Sample Questions
Question 1
Easy
Risk-Adjusted Return on Capital (RAROC) is most commonly defined as:
Solution
B is correct. RAROC measures risk-adjusted profitability per unit of economic capital. The numerator is the economic return: revenues net of operating expenses and expected losses (and may include funding transfer pricing or tax adjustments). The denominator is economic capital, which is sized to cover unexpected loss at a high confidence level (for example, 99.9% over one year). Comparing RAROC against a firm-wide hurdle rate (cost of equity) tells management whether a business line is creating or destroying shareholder value on a risk-adjusted basis.
Question 2
Medium
Under supervisory guidance on model risk management, which description best captures internal audit's role with respect to models?
Solution
A is correct. The guidance separates validation from audit. Validation, whether performed by a dedicated unit or by qualified staff outside the development chain, evaluates conceptual soundness, ongoing monitoring and outcomes analysis. Internal audit does not own that work. It provides assurance that the framework exists and operates as intended: that the inventory is complete, that policies and risk tiering are applied consistently, that validation is performed with adequate independence, scope and documentation, and that findings are tracked to closure. Auditors must be skilled enough to evaluate the quality of validation work without becoming the validators themselves.
Question 3
Hard
A bank licenses a third-party economic capital model whose source code and certain proprietary parameter estimates are not disclosed. The vendor supplies its own validation report and a benchmark study across its client base. Which approach best satisfies supervisory expectations for validating this model?
Solution
D is correct. Responsibility for validating a vendor model rests with the user bank, not the vendor, because the question is whether the model is appropriate for this bank's portfolios, data and uses. Where proprietary elements limit transparency, the bank compensates rather than concedes: it demands documentation of theory, assumptions, data and the testing the vendor performed, runs sensitivity analysis over the parameters it can vary, benchmarks against alternative approaches, and performs outcomes analysis on its own exposures. A is insufficient because vendor-supplied evidence and clerical checks on data feeds say nothing about performance on this bank's exposures. B fails because validation of a vendor model is a continuing program of monitoring, outcomes analysis and review, not a single acceptance test revisited only at version changes. C misreads an escrow arrangement, which supports continuity of use, as a substitute for testing the bank can perform now without seeing the code. The guidance also expects the bank to monitor vendor product changes and to hold contingency plans in case the vendor ceases support for the product.
