Free CISI IOC Operational Risk Practice Questions

Sample Practice Questions

Try these 10 sample questions from the CISI IOC Operational Risk practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1Which control failure featured in the Wells Fargo sales-practices case announced by the OCC in September 2016?

   1. A.Opening customer accounts without authorisationCorrect answer: A
   2. B.Holding bonds whose issuers later defaulted
   3. C.Borrowing at rates above the market average
   4. D.Selling securities after a market-price decline

   Explanation: The source states: "the unauthorized opening of deposit or credit card accounts" This was an operational and conduct-control failure involving customer consent, rather than ordinary issuer credit, funding-cost or price risk.

   Reference: OCC Wells Fargo sales-practices enforcement announcement — News Release 2016-106, sales-practices findings

2. 2A bank's swap has a positive replacement value when its counterparty defaults before maturity. Which risk has crystallised?

   1. A.Funding rollover risk on the bank's debt
   2. B.Operational risk from inaccurate trade entry
   3. C.Counterparty pre-settlement credit riskCorrect answer: C
   4. D.Market basis risk between benchmark rates

   Explanation: The source states: "Pre-settlement risk is the risk of loss due to a counterparty defaulting on a contract during the life of a transaction." The loss arises because the swap counterparty fails during the contract, not because benchmarks diverge, funding matures or trade data were entered incorrectly.

   Reference: OCC Comptroller's Handbook: Risk Management of Financial Derivatives — Types of Credit Risk, printed p. 44

3. 3Which description identifies the sources of loss in the Basel definition of operational risk?

   1. A.Failed internal processes, people or systems, or external eventsCorrect answer: A
   2. B.Unfavourable market prices and changes in benchmark interest rates
   3. C.Counterparty default and changes in the borrower's credit spread
   4. D.Funding mismatches and inability to sell assets at a fair price

   Explanation: The Basel definition includes losses involving "people and systems or from external events." Its complete definition also includes failed internal processes. The other options describe market, credit or liquidity exposures rather than the operational-risk definition.

   Reference: Basel Committee: Principles for the Sound Management of Operational Risk — Footnote 5, printed p. 3

4. 4A bank outsources an IT migration supporting its core banking service. Why does this arrangement create operational-risk exposure for the bank?

   1. A.Failure by the supplier can disrupt the bank's critical operationsCorrect answer: A
   2. B.The supplier's involvement converts service failures into issuer credit risk
   3. C.The outsourcing contract removes the bank's exposure to system failures
   4. D.The bank's exposure arises only if the supplier's bond price declines

   Explanation: The source states: "firms have made increasing use of third parties to deliver a variety of services, including those that are integral to critical operations and core business lines." Dependence on a supplier creates a route for service or technology failure to disrupt the bank. A contract does not remove that exposure, and neither an issuer default nor a bond-price decline is needed for the operational event.

   Reference: Interagency Sound Practices to Strengthen Operational Resilience — Section 4, Third-Party Risk Management, printed p. 6

5. 5What is the purpose of verifying a customer's identity during account set-up?

   1. A.To establish a reasonable belief about the customer's true identityCorrect answer: A
   2. B.To assess the customer's ability to repay a proposed loan
   3. C.To evaluate the suitability of a particular investment recommendation
   4. D.To establish how the customer accumulated their overall wealth

   Explanation: The source states: "The procedures must enable the bank to form a reasonable belief that it knows the true identity of each customer" Identity verification establishes who the customer is. Creditworthiness, investment suitability and source-of-wealth assessment answer different due-diligence questions; they do not substitute for verifying identity. This tests the control purpose, not US account-opening deadlines.

   Reference: FFIEC BSA/AML Examination Manual: Customer Identification Program — Identity Verification Procedures

6. 6A board receives a proposal that would materially increase the firm's operational exposure. What does credible board challenge involve?

   1. A.Delegate all scrutiny to the proposer because it owns the business case
   2. B.Judge the proposal solely by the revenue increase it promises
   3. C.Independently question the assumptions and risk implications before decidingCorrect answer: C
   4. D.Accept the proposal because senior management prepared it

   Explanation: The source states: "The board should be willing and able to act independently and provide a credible challenge to management." Credible challenge requires independent scrutiny of assumptions and consequences. Preparation by management, ownership of the business case and projected revenue do not replace oversight.

   Reference: OCC Comptroller's Handbook: Corporate and Risk Governance — Board of Directors, printed p. 6

7. 7A UK firm is deciding how much personal information to collect for a stated processing purpose. Which approach follows the UK GDPR data-minimisation principle?

   1. A.Collect data that are adequate, relevant and necessary for that purposeCorrect answer: A
   2. B.Collect every available item in case it becomes commercially useful
   3. C.Treat a customer's signature as removing any need to limit collection
   4. D.Base the amount collected solely on the storage capacity available

   Explanation: The source states: "adequate, relevant and limited to what is necessary" Data minimisation relates collection to the processing purpose. Storage capacity, speculative future uses and a signature do not displace that principle.

   Reference: UK GDPR: Article 5 principles relating to processing of personal data — Article 5(1)(c)

8. 8In the FCA's 2014 Invesco findings, why could delayed trade recording affect fund pricing?

   1. A.Delaying an entry removed the trade's economic exposure
   2. B.Delaying an entry changed the contract price agreed with the broker
   3. C.Incomplete records prevented changes in underlying market prices
   4. D.Incomplete transaction records could distort fund valuationsCorrect answer: D

   Explanation: The FCA identified that the funds "could have been wrongly priced". An incomplete trade record can distort valuation inputs. Recording delays do not remove economic exposure, amend the agreed contract price or stop underlying market movements.

   Reference: FCA Invesco Perpetual fund-management enforcement announcement — FCA findings, trade recording

9. 9An investor holds a corporate bond. The company cannot make the promised coupon payment. Which relationship gives rise to the credit exposure?

   1. A.The exchange's procedure for matching orders
   2. B.The investor's claim on the bond issuerCorrect answer: B
   3. C.The investor's instruction to its stockbroker
   4. D.The custodian's timetable for corporate actions

   Explanation: The source states: "Credit risk arises from all activities in which success depends on counterparty, issuer, or borrower performance." The issuer owes the coupon under the bond. Broker, custodian and exchange processing are different relationships and are not the failed obligation described.

   Reference: OCC Comptroller's Handbook: Risk Management of Financial Derivatives — Credit Risk, printed p. 44

10. 10A firm suffers a loss from a legal claim arising from a processing failure. How does legal risk relate to the operational-risk definition?

    1. A.Legal risk is excluded unless the claimant is a customer
    2. B.Legal risk is included only after an external audit
    3. C.Legal risk is classified exclusively as market risk
    4. D.Legal risk is included within operational riskCorrect answer: D

    Explanation: The source states: "This definition includes legal risk" The definition includes legal risk; it does not depend on a customer claimant or audit finding, nor does a legal claim become market risk merely because it has financial consequences.

    Reference: Interagency Sound Practices to Strengthen Operational Resilience — Introduction, footnote 1, printed p. 1