CISI Operational Risk Sample Paper

Q: Are these CISI Operational Risk sample questions updated for 2026?

Yes, these free practice questions are continuously reviewed and updated to reflect the latest official syllabus changes and regulatory requirements for candidates in international markets.

Q: How similar is this sample paper to the real CISI Operational Risk exam?

Our sample paper and question bank are engineered to closely match the difficulty, format, and testing style of the actual official exam. It provides a highly realistic mock exam benchmark of your current readiness.

Q: What is the pass mark for the CISI Operational Risk certification?

While the pass mark can vary slightly by specific exam versions, most CISI exams require a score of 70% to pass. We recommend consistently scoring 80% or higher on our practice question bank before sitting for your real test in international markets.

Q: Can I take this free mock exam multiple times?

Yes, you can retake this 30-question sample paper as many times as you like. However, to ensure comprehensive preparation and avoid simply memorizing answers, we highly recommend unlocking our full premium question bank which features over 500 unique scenario-based practice questions.

Question 1

In a volatile derivatives market, Counterparty A wants to trade with Counterparty B but is concerned about B's creditworthiness. They decide to execute the trade on an exchange that uses a central clearing counterparty (CCP). What is the main reason for using the CCP in this scenario?

Accepted Answer

To reduce credit risk by having the CCP act as the guarantor of the contract.

Answer

To ensure the trade settles on a true Delivery versus Payment (DvP) basis.

Answer

To guarantee that the trade will be profitable for both parties.

Answer

To eliminate market risk from the transaction.

Question 2

Following a period of severe economic stress, a large US investment bank begins taking excessive risks with high-risk over-the-counter (OTC) derivatives, including credit default swaps. Under the Dodd-Frank Act, which bodies are specifically designated to regulate these activities to prevent the firm from becoming 'too big to fail' and requiring a taxpayer bailout?

Accepted Answer

The Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (CFTC)

Answer

The Information Commissioner's Office (ICO)

Answer

The Financial Conduct Authority (FCA) and the Prudential Regulation Authority (PRA)

Answer

The Bank for International Settlements (BIS) and the Basel Committee

Question 3

Alpha Capital wants to sell a large position in a thinly traded emerging market stock but cannot find buyers without drastically dropping the price. Furthermore, because of a recent market panic, Alpha Capital's short-term lenders refuse to roll over their credit lines, leaving Alpha Capital struggling to settle its day-to-day trades. What type(s) of risk is Alpha Capital experiencing?

Accepted Answer

Both market liquidity risk and funding liquidity risk

Answer

Market liquidity risk only

Answer

Market risk and Credit risk

Answer

Funding liquidity risk only

Question 4

A risk manager at a bank is analysing a portfolio of foreign exchange forward contracts. To quantitatively assess the severity of the credit risk, the manager calculates the current obligation outstanding and then uses statistical techniques within a Value at Risk (VaR) framework to calculate the likely maximum loss over the life of the contracts. What two elements is the manager combining to determine the overall credit exposure?

Accepted Answer

Current exposure and Potential future exposure

Answer

Market depth and Potential future exposure

Answer

Expected shortfall and Current exposure

Answer

Pre-settlement exposure and Direct exposure

Question 5

Alpha Capital recently executed several complex derivatives trades. The compliance team must ensure that these trades are reported to the regulator by T+1. What is the primary purpose of this specific transaction reporting?

Accepted Answer

To allow the regulator to identify possible instances of market abuse without making the data available to other market participants.

Answer

To reconcile the front-office positions with the back-office positions for the daily P&L calculation.

Answer

To provide immediate market transparency so other participants can see the pricing and volume of the trades.

Answer

To ensure that the correct settlement instruction information is matched and fulfilled.

Question 6

The board of directors at an investment bank determines that a loss of up to £50 million over the financial year would not affect the ongoing viability of the business. However, they formally document that they are only willing to accept operational risk losses up to £10 million per year to ensure stable dividend payments to shareholders. How are these two financial figures defined?

Accepted Answer

£50 million is the risk capacity; £10 million is the risk appetite.

Answer

£50 million is the expected loss; £10 million is the unexpected loss limit.

Answer

£50 million is the risk appetite; £10 million is the risk capacity.

Answer

Both figures represent the firm's risk capacity under different stress scenarios.

