PRMIA 8020 Exam Dumps

Step 1: Key Elements of a Well-Designed Policy Document

A well-designed policy should include:

Scope -- Who the policy applies to.

Exception Handling -- How and where exceptions should be requested.

Accountability -- Who is responsible for enforcement.

Step 2: Why Option C is Correct

A policy must clearly define exceptions and the process for requesting them.

It should also define areas where the policy does not apply to avoid confusion.

Step 3: Why the Other Options Are Incorrect

Option A ('List of exceptions for board members' families') Incorrect because policies should apply consistently to all stakeholders.

Option B ('List of acceptable fonts and margin types') Incorrect because formatting is secondary to content clarity.

Option D ('To whom the policy applies and an additional management report') Incorrect because policy scope should not include unnecessary reports.

PRMIA Risk Reference Used:

PRMIA Policy Writing Guidelines -- Defines policy structure and exception handling.

ISO 19600 Compliance Management Standard -- Supports clear, well-documented policies.

Final Conclusion:

A well-designed policy clearly defines exceptions and their handling process, making Option C the correct answer.

Definition of an Effective Key Risk Indicator (KRI)

A KRI is a metric used to identify, measure, and monitor emerging risks.

To be effective, KRIs must be both quantitative and qualitative, allowing for a comprehensive risk view.

Key Characteristics of Effective KRIs

Quantitative -- Uses numerical data for trend analysis.

Qualitative -- Incorporates expert judgment and scenario-based insights.

Consistent -- Maintains uniform definitions across reporting periods.

Efficient & Repeatable -- Must be easily measured and consistently reported.

Why Other Answers Are Incorrect

Option

Explanation

B . Qualitative, Consistent, Efficient & Repeatable.

Incorrect -- Excludes quantitative aspects, which are essential for KRIs.

C . Quantitative, Consistent, Comparable, Efficient & Repeatable.

Incorrect -- While comparison is useful, qualitative factors are missing, making this answer incomplete.

D . Quantitative, Repeatable and Efficient.

Incorrect -- Lacks qualitative insights and consistency as key factors for KRIs.

PRMIA Reference for Verification

PRMIA Risk Indicator Guidelines

Basel Committee's Principles on Risk Data and KRI

Three Lines of Defense Model

The compliance department functions as the second line of defense, ensuring oversight over the first line's compliance controls.

It does not directly implement controls but monitors and advises on compliance risk management.

Responsibilities of the Compliance Department

Ensures regulatory compliance with laws, policies, and industry standards.

Monitors and enforces risk management controls within business operations.

Provides advisory and training on compliance risks.

Why Answer D is Correct

The first line of defense (business operations) is responsible for executing compliance controls.

The compliance department (second line) provides oversight and governance to ensure compliance adherence.

Why Other Answers Are Incorrect

Option

Explanation

A . The compliance department is responsible for implementing the first line's compliance risk management controls.

Incorrect -- The first line (business units) implement compliance controls, while compliance oversees.

B . The compliance department is responsible for providing oversight over the auditor's implementation of compliance risk management controls.

Incorrect -- Internal audit is part of the third line of defense, not directly overseen by compliance.

C . The compliance department is responsible for providing oversight over the board's implementation of compliance risk management controls.

Incorrect -- The board provides high-level governance; compliance ensures business adherence to regulations.

PRMIA Reference for Verification

PRMIA Governance & Compliance Oversight Framework

Basel Committee's Guidelines on Compliance Risk Management

Introduction of Operational Risk in Basel Accords

Basel I (1988) Focused only on credit risk and market risk; operational risk was not yet included.

Basel II (2004) Introduced operational risk as a separate category, subject to capital requirements.

Basel III (2010) Strengthened capital and liquidity requirements but did not introduce operational risk.

Basel IV (2017, still evolving) Adjusts Basel III reforms but does not introduce operational risk as a new category.

Why Answer B is Correct

Basel II (2004) was the first to introduce operational risk as a risk requiring a capital charge.

Why Other Answers Are Incorrect

Option

Explanation

A . Basel I

Incorrect -- Basel I focused on credit risk and market risk, with no capital requirements for operational risk.

C . Basel III

Incorrect -- Basel III strengthened Basel II but did not introduce operational risk.

D . Basel IV

Incorrect -- Basel IV refines Basel III but does not introduce operational risk as a new capital charge.

PRMIA Reference for Verification

Basel II (2004) Operational Risk Framework

PRMIA Operational Risk Management Guidelines

Impact Tolerance is a key concept in Operational Resilience, defined as the ability of a firm to withstand, respond to, and recover from disruptions. According to PRMIA and global regulatory frameworks (such as the Bank of England's Operational Resilience Framework), impact tolerance is specifically tied to business services rather than processes.

Step 1: Defining Impact Tolerance

Impact tolerance is the maximum acceptable level of disruption to an important business service, beyond which there would be intolerable harm to customers, financial markets, or regulatory obligations.

It is not the same as risk appetite or risk capacity, as those deal with broader organizational risk exposure.

Step 2: Why Business Services Matter

PRMIA defines business services as end-to-end services delivered to clients and stakeholders, such as payments processing, trade execution, or loan approvals.

Disruptions to these services directly impact customers and financial stability, making business service resilience the core focus of impact tolerance.

Step 3: Why the Other Options Are Incorrect

Option A ('tolerance for disruption to a particular business process')

Incorrect because impact tolerance applies to services, not just internal processes.

Option C ('a firm's risk appetite statement')

Incorrect because risk appetite focuses on how much risk a firm is willing to take, while impact tolerance is about surviving disruptions.

Option D ('a firm's risk capacity statement')

Incorrect because risk capacity is the maximum level of risk a firm can bear, which is broader than business service disruptions.

PRMIA Risk Reference Used:

PRMIA Operational Resilience Guidelines -- Defines impact tolerance as a service-based metric.

Bank of England's Operational Resilience Framework -- Establishes impact tolerance as a limit on business service disruption.

Final Conclusion:

Impact tolerance focuses on business services, not just internal processes or risk appetite, making Option B the correct answer.