A well-designed policy should include:

Scope – Who the policy applies to.

Exception Handling – How and where exceptions should be requested.

Accountability – Who is responsible for enforcement.

A policy must clearly define exceptions and the process for requesting them .

It should also define areas where the policy does not apply to avoid confusion.

Option A ("List of exceptions for board members' families") → Incorrect because policies should apply consistently to all stakeholders .

Option B ("List of acceptable fonts and margin types") → Incorrect because formatting is secondary to content clarity .

Option D ("To whom the policy applies and an additional management report") → Incorrect because policy scope should not include unnecessary reports .

Step 1: Key Elements of a Well-Designed Policy Document Step 2: Why Option C is Correct Step 3: Why the Other Options Are Incorrect

PRMIA Policy Writing Guidelines – Defines policy structure and exception handling.

ISO 19600 Compliance Management Standard – Supports clear, well-documented policies.

PRMIA Risk References Used:

Final Conclusion: A well-designed policy clearly defines exceptions and their handling process , making Option C the correct answer .

Key Resources for Calibrating Risk Appetite

Risk appetite defines how much risk an organization is willing to accept to achieve its objectives.

Two of the most critical resources for maintaining confidence and setting risk appetite are net earnings and capital .

Why Net Earnings and Capital are Critical

Net earnings reflect profitability and financial stability , influencing risk-taking capacity.

Capital ensures that the institution can absorb losses and meet regulatory requirements.

Basel III emphasizes capital adequacy as a core measure of financial resilience.

Why Answer B is Correct

Net earnings support operational stability , while capital determines how much risk an institution can bear .

Both are used to define and calibrate risk appetite levels .

Why Other Answers Are Incorrect

Option

Explanation

A. Capital expenditure and liquidity.

Incorrect – Capital expenditure is an investment measure , not a direct risk appetite determinant.

C. Strong regulatory assessment and net earnings.

Incorrect – Regulatory assessments are important but do not directly set risk appetite .

D. Quality human resources and reputation.

Incorrect – HR and reputation are important for governance but do not directly influence risk capital and earnings stability .

PRMIA Risk Appetite Framework

Basel III Capital and Earnings Management Guidelines

PRMIA References for Verification

The Turnbull Report (1999) was a UK corporate governance report that set risk management expectations for boards .

It required companies to assess and manage risks effectively as part of corporate governance.

Turnbull was the first report to mandate that boards must consider risk management in corporate governance .

This report established risk assessment as a board-level responsibility .

Option A ("Defined risk governance for insurance") → Incorrect because Turnbull applied to all sectors, not just insurance .

Option B ("First report to propose board structure") → Incorrect because corporate boards existed long before Turnbull .

Option D ("Led to the US Federal Reserve") → Incorrect because the Federal Reserve was established in 1913, long before Turnbull .

Step 1: What Is the Turnbull Report? Step 2: Why Option C is Correct Step 3: Why the Other Options Are Incorrect

PRMIA Corporate Governance Guidelines – Highlights Turnbull's role in board-level risk oversight.

UK Corporate Governance Code – Turnbull contributed to defining board risk responsibilities.

PRMIA Risk References Used:

Final Conclusion: The Turnbull Report was the first to require boards to consider risks in corporate governance , making Option C the correct answer .

Understanding Zero Risk Appetite in Compliance

A zero risk appetite means the organization does not tolerate any compliance breaches .

However, in real-world risk management , it is often impractical to have zero risk exposure.

Some compliance violations may occur despite strong controls , making a strict zero-risk stance unrealistic .

Why Answer C is Correct

If an organization adopts a zero risk appetite for compliance , any compliance issue, even minor ones, would breach this policy .

This contradicts practical risk management , which allows for some residual risk while maintaining controls .

Why Other Answers Are Incorrect

Option

Explanation

A. A zero risk appetite is illegal under all known regulations.

Incorrect – It is not illegal , but it is impractical in many industries.