Question 7

Bank X and Bank Y actively trade foreign exchange forwards with each other. To reduce counterparty credit risk, they agree that at any point in time, whoever is the overall net obligor will post cash as security for just the value of the net obligation. What specific type of collateral arrangement have they established?

Accepted Answer

Netted collateral arrangement

Answer

Bilateral arrangement

Answer

Unilateral arrangement

Answer

Cash payment netting

Question 8

A wealth management firm participates in an industry-wide survey and is delighted to find out that its operational loss figures are the lowest among its peer group. The board decides they no longer need to invest heavily in operational risk controls because they are the 'market leader'. Why might this conclusion create a false sense of security?

Accepted Answer

Because ranking highly only implies the firm currently outperforms its competitors in risk areas; it does not guarantee that the firm manages its risks effectively or is immune to catastrophic failures.

Answer

Benchmarking requires a firm to immediately adopt the exact risk appetite of its competitors, invalidating its own strategy.

Answer

Benchmarking solely compares market risk and credit risk, completely ignoring operational risk entirely.

Answer

Industry-wide data is always sourced from external regulators who routinely penalise the market leaders with higher capital charges.

Question 9

Firm X has entered into an OTC interest rate swap with Firm Y. Over the next six months, interest rates move heavily in Firm X's favour, meaning the contract currently has a significant positive economic value to Firm X. However, before the contract matures, Firm Y declares bankruptcy. What specific type of risk has materialised for Firm X?

Accepted Answer

Pre-settlement credit risk

Answer

Issuer credit risk

Answer

Direct credit risk

Answer

Settlement credit risk

Question 10

Gamma Bank has recently restructured its executive suite following a string of regulatory fines. The board is appointing a Chief Risk Officer (CRO) to overhaul the firm's Enterprise Risk Management (ERM) framework. Who should the new CRO ideally report to in order to ensure effective governance and independence?

Accepted Answer

The executive committee and the board of directors (or a risk committee).

Answer

The Chief Executive Officer only, to streamline operational directives.

Answer

The Head of Middle Office and the Chief Financial Officer.

Answer

The Head of Internal Audit and the Compliance Director.

Question 11

A senior director at a UK-listed company suggests that in order to align her interests with the company's short-term quarterly targets, she should personally decide her remuneration outcome and base it solely on quarterly profits. Under the UK Corporate Governance Code 2018, how should this suggestion be addressed?

Accepted Answer

It should be rejected because remuneration policies should promote long-term sustainable success and no director should be involved in deciding their own remuneration.

Answer

It should be rejected because executive remuneration is determined solely by the shareholders, not the board.

Answer

It should be approved since directors are encouraged to align their interests with shareholder quarterly returns.

Answer

It should be approved, provided she discloses her remuneration outcome at the general meeting.

Question 12

A bank initiates a strategic project to overhaul its client management system. The project runs significantly over budget, forcing the bank to pull senior line managers away from their day-to-day duties to help bring it back on track. The diversion of line staff puts extra pressure on the business, leading to a deterioration in client service and subsequent loss of future business. How is this loss of future business classified?

Accepted Answer

An indirect loss due to the project destabilising day-to-day operations.

Answer

A direct loss stemming from delayed processing.

Answer

A direct loss due to project mismanagement.

Answer

A near miss, as the project was ultimately rescued.

Question 13

An operations manager reviews the risk event data for the past three years. They notice a pattern of small, £500 processing errors occurring almost weekly due to minor data-entry typos. They also note one single £2 million loss caused by a rare, sophisticated external hacking event two years ago. How should the firm approach managing these two different types of losses?

Accepted Answer

The regular typos are expected losses managed by good continuous process controls; the hack is an unexpected loss best managed using contingency planning and risk transfer.

Answer

The regular typos are unexpected losses requiring contingency planning; the hack is an expected loss requiring better process controls.

Answer

Both are unexpected losses because human error and external hacking are inherently unpredictable.

Answer

Both are expected losses because they have already occurred in the past and are recorded in the loss distribution curve.

Question 14

Omega Bank lends money to a corporate client. Simultaneously, it holds a portfolio of corporate bonds. If the corporate client fails to repay the loan, and the corporate bonds fall in value due to rising interest rates, which two risks has Omega Bank primarily experienced?

