets, failures by counterparties can and do happen, and a collateral management system needs to account for and keep a buffer for the fact that some collateral when due will not be received.

Statement II is not true as rehypothecation by counterparties of collateral posted increases the chances of the collateral not being received in time. The system should consider the need for liquidity to generate assets that can be posted as collateral when others have failed to return the collateral in a timely way.

Statement III is not correct as cash may not be acceptable to counterparties as collateral. From a practical point of view, they may not have the infrastructure to receive and account for cash as collateral. A Swiss bank, for example, may have an 'account' to receive US t-bills as collateral but may not even have a US dollar account to receive cash. Even if it did, the volumes of transactions going back and forth may make tracking and reconciliations impossible. Thus a bank should always make sure that it has the right type of collateral available to post.

Statement IV is incorrect as well, as treasury issued instruments are also subject to haircuts. Their value also fluctuates in response to changes in yields, and therefore they are subject to haircuts as well.

Thus none of the statements are correct and Choice 'd' is the correct answer.

All the factors listed above contributed to systemic failure. Liquidity risk was not on the radar of regulators, and was a second priority for risk managers, and most of the focus was on capital adequacy as liquidity was thought to be an unlikely problem. Liquidity, regardless of capital adequacy, was the primary cause of failure of a number of institutions during the crisis.

Similarly, stress tests proved to be much milder than the shocks that were actually experienced, and the strategy of 'originate and distribute' implied that the mortgage and other debt originators had no interest in any due diligence as they intended to package and sell the debt to other investors.

Therefore Choice 'd' is the correct answer.

Delta is non-linear with respect to prices for a number of securities such as bonds, options and other derivatives. It changes with changes in prices, and any hedge initially undertaken becomes quickly mismatched. Therefore delta hedges need to be managed quite actively and kept up-to-date. Therefore I is true. Primary risks comprise most of the risk in a position, and therefore portfolio managers are right to focus on them over secondary risks. Therefore II is true. The greater the hedge rebalance frequency, the lower is the hedge mismatch at any point in time, and therefore residual risks would be lower. However, rebalancing hedges requires rebalance trades to be done, and these involve transaction costs. Generally, a reasonable balance needs to be struck between the frequency of rebalances (a lower frequency increases residual risk, but this residual risk is not directionally biased) and the costs of rebalancing. III is correct. Vega risk is the risk arising due to changes in prices due to changes in volatility.  Options carry vega risk. Therefore any hedges against vega risks can only be obtained using other options positions.  (Vega risk may also be hedged using other volatility based products, eg an OTC volatility swap, or a VIX futures type product.)

Choice 'c' is the correct answer. Refer to the detailed loss event type classification under Basel II (see Annex 9 of the accord). You should know the exact names of all loss event types, and examples of each.

When a operational loss frequency distribution (which, for example, may be based upon a Poisson distribution) and a loss severity distribution (for example, based upon a lognormal distribution), it is assumed that the frequency of losses and the severity of the losses are completely independent and do not impact each other. Therefore statement II is correct, and the others are not valid assumptions underlying the operational loss distribution.

The current Basel rules for the basic VaR based charge for market risk capital set market risk capital requirements as the maximum of the following two amounts:

1. 99%/10-day VaR,

2. Regulatory Multiplier x Average 99%/10-day VaR of the past 60 days

The 'regulatory multiplier' is a number between 3 and 4 (inclusive) calculated based on the number of 1% VaR exceedances in the previous 250 days, as determined by backtesting.

- If the number of exceedances is < = 4, then the regulatory multiplier is 3.

- If the number of exceedances is between 5 and 9, then the multiplier = 3 + 0.2*(N-4), where N is the number of exceedances.

- If the number of exceedances is > =10, then the multiplier is 4.

So you can see that in most normal situations the risk capital requirement will be dictated by the multiplier and the prior 60-day average VaR, because the product of these two will almost often be greater than the current 99% VaR.

The correct answer therefore is = max(200mm, 3*250mm) = $750mm.

Interestingly, also note that a 99% VaR should statistically be exceeded 1%*250 days = 2.5 times, which means if the bank's VaR model is performing as it should, it will still need to use a reg multiplier of 3.

The correct answer is Choice 'b'. The following is a brief description of the major approaches available to model credit risk, and the analysis that underlies them:

1. CreditMetrics: based on the credit migration framework. Considers the probability of migration to other credit ratings and the impact of such migrations on portfolio value.

2. CreditPortfolio View: similar to CreditMetrics, but adds the impact of the business cycle to the evaluation.

3. The contingent claims approach: uses option theory by considering a debt as a put option on the assets of the firm.

4. KMV's EDF (expected default frequency) based approach: relies on EDFs and distance to default as a measure of credit risk.

5. CreditRisk+: Also called the 'actuarial approach', considers default as a binary event that either happens or does not happen. This approach does not consider the loss of value from deterioration in credit quality (unless the deterioration implies default).

While conceptually VaR is a fairly straightforward concept, a number of decisions need to be made to select between the different choices available for the exact mechanism to be used for the calculations.

There is more than one way to calculate returns. Absolute returns may be relevant for risk factors where the size of the movement is unrelated to its current value. For other risk factors, the returns might scale with the size of the existing value of the risk factor, eg equity prices. The right return definition needs to be adopted for each risk factor, therefore 'I' is a correct choice.

The risk analyst has a Choice 'b'etween parametric VaR, Monte Carlo, and historical simulation based VaR. 'II' therefore is one of the decisions that needs to be made (though historical simulation is the choice most often made).

The decision as to what to include in a portfolio is not a decision that is affected by choices made for VaR calculations. 'III' is therefore not a correct answer.

There are multiple ways to calculate volatility - including decisions on how long back in time to go for the data, and whether volatility clustering needs to be accounted for using EWMA or GARCH. Therefore 'IV' is a correct answer.