8010 PRMIA Operational Risk Manager (ORM) Exam Free Practice Exam Questions (2025 Updated)

Statement I is correct. Retail Risk Based Pricing (RRBP) involves the use of borrower specific data (such as FICO scores, average balances etc) to arrive at credit decisions. These 'retail' credit decisions may include decisions on whether to grant a line of credit, a mortgage, issue a credit card, or any of the various other retail activities abank may be dealing with. At the same time, this data can also be used to price the product, in addition to providing a yes or no credit decision so that risky borrowers are charged more than less risky borrowers.

Statement II is not correct, because an integrated Risk Information Management Environment includes three elements - people, processes and technology (and not just people and processes).

Statement III is correct. An LDM is a blue print of an organization's data, and describes the relationships between the various data elements.

Statement IV is not correct because reference data and metadata are not the same thing. Reference data refers to relatively static data, such as customer name (while actual transactions may not be so static). Metadata refers to data about data, and is stored in a data dictionary.

Therefore Choice 'b' is the correct answer and the rest are incorrect.

All of the properties described are the properties of a 'coherent' risk measure.

Monotonicity means that if a portfolio's future value is expected to be greater than that of another portfolio, its risk should be lower than thatof the other portfolio. For example, if the expected return of an asset (or portfolio) is greater than that of another, the first asset must have a lower risk than the other. Another example: between two options if the first has a strike price lower thanthe second, then the first option will always have a lower risk if all other parameters are the same. VaR satisfies this property.

Homogeneity is easiest explained by an example: if you double the size of a portfolio, the risk doubles. The linear scaling property of a risk measure is called homogeneity. VaR satisfies this property.

Translation invariance means adding riskless assets to a portfolio reduces total risk. So if cash (which has zero standard deviation and zero correlation with other assets) is added to a portfolio, the risk goes down. A risk measure should satisfy this property, and VaR does.

Sub-additivity means that the total risk for a portfolio should be less than the sum of its parts. This is a property that VaR satisfies most of thetime, but not always. As an example, VaR may not be sub-additive for portfolios that have assets with discontinuous payoffs close to the VaR cutoff quantile.

Choice 'd' is the correct answer. Settlement risk, as the name suggests, arises upon settlement when one of the parties delivers its obligation under the transaction and the other does not. Consider a EUR/USD FX forward contract maturing in a month. At maturity, one of the parties will deliver EURs and the other USDs. If one party fails to deliver, then it constitutes a very large risk to the other party. This risk is much larger than pre-settlement risk, because the amount at risk is the entire notional and not just the replacement value. Of course, settlement risk exists for a very short period of time, no more than a number or hours or a day.

There is no such thing as 'replacement risk', and credit risk is a larger category of which settlement risks is one component. Settlement risk is the most appropriate answer.

The 'middle office' is a term used for the risk management function, thereforeChoice 'd' is the correct answers. The other functions describe what the 'back office' does (IT, accounting). The 'front office' includes the traders.

The CDS rate is approximated by the [Loss given default x Default hazard rate]. Thus Choice 'b' is the correctanswer.

Note that this is also equal to the credit spread on the reference bond over the risk free rate. Therefore credit spreads and CDS rates are generally the same. Also, 'loss given default' is nothing but (1 - Recovery rate). This can besubstituted in the formula for the credit spread to get an alternative expression that directly refers to the recovery rate. Therefore all other choices are incorrect.

A situation where a firm has more liabilities than assets does not necessarily implydefault, so long as the firm is able to pay its obligations when they come due. Therefore, short term debts have a greater bearing on a firm's default than longer term debt. However, this is not to say that merely having enough to pay off the short term debts (ie debts due within one year) is enough to avoid default. Over time, the long term debt will also be turning to short term debt, and it may not be possible for the firm to roll over its liabilities without lenders considering the long term debt. The KMV approach considers the entire short term debt and half of the long term debt as the critical value of assets below which default will be triggered. Therefore Choice 'c' is the correct answer.

Economic capital is a measure of the level of capital needed to maintain adesired credit rating. Regulatory capital is the amount of capital required to be held by regulation, and this may be quite different from economic capital. Book value is an accounting measure reflecting the assets minus liabilities as measured per accounting rules, this is often expressed per share. Shareholders' equity is a narrow term which is the amount of capital attributable to the shareholders and includes paid up capital and reserves but not long term debt or other non-equity funding.

Therefore Choice 'b' is the correct answer.

