Impact Tolerance is a key concept in Operational Resilience , defined as the ability of a firm to withstand, respond to, and recover from disruptions. According to PRMIA and global regulatory frameworks (such as the Bank of England's Operational Resilience Framework ), impact tolerance is specifically tied to business services rather than processes .

Impact tolerance is the maximum acceptable level of disruption to an important business service , beyond which there would be intolerable harm to customers, financial markets, or regulatory obligations.

It is not the same as risk appetite or risk capacity , as those deal with broader organizational risk exposure.

PRMIA defines business services as end-to-end services delivered to clients and stakeholders , such as payments processing, trade execution, or loan approvals.

Disruptions to these services directly impact customers and financial stability , making business service resilience the core focus of impact tolerance.

Option A ("tolerance for disruption to a particular business process")

Incorrect because impact tolerance applies to services , not just internal processes.

Option C ("a firm's risk appetite statement")

Incorrect because risk appetite focuses on how much risk a firm is willing to take, while impact tolerance is about surviving disruptions .

Option D ("a firm's risk capacity statement")

Incorrect because risk capacity is the maximum level of risk a firm can bear , which is broader than business service disruptions.

Step 1: Defining Impact Tolerance Step 2: Why Business Services Matter Step 3: Why the Other Options Are Incorrect

PRMIA Operational Resilience Guidelines – Defines impact tolerance as a service-based metric.

Bank of England’s Operational Resilience Framework – Establishes impact tolerance as a limit on business service disruption.

PRMIA Risk References Used:

Final Conclusion: Impact tolerance focuses on business services, not just internal processes or risk appetite , making Option B the correct answer .

Definition of Bottom-Up KRIs

Bottom-Up Key Risk Indicators (KRIs) are identified at the operational level , focusing on localized risks within business units.

They are tied to actual internal loss events and reported frequently (daily, weekly, or monthly) to capture ongoing trends.

Key Properties of Bottom-Up KRIs

Selected by local management → Ensures relevance to specific business areas .

Tied to internal loss events → Helps in tracking risk patterns within specific legal entities, countries, or business units .

Reported frequently → Allows for timely risk detection and mitigation .

Why Answer D is Correct

Bottom-up KRIs focus on localized risk exposure and are monitored frequently to track operational changes.

Why Other Answers Are Incorrect

Option

Explanation

A. Seated by senior management: tied to internal loss events at the legal entity, country, business, and/or product level, reported daily, weekly, or monthly.

Incorrect – Senior management sets top-down KRIs , while bottom-up KRIs are managed locally.

B. Selected by local management, based on key controls or weaknesses identified by audit reports, reported quarterly.

Incorrect – While audit reports are useful, bottom-up KRIs are based on loss events, not just audit findings . Quarterly reporting is too infrequent.

C. Are not used due to changes in regulations.

Incorrect – Bottom-up KRIs remain essential despite regulatory changes.

PRMIA Risk Indicator Best Practices

Basel Committee’s Risk Measurement and Reporting Guidelines

PRMIA References for Verification

Definition of Key Risk Indicators (KRIs)

KRIs are quantitative metrics used to monitor risk levels and detect early warning signs of potential risk events.

Top-down KRIs are identified at the senior management level and focus on enterprise-wide risk exposure .

Key Properties of Top-Down KRIs

Selected by senior management to ensure alignment with strategic objectives.

Tied to material external and internal loss exposures to capture critical financial, operational, and strategic risks.

Used to manage changes in the business environment to ensure proactive risk response, especially under stress conditions.

Why Other Answers Are Incorrect

Option

Explanation

B. Selected by senior management, used to manage changes in the business environment, especially under periods of stress, and reported on a daily basis.

Incorrect – Top-down KRIs are not reported daily ; they are monitored periodically (e.g., quarterly).

C. Selected by junior management, used to manage changes in the business environment, especially under periods of stress, and reported on an annual basis.

Incorrect – Junior management does not define top-down KRIs ; senior management does. Also, annual reporting is too infrequent.

D. Can only be selected by the board in line with risk ratings.

Incorrect – The board provides oversight, but senior risk management selects KRIs , not just the board.

PRMIA Risk Indicator Guidelines

Basel Committee on Banking Supervision (BCBS) Principles for Effective Risk Data Aggregation

PRMIA References for Verification

Risk-sensitive pricing ensures that financial institutions and businesses properly account for risk in their pricing strategies to maintain stability and sustainability. PRMIA’s Risk Pricing and Capital Adequacy Guidelines define the importance of risk-sensitive pricing in ensuring fair compensation for risk exposure and avoiding risk concentration issues .

Aligns risk with return : Pricing should be designed to reflect the underlying risk and return trade-off.

Protects investors : Investors expect compensation for capital at risk ( Option A is correct).

Reinforces risk-aware culture : PRMIA promotes linking incentives to risk-adjusted returns ( Option B is correct).

Prevents adverse selection : Proper risk pricing prevents low-quality assets from accumulating ( Option C is correct).

Income targets are business-driven, not risk-driven .

Risk-sensitive pricing aims to balance risk and reward , not just maximize revenue.

PRMIA discourages profit-seeking behavior at the expense of risk considerations .

Step 1: Why Risk-Sensitive Pricing Is Important Step 2: Why Option D Is Incorrect

PRMIA Risk Pricing Guidelines – Defines the principles of risk-sensitive pricing.

PRMIA Risk-Adjusted Return Standards – Stresses linking incentives to risk-aware decisions.

PRMIA Capital Adequacy Framework – Highlights the role of risk-sensitive pricing in portfolio management.

