Are these CISI Operational Risk mock exams updated for 2026?

The course has been checked against CISI Operational Risk Edition 26 and syllabus Version 22, which applies to exams from 20 September 2025 to 19 September 2027.

Can I try a free CISI Operational Risk sample paper?

Yes. The free course preview includes sample practice questions; full 50-question mocks are part of the course.

Who reviews the questions?

Questions and explanations are checked against the current CISI workbook and syllabus during course QA.

How many questions are in the bank?

The course includes 250 practice questions across five 50-question mock exams.

During a routine reconciliation, a back-office manager discovers that a corporate client's account has been deliberately churned by a broker to generate higher commission fees, in direct violation of the firm's policies and client agreements. Under which Basel II operational risk event category should this incident be recorded?

Clients, products and business practices

Execution, delivery and process management

A global asset manager employs a dedicated 'Enterprise Risk Management' (ERM) team to facilitate the implementation of risk systems and provide management with an overview of key business risks. They also have a separate team of line managers who embed day-to-day controls in the trading systems. In the 'three lines of defence' model, what role does the ERM team fulfil?

The second line of defence, as they provide oversight, advisory, and monitoring functions to facilitate effective risk management.

They sit outside the three lines of defence, acting as external assurance providers to the board.

The third line of defence, as they independently audit the effectiveness of the controls embedded by the line managers.

The first line of defence, as they provide an overview of key business risks directly to management.

A junior trader bypasses the mandatory secondary approval step for high-value transactions due to poorly designed system permissions. This eventually leads to a large, unauthorised transaction that results in a severe financial loss for the firm. In the context of the operational risk 'chain of events', how should this sequence be accurately categorised?

Root Cause: Poorly designed system permissions; Event: Unauthorised transaction; Effect: Severe financial loss.

Root Cause: Junior trader; Event: Severe financial loss; Effect: Bypassed approval.

Root Cause: Bypassed approval; Event: Poorly designed system permissions; Effect: Severe financial loss.

Root Cause: Severe financial loss; Event: Poorly designed system permissions; Effect: Unauthorised transaction.

The board of directors at an investment bank determines that a loss of up to £50 million over the financial year would not affect the ongoing viability of the business. However, they formally document that they are only willing to accept operational risk losses up to £10 million per year to ensure stable dividend payments to shareholders. How are these two financial figures defined?

£50 million is the risk capacity; £10 million is the risk appetite.

£50 million is the risk appetite; £10 million is the risk capacity.

£50 million is the expected loss; £10 million is the unexpected loss limit.

Both figures represent the firm's risk capacity under different stress scenarios.

The compliance department of a brokerage identifies that without any checks, 15% of all new client onboardings could fail anti-money laundering (AML) screening, risking a massive regulatory fine. To combat this, they deploy a robust automated identity verification system. After deployment, only 0.5% of applications pose an AML risk, which the firm deems acceptable. What do the 15% and 0.5% figures represent, respectively?

Inherent risk and Residual risk.

Inherent risk and Risk capacity.

Residual risk and Risk appetite.

Risk capacity and Residual risk.

A wealth management firm recently updated its business continuity plan to include a detailed disaster recovery procedure in the event of a total data centre loss. They also installed a secondary, automated validation software to ensure all trades are matched before execution. How do these two operational controls respond to risk?

Continuity limits outage impact; validation prevents mismatches.

Both controls transfer the exposure to service providers.

Continuity transfers risk; validation accepts the remaining risk.

Both controls mainly reduce the chance of the first event.

A medium-sized investment firm wants to assess its exposure to low-frequency, high-impact events, such as a rogue trader scandal. Because they have never experienced such an event, they subscribe to a consortium to access anonymised loss data from other financial institutions. What is a key limitation of relying on this external loss data?

Peer losses may not map well to this firm's risk profile.

It cannot be used to benchmark performance against industry peers.

External data providers strictly forbid using their data for strategic planning or capital allocation purposes.

The data provided by external consortiums is usually unverified and highly inaccurate.

A newly appointed Chief Risk Officer (CRO) notices that the current firm culture avoids escalating potential risks because staff fear being blamed for mistakes. The CRO decides to launch an initiative to change this culture, but faces immense pushback. Why is operational risk due to cultural issues often particularly difficult to manage and change?

Culture depends on habits, perceptions and incentives that are hard to measure.

Because cultural changes must always be approved by external regulators, which takes several years to process.

Because it relies solely on highly complex quantitative data that most employees cannot comprehend.

Because the Basel II Accords prohibit altering the firm's cultural risk appetite without simultaneously altering its risk capacity.