Accepted Answer

Credit risk and Market risk

Answer

Credit risk and Liquidity risk

Answer

Market risk and Operational risk

Answer

Liquidity risk and Operational risk

Question 15

A junior trader bypasses the mandatory secondary approval step for high-value transactions due to poorly designed system permissions. This eventually leads to a large, unauthorised transaction that results in a severe financial loss for the firm. In the context of the operational risk 'chain of events', how should this sequence be accurately categorised?

Accepted Answer

Root Cause: Poorly designed system permissions; Event: Unauthorised transaction; Effect: Severe financial loss.

Answer

Root Cause: Junior trader; Event: Severe financial loss; Effect: Bypassed approval.

Answer

Root Cause: Bypassed approval; Event: Poorly designed system permissions; Effect: Severe financial loss.

Answer

Root Cause: Severe financial loss; Event: Poorly designed system permissions; Effect: Unauthorised transaction.

Question 16

Delta Bank uses modern mathematical modelling to calculate the credit risk of its portfolio. However, the internal audit team flags that the model treats all exposures across emerging markets with a single, simplified capital charge based on a percentage of the notional amounts. What issue does this simplified approach introduce to the risk calculation?

Accepted Answer

It assumes that some exposures have equal credit risk when in reality they do not.

Answer

It assumes lack of availability of historical data.

Answer

It overestimates the impact of portfolio diversification.

Answer

It fails to account for the time period of credit risk.

Question 17

A wealth management firm recently updated its business continuity plan to include a detailed disaster recovery procedure in the event of a total data centre loss. They also installed a secondary, automated validation software to ensure all trades are matched before execution. How do these two operational controls respond to risk?

Accepted Answer

The business continuity plan reduces the impact of a risk event, while the automated validation software reduces the likelihood of the risk occurring.

Answer

Both controls primarily act to transfer the risk to third-party vendors.

Answer

The business continuity plan transfers the risk, while the automated validation software accepts the risk within the firm's appetite.

Answer

Both controls primarily act to reduce the likelihood of operational risk.

Question 18

An investment bank has decided to outsource its daily profit and loss calculations and portfolio revaluations to a third-party service provider. Which function within the bank retains the responsibility of acting as a direct point of control over this outsourced provider?

Accepted Answer

The middle office

Answer

The front office

Answer

The back office

Answer

The internal audit function

Question 19

Sarah works in the compliance department of a mid-sized asset management firm. She has been tasked with drafting the firm's new policies regarding employee conduct to meet industry expectations. Which of the following sets of topics would specifically fall under her remit?

Accepted Answer

Whistleblower protection, conflicts of interest, and anti-money laundering.

Answer

Defining strategic change solutions for IT infrastructure and systems integration.

Answer

Employee retention programmes, salary benchmarking, and health & safety.

Answer

Maintaining employee records, diversity initiatives, and benefit packages.

Question 20

A trading firm is looking to improve its control environment. Management writes a new policy mandating that staff cannot share passwords. They also implement an automated daily statement-to-ledger reconciliation system that alerts supervisors if a counterparty payment fails. What types of controls are these, respectively?

Accepted Answer

Directive and Detective (External).

Answer

Directive and Preventative.

Answer

Preventative and Corrective.

Answer

Detective (Internal) and Corrective.

Question 21

A retail bank maps out its core payment processing system to ensure it can continue delivering this 'Important Business Service' even during a severe cyber-attack. The bank determines the maximum tolerable level of disruption is 4 hours before clients suffer unacceptable harm. What regulatory concept is the bank primarily demonstrating here?

Accepted Answer

Operational resilience and impact tolerances.

Answer

Risk transference and financial reserving.

Answer

Top-down risk assessment and value at risk (VaR).

Answer

The first line of defence in enterprise risk management.

Question 22

In a risk committee meeting, a director raises concerns about heavily relying on external rating agencies like Moody's and Standard & Poor's. To illustrate a known limitation of rating agencies, she references the case of Enron in 2002. What specific criticism of rating agencies is highlighted by the Enron case?

Accepted Answer

Rating agencies failed to promptly downgrade the company, keeping it at investment grade just days before bankruptcy.

Answer

Rating agencies incorrectly applied the Basel Committee's rules on capital adequacy for the energy sector.

Answer

Rating agencies frequently miscalculate the expected shortfall of structured products.

Answer

Rating agencies have too familiar a relationship with governments, skewing sovereign ratings.