Theprobability of default would make the future cash flows from both the bonds identical. If p be the probability of default, the cash flows from the risky corporate bond would be

= (cash flows in the event of default x probability of default) + (cash flows without default x (1 - probability of default))

=> p*0 + (1 - p)*(1 + 8.5%) = (1 - p)*1.085.

The cash flows from the treasury bond would be 1.04. These two should be equal, ie,

1.04 = (1- p)*1.085, implying p = 4.15%.

(Note: The above is a simplification intended for the exam. In reality investors would demand a 'credit risk premium' for the corporate bond over and above the expected default loss rate. They are unlikely to be happy with just being compensated with exactly the expected default loss rate plus the risk-fre rate because the expected default loss rate itself is uncertain. They would demand some premium over and above what the default rate alone might mathematically imply above the risk free rate. In this question, this credit risk premium is ignored.)

The beta distribution is commonly used to model recovery rates. It is a distribution forvariables whose values lie between 0 & 1, and the parameters of the distribution can be estimated using the mean and standard deviation of the data. Therefore Choice 'a' is correct and the others are wrong.

Refer to the tutorial on distributions for an Excel model of the beta distribution.

Top down approaches do not consider event frequency and severity, on the otherhand they focus on high level available data such as total capital, income volatility, peer group information on risk capital etc. Bottom up approaches focus on severity and frequency distributions for events. Statement I is therefore not correct.

Top downapproaches do indeed rely upon high level aggregate data and tend to infer operational risk capital requirements from these. Bottom up approaches look at more detailed firm specific information. Statement II is correct.

Scenario analysis requires estimating losses from risk scenarios, and allows incorporating the judgment and views of managers in addition to any data that might be available from internal or external loss databases. Statement III is correct. Therefore Choice 'b' is the correct answer.

Right after inception' is incorrect as the interest rate swap (IRS) would be valued at close to zero right after inception and the credit risk would be minimum. Choice 'a' (ie 10 years, at maturity) is incorrect as at maturity there would be no more cash flows to exchange, and the replacement value of the contract would again be close to zero.

Therefore the worst time for the counterparty to default is somewhere between inception and maturity - in fact the range of possible outcomes for the contract increases with the passage of time, and we should find the worst time to default to be a later date. However, towards maturity, the value of the contract starts to go towards zero again, and the maximum value is reached around 7 years. 2 years is too early for the maximum to be reached for the10 year IRS, and therefore choice a is the correct answer.

Gross income is defined by Basel II (see para 650 of the Basel standard) as net interest income plus netnon-interest income. It is intended that this measure should: (i) be gross of any provisions (e.g. for unpaid interest); (ii) be gross of operating expenses, including fees paid to outsourcing service providers; (iii) exclude realised profits/losses from the sale of securities in the banking book; and (iv) exclude extraordinary or irregular items as well as income derived from insurance.

What this means is that gross income is calculated without deducting any provisions or operating expenses from net interest plus non-interest income; and does not include any realised profits or losses from the sale of securities in the banking book, and also does not include any extraordinary or irregular item or insurance income.

Therefore operating expenses are to be notto be deducted for the purposes of calculating gross income, and neither are any provisions. Profits and losses from the sale of banking book securities are not considered part of gross income, and so isn't any income from insurance or extraordinary items.

Of the listed choices, only net non-interest income needs to be included for gross income calculations, and the others are to be excluded. Therefore Choice 'd' is the correct answer. Try to remember the components of gross income from the definition abovebecause in the exam the question may be phrased differently.

An interesting property that distinguishes the three most used distributions for modeling event frequency is that for a given mean, their variances differ. The ratio of variance to mean (the variance-mean ratio, calculated as variance/mean) can then be used to decide the kind of distribution to use. Both the variance and the mean can be estimated from available data points from the internal or external loss databases, or the scenario exercise.

The variance-mean ratio reflects how dispersed a distribution is. (In the PRMIA handbook, the variance to mean ratio has been described as the "Q-Factor".)

The Poisson distribution has its mean equal to its variance, and therefore the variance to mean ratio is 1. For the negative binomial distribution, this ratio is always greater than 1, which means there is greater dispersion compared to the mean - or more intervals with low counts as well as more intervals with high counts. For the binomial distribution, the variance to mean ratio is less than one, which means it is less dispersed than the Poisson distribution with values closer to the mean.

In a situation where operational risk events are seen as clustering together, ordependent, the variance will be higher and it would be more appropriate to use the negative binomial distribution.