PRMIA Risk References Used:

Final Conclusion: Risk-sensitive pricing is designed to align returns with risk exposure , not simply to meet or exceed income targets , making Option D the correct answer .

A Risk Function ensures that an organization follows best practices in risk governance, assessment, and control implementation .

It should be aligned with the board’s risk strategy and ensure independent oversight .

The board sets the overall risk strategy , and the risk function implements risk controls accordingly .

PRMIA emphasizes board oversight as the guiding force behind risk management .

Option A ("Implement management’s direction") → Incorrect because risk oversight should be board-driven, not solely management-driven .

Option C ("Ensure opinions are listened to") → Incorrect because risk functions enforce policies, not just share opinions .

Option D ("Lower risk-taking to zero") → Incorrect because risk-taking is necessary for growth—excessive risk aversion harms business .

Step 1: Role of a Risk Function Step 2: Why Option B is Correct Step 3: Why the Other Options Are Incorrect

PRMIA Risk Governance Framework – Highlights board oversight in risk management.

Basel III Risk Management Standards – Emphasizes board-driven risk controls.

PRMIA Risk References Used:

Final Conclusion: The Risk Function must follow the board’s direction in implementing risk controls , making Option B the correct answer .

OFAC (Office of Foreign Assets Control) is a U.S. Treasury Department agency responsible for enforcing economic and trade sanctions based on U.S. foreign policy and national security goals.

It prevents financial crime by restricting transactions with sanctioned individuals, entities, and countries .

OFAC administers sanctions to prevent money laundering, terrorism financing, and other illicit activities .

Financial institutions must comply with OFAC regulations to avoid heavy fines and reputational damage .

PRMIA’s Financial Crime Risk Guidelines emphasize the importance of OFAC compliance in risk management.

Option A ("Office of Financial Asset Control") – Incorrect wording; OFAC deals with foreign assets, not just financial assets.

Option B ("Office of Foreigner and Other Control") – OFAC does not regulate foreigners broadly; it targets specific foreign assets and transactions .

Option C ("Office for Asset Control") – Missing "Foreign" , which is critical to OFAC’s function.

Step 1: Understanding OFAC Step 2: Role of OFAC in Financial Crime Prevention Step 3: Why the Other Options Are Incorrect

PRMIA Financial Crime Risk Management Guidelines – Emphasizes regulatory compliance with OFAC.

PRMIA Compliance and Sanctions Risk Standards – Stresses the role of OFAC in preventing illicit financial activities.

PRMIA Risk References Used:

Final Conclusion: OFAC stands for the Office of Foreign Assets Control , making Option D the correct answer .

The Business Indicator (BI) is a financial-statement-based metric used in Basel III's Standardized Approach for Operational Risk .

It replaces previous approaches by using financial figures (e.g., revenue, fees, interest income) to estimate operational risk exposure.

The BI uses financial-statement data to calculate operational risk capital requirements .

It acts as a proxy for a bank’s operational risk exposure by linking operational risk to its financial size and complexity .

Option A ("Proxy for near-miss events") → Incorrect because BI is based on financial data , not near-miss risk events.

Option B ("Non-financial-statement-based proxy") → Incorrect because BI is explicitly derived from financial statements .

Option C ("Scaling factor based on historical losses") → Incorrect because BI does not use historical losses directly—it relies on financial-statement inputs .

Step 1: Definition of the Business Indicator (BI) in Basel III Step 2: Why Option D Is Correct Step 3: Why the Other Options Are Incorrect

Basel III Operational Risk Framework – Defines the Business Indicator as a financial-statement-based metric.

PRMIA Operational Risk Guidelines – Explains the BI’s role in capital calculations.

PRMIA Risk References Used:

Team supervisors play a critical role in shaping and maintaining an organization's risk culture . PRMIA's Risk Governance Framework and Risk Culture Principles emphasize that supervisors act as the link between risk policies and frontline employees , ensuring that risk-aware behaviors are consistently followed.

Supervisors engage with employees daily , providing guidance on risk-based decision-making.

They reinforce risk policies, standards, and expectations set by senior management.

Supervisors identify behavioral trends that may indicate risk culture weaknesses.

PRMIA’s Risk Culture Framework stresses that risk culture must be embedded into daily operations through supervisor-led enforcement.

Supervisors monitor, correct non-compliant behaviors , and provide ongoing risk awareness training .

Their proximity to employees allows them to detect early warning signs of risk issues .

Option A: "More experienced than the employees that report to them."

Experience alone does not establish or maintain a risk culture.

A risk culture is about behaviors and practices , not just expertise.

Option B: "Visible to regulators and can describe the firm's risk culture to inspection teams."

While supervisors may interact with regulators, their primary role is to engage with employees daily rather than acting as spokespersons.

Option D: "Visible to regulators and can describe the firm's risk culture to their board."

Boards typically rely on Chief Risk Officers (CROs) or senior executives to communicate risk culture, not direct supervisors.

Step 1: Role of Supervisors in Risk Culture Development Step 2: Supervisors as Enforcers of Risk Culture Step 3: Why the Other Options Are Incorrect

PRMIA Risk Culture Framework – Highlights the role of supervisors in ensuring risk-aware behaviors.

PRMIA Risk Governance Framework – Stresses that frontline supervisors must enforce risk management policies.

PRMIA Risk Awareness Guidelines – Reinforces daily interaction as a key factor in maintaining a strong risk culture.

PRMIA Risk References Used:

Final Conclusion: Supervisors directly influence employees' behaviors and ensure that risk culture is consistently followed, making Option C the correct answer.