Question 23

A trader incorrectly prices a block of shares due to outdated data on their terminal. Before the error is identified, the market moves against the trader, resulting in a financial hit to the firm when the transaction settles. How should this consequence be classified?

Accepted Answer

A direct loss due to incorrect data.

Answer

An indirect loss stemming from technology obsolescence.

Answer

An indirect loss due to damaged reputation.

Answer

A near miss because the transaction was settled.

Question 24

A newly appointed Chief Risk Officer (CRO) notices that the current firm culture avoids escalating potential risks because staff fear being blamed for mistakes. The CRO decides to launch an initiative to change this culture, but faces immense pushback. Why is operational risk due to cultural issues often particularly difficult to manage and change?

Accepted Answer

Because it involves a large intangible element where cause-and-effect relationships are not obvious, making it a perceptual issue driven by emotion, habits, and ego rather than pure logic.

Answer

Because cultural changes must always be approved by external regulators, which takes several years to process.

Answer

Because it relies solely on highly complex quantitative data that most employees cannot comprehend.

Answer

Because the Basel II Accords prohibit altering the firm's cultural risk appetite without simultaneously altering its risk capacity.

Question 25

The operational risk team of a financial institution gathers subject matter experts to evaluate what would happen to their transaction processing if a widespread telecommunications outage occurred while the primary backup server was simultaneously undergoing maintenance. They attempt to gauge the potential severity of this worst-case event. Which risk measurement method is the firm primarily using?

Accepted Answer

Scenario analysis

Answer

Top-down risk assessment

Answer

Risk event data analysis

Answer

Risk and control self-assessment

Question 26

During a routine reconciliation, a back-office manager discovers that a corporate client's account has been deliberately churned by a broker to generate higher commission fees, in direct violation of the firm's policies and client agreements. Under which Basel II operational risk event category should this incident be recorded?

Accepted Answer

Clients, products and business practices

Answer

Execution, delivery and process management

Answer

External fraud

Answer

Internal fraud

Question 27

A newly hired Head of Operations is outlining the objectives of the back-office department to the board. Which of the following accurately describes the three core objectives of this department?

Accepted Answer

Monitor transaction lifecycles, fulfil settlement/payment actions, and provide data for the accounting function.

Answer

Execute trades, manage market risk, and formulate investment strategies.

Answer

Pitch products to clients, maintain KYC records, and manage front-office KRIs.

Answer

Capture transactions, confirm trades bilaterally, and clear trades via a CCP.

Question 28

A retail brokerage firm failed to adequately protect its clients' interests by recommending high-risk, structured investment products to elderly customers with conservative risk profiles. As a result, the firm faces regulatory censure, voiding of contracts, and severe reputational damage. This scenario primarily illustrates the realisation of:

Accepted Answer

Compliance risk

Answer

Settlement risk

Answer

Liquidity risk

Answer

Market risk

Question 29

Hackers breach a central bank's internal systems, initiating fraudulent payment instructions via SWIFT. To delay detection, the hackers also disable the internal printers used by the bank to review manual transfer instructions. Which major operational risk event does this describe?

Accepted Answer

The Bank of Bangladesh heist

Answer

The LIBOR manipulation scandal

Answer

The HSBC DDoS attack

Answer

The TSB IT migration failure

Question 30

Delta Securities executes a large block trade of equities on behalf of an institutional client. In order to ensure market transparency and comply with regulatory requirements, the firm must report details of the trade such as the price and volume to the market. How quickly must this trade reporting typically take place, and through what mechanism?

Accepted Answer

In near-real time via an Approved Publication Arrangement (APA).

Answer

Within one business day (T+1) via an Approved Publication Arrangement (APA).

Answer

Within one business day (T+1) via an Approved Reporting Mechanism (ARM).

Answer

In near-real time via an Approved Reporting Mechanism (ARM).

CISI Operational Risk Free Sample Paper & Question Bank

In a volatile derivatives market, Counterparty A wants to trade with Counterparty B but is concerned about B's creditworthiness. They decide to execute the trade on an exchange that uses a central clearing counterparty (CCP). What is the main reason for using the CCP in this scenario?

CISI Operational Risk

Unlock 20% Discount

About This Free Sample Paper

Why Use a Question Bank & Mock Exams?

Frequently Asked Questions

Pass on Your First Attempt