B. It means that there can be a risk self-assessment workshop for the compliance department.

Incorrect – Self-assessments are part of compliance but do not define zero risk appetite issues .

D. It will result in a compliance investigation conducted by the first line.

Incorrect – Investigations are typically conducted by the second or third line of defense (compliance or audit) , not the first line.

PRMIA Risk Appetite Guidelines

Basel & ISO 31000 Risk Management Frameworks

PRMIA References for Verification

Risk Appetite is the amount of risk an organization is willing to take to achieve its objectives .

A Risk Appetite Statement (RAS) communicates risk tolerance levels and management expectations .

Risk Capacity (not Risk Appetite) defines the maximum risk the firm can withstand .

Risk Appetite is about willingness to take risk, not the absolute limit .

Option A ("Improves risk management standards") → Correct , as RAS helps define better risk management .

Option B ("Governing body articulates expectations") → Correct , as RAS is approved by the board .

Option D ("Assists strategic discussions") → Correct , as RAS guides decision-making .

Step 1: Understanding a Risk Appetite Statement Step 2: Why Option C is Incorrect Step 3: Why the Other Options Are Correct

PRMIA Risk Appetite Framework – Differentiates between Risk Appetite and Risk Capacity.

Basel III Governance Principles – Encourages organizations to establish clear risk appetite statements.

PRMIA Risk References Used:

Final Conclusion: Risk Appetite does not establish the maximum risk the firm can withstand —that is Risk Capacity , making Option C the correct answer .

Definition of DORA

The Digital Operational Resilience Act (DORA) is a regulation by the European Union (EU) aimed at strengthening the digital resilience of financial institutions.

It establishes a regulatory framework for managing information and communication technology (ICT) risks in the financial sector.

Key Objectives of DORA

Ensures that financial institutions can withstand, respond to, and recover from cyber threats and ICT-related disruptions .

Introduces standards for risk management, incident reporting, and third-party ICT risk oversight .

Why Other Answers Are Incorrect

Option

Explanation

A. Domain for Operational Risk Act.

Incorrect – No such regulation exists under this name.

B. Digital Operational Risk Act.

Incorrect – The official name is Digital Operational Resilience Act (DORA).

C. Daily Operational Resilience Act.

Incorrect – DORA is not focused on daily operations but rather long-term digital resilience .

PRMIA Risk Governance & Digital Resilience Standards

European Commission’s Official DORA Regulation

PRMIA References for Verification

Risk Capacity refers to the maximum level of risk a bank can absorb while still maintaining orderly operations or, in extreme cases, conducting an orderly resolution .

PRMIA and Basel III define risk capacity as a bank’s ability to absorb losses in a crisis without systemic consequences .

The ultimate test of a bank’s risk capacity is whether it can survive an extreme shock without harming depositors or financial markets .

Regulators ensure that a bank can be wound up in an orderly manner so that only shareholders lose money , while depositors and creditors remain protected under resolution planning frameworks .

Option A ("Amount of risk the bank wishes to take")

Incorrect because this describes Risk Appetite , not Risk Capacity .

Option B ("Amount of risk the regulator sets for the bank")

Incorrect because regulators set capital requirements , but the bank's actual risk capacity is based on its own capital structure and business model.

Option C ("Ability to withstand an extreme event and make a profit")

Incorrect because risk capacity is about survival , not profit-making during extreme events.

Step 1: Definition of Risk Capacity Step 2: Why Option D Is Correct Step 3: Why the Other Options Are Incorrect

Basel III Risk Capacity Standards – Defines the ability to absorb losses during crises.

PRMIA Risk Governance Framework – Describes how banks should manage risk capacity through capital buffers.

PRMIA Risk References Used:

Final Conclusion: Banks must be able to withstand an extreme event and conduct an orderly wind-up if necessary , ensuring that only shareholders bear the loss , making Option D the correct answer .