A trading firm is looking to improve its control environment. Management writes a new policy mandating that staff cannot share passwords. They also implement an automated daily statement-to-ledger reconciliation system that alerts supervisors if a counterparty payment fails. What types of controls are these, respectively?

Directive and Detective (External).

Detective (Internal) and Corrective.

The operational risk team of a financial institution gathers subject matter experts to evaluate what would happen to their transaction processing if a widespread telecommunications outage occurred while the primary backup server was simultaneously undergoing maintenance. They attempt to gauge the potential severity of this worst-case event. Which risk measurement method is the firm primarily using?

Risk and control self-assessment

A corporate actions processing team misses a vital deadline to notify clients of an upcoming stock split because the responsible clerk mistakenly believed a colleague had already sent the communication. This leads to a flood of client complaints and minor compensation payouts. Which Basel II risk event category does this fall into?

Execution, delivery and process management

Employment practices and workplace safety

Business disruption and systems failures

Clients, products and business practices

A retail bank maps out its core payment processing system to ensure it can continue delivering this 'Important Business Service' even during a severe cyber-attack. The bank determines the maximum tolerable level of disruption is 4 hours before clients suffer unacceptable harm. What regulatory concept is the bank primarily demonstrating here?

Operational resilience and impact tolerances.

Top-down risk assessment and value at risk (VaR).

Risk transference and financial reserving.

The first line of defence in enterprise risk management.

The risk committee of a multinational broker-dealer wants to fully transition from using qualitative risk ranking charts to relying entirely on exact financial models to quantify their operational risk. The head of operational risk warns against doing this exclusively. Why is it inherently difficult to measure operational risk precisely using solely quantitative financial models?

Accurate loss data are scarce and hard to standardise across functions.

Regulators explicitly prohibit the use of financial measures for operational risk, requiring subjective scenario analysis instead.

Quantitative measurement requires a firm to merge its operational risk data with market risk data, which violates segregation of duties.

Financial models cannot account for the expected losses, which are the only losses relevant to the firm's risk capacity.

A trading firm recovers a £4 million employee-theft loss from its insurer. Clients later move business away after the public scandal. Which item is the clearest indirect loss from the event?

Future revenue lost when clients leave the firm.

The £4 million taken by the employee before recovery.

An invoice for the forensic investigation of the theft.

Legal fees incurred in the firm’s claim against the trader.

A specific type of credit risk where the issuer of a bond or debt instrument defaults on their repayment obligations.

What is the difference between Inherent (Gross) Risk and Residual (Net) Risk?

Inherent risk is the level of risk before any controls are applied; residual risk is the remaining risk after controls are in place.

What are the four root causes of Operational Risk?

People, Processes, Systems, and External Events.

Why are the Middle and Back Offices structurally separated from the Front Office?

To ensure segregation of duties, acting as an independent check against Front Office activities.

What is the purpose of the Digital Operational Resilience Act (DORA)?

To ensure financial entities in the EU can withstand, respond to, and recover from severe ICT-related disruptions.

What was the operational failure in the PPI episode?

Payment Protection Insurance was widely mis-sold with credit, often without borrowers understanding its cost or protection; incentives, disclosure and sales controls failed.

When does a derivative create pre-settlement credit risk?

When it has positive value to a firm before settlement and its counterparty may fail to perform.

Who owns daily operational risk in the three-lines model?

The first-line business units own and manage risks in their activities; risk/compliance challenge and audit provide independent assurance.

Table of Contents

CISI Operational Risk Mock Exams & Free Sample Questions (2026)
• How the Mock Papers Work
• Free Sample Questions
• Question Bank Coverage
• How to Use Mock Exams Effectively

CISI Operational Risk

Explore syllabus-aligned study tools, realistic practice and course-grounded AI support.

CISI Operational Risk Mock Exams & Free Sample Questions (2026)

Preparing for CISI Operational Risk takes active recall and practice under time pressure. The current syllabus specifies 50 multiple-choice questions in 60 minutes. This course provides 250 practice questions across five 50-question mock exams, each with answer explanations.

How the Mock Papers Work

The practice bank follows the seven elements of syllabus Version 22:

Five full mock exams: 250 practice questions across five 50-question papers.
Source-led study: Questions, summaries and recall tools use the CISI Edition 26 workbook.
Answer explanations: Each question explains the rule or distinction behind the answer.

Free Sample Questions

Try the free sample questions and course preview before enrolling.

Try the CISI Operational Risk free sample

Question Bank Coverage

The papers use the syllabus allocation of 3, 7, 20, 4, 5, 7 and 4 questions across its seven elements. Review explanations after each attempt to see where you need more study.

Interactive preview

Free CISI Operational Risk Practice Questions & Exam Preview

Try 15 CISI Operational Risk practