Sample Questions
Question 1
Easy
Under the BCBS Principles for Operational Resilience (March 2021), 'impact tolerance' is best described as:
Solution
A is correct. BCBS defines impact tolerance as the maximum level of disruption to a critical operation that the firm is willing to accept, articulated in measurable, forward-looking terms (such as time offline, volume of transactions affected, or scope of customers harmed). It is a resilience metric used to drive scenario testing and remediation, not a capital or statistical loss measure.
Question 2
Medium
Under supervisory guidance on model risk management, which description best captures internal audit's role with respect to models?
Solution
A is correct. The guidance separates validation from audit. Validation, whether performed by a dedicated unit or by qualified staff outside the development chain, evaluates conceptual soundness, ongoing monitoring and outcomes analysis. Internal audit does not own that work. It provides assurance that the framework exists and operates as intended: that the inventory is complete, that policies and risk tiering are applied consistently, that validation is performed with adequate independence, scope and documentation, and that findings are tracked to closure. Auditors must be skilled enough to evaluate the quality of validation work without becoming the validators themselves.
Question 3
Hard
A bank licenses a third-party economic capital model whose source code and certain proprietary parameter estimates are not disclosed. The vendor supplies its own validation report and a benchmark study across its client base. Which approach best satisfies supervisory expectations for validating this model?
Solution
D is correct. Responsibility for validating a vendor model rests with the user bank, not the vendor, because the question is whether the model is appropriate for this bank's portfolios, data and uses. Where proprietary elements limit transparency, the bank compensates rather than concedes: it demands documentation of theory, assumptions, data and the testing the vendor performed, runs sensitivity analysis over the parameters it can vary, benchmarks against alternative approaches, and performs outcomes analysis on its own exposures. A is insufficient because vendor-supplied evidence and clerical checks on data feeds say nothing about performance on this bank's exposures. B fails because validation of a vendor model is a continuing program of monitoring, outcomes analysis and review, not a single acceptance test revisited only at version changes. C misreads an escrow arrangement, which supports continuity of use, as a substitute for testing the bank can perform now without seeing the code. The guidance also expects the bank to monitor vendor product changes and to hold contingency plans in case the vendor ceases support for the product.