Credit risk is the risk from a borrower defaulting on moneys lent. Counterparty risk, on the other hand, is the risk that a counterparty to a derivativetransaction will be unable to pay at the time the transaction is in-the-money.

Credit risk therefore relates more to the banking book, counterparty risk relates more to the trading book. Credit risk and counterparty risk differ in that for counterparty risk, the amount at risk fluctuates for counterparty risk depending upon the value of the underlying derivative. Counterparty risk generally starts at zero, for most swaps and other derivatives are near zero value at inception. Over time, as the prices of theunderlying instruments move, one party ends up owing money to the other. A deterioration in the financial situation of the party owing moneys may lead to a loss to the other party, resulting in counterparty risk. Counterparty risk can also arise from stock lending operations and repo trades.

Credit risk on the other hand is the traditional risk of default by a borrower, or a bank's customer who has taken a loan or has an overdraft or other credit facility.

Statement I is therefore incorrect as credit riskand counterparty risks are different.

Statement II is correct as counterparty risk is 'contingent' in the sense it arises only if the transaction with the counterparty ends up being in-the-money, and the counterparty defaults.

Statement III is incorrect. The statement describes credit risk.

Statement IV is incorrect, as the exposure is known for moneys lent. Derivative exposures for the future are difficult to estimate, they can even turn from moneys owed to moneys due as the value of the underlying changes.

Statutory financial reporting is the responsibility of the Chief Financial Officer, not the Chief Risk Officer. The head of internal audit reports to theaudit committee of the board, not the CRO. Therefore statements I and II are incorect.

The CRO is generally expected to drive risk and compliance with related regulatory standards. Market risk, credit risk and operational risk groups report into the CRO, so statements III and IV are correct.

This question relates to fitting a distribution to the true severity of the operational risk loss we are trying to model. The quality of the fit, or the precision of the fit, has two elements to the difference between the severity as represented by our model and the true severity. To understand this, consider the three data points below:

a. The true severity,

b. The best approximation of the true severity in the model space, and

c. The fit based on the dataset.

- True severity is what we are trying to model.

- The model space refers to the collection of analytical distributions (log-normal, burr etc) that we are considering to arrive at the estimate of the severity.

- The 'best approximation of the true severity in the model space' is reached byestimating the parameters of the distribution that optimizes the risk functional.

- The 'fit' is the actual parameter estimates we settle for with the distribution we have determined best fits the true estimate of our severity. When estimating parameters,we have various methods available for estimation - the least squares method, the maximum likelihood method, for example, and we can get different estimates depending upon the method we choose to use.

Our severity model will be different from the true severity, and the total difference can be split into two types of errors:

1. Fitting error, represented by 'c - b' above: The difference between the fit based on the dataset and the best approximation of the true severity is called 'fitting error', ie, a measure of the extent to which we could have estimated the parameters better.

2. Approximation error, represented by 'b - a' above: Approximation error is the difference between the true severity, and the best approximation of the true severity that can be achieved within the model space is called 'approximation error'.

One can reduce the approximation error by expanding the model space by adding more distributions. This will reduce the approximation error, but generally has the effect of increasing the fittingerror because the complexity of the model space increases, and there are more ways to fit to the true severity.

Assuming timeinvariance and the Markov property, it is easy to calculate the transition matrix for any time period as P^n, where P is the given transition matrix for one period and n the number of time periods that we need to compute the new transition matrix for. ThusChoice 'b' is the correct answer.

Risks such as abrupt changes to a firm's businessmodel caused by legislation, or the introduction of capital controls in foreign countries where a firm in invested, geo-political risks etc are not modelable in the traditional sense. These risks cannot be modeled using VaR. Therefore statement I is correct.

VaR indeed does not consider liquidity risk, it is only concerned with the standard deviation of portfolio returns. Statement II is a valid criticism.

Statement III is not correct, as VaR can consider historical price movements.

Statement IV is correct,as VaR does not consider systemic risk or the risk of contagion.

Recovery rates vary a great deal from year to year, and are difficult to predict. Therefore statement III is true. Similarly, any attempt to predict these is hamstrung by a high standard error, which can be as high as the historical mean itself. The error does not cancel itself out due to the effect of the business cycle making the error directionally biased. Thus statement IV is false.

Statement II is true as these are all factors that make forecasting recovery rates for any credit risk model ratherdifficult. Statement I is false because recovery rates are difficult to predict and assumptions are not easy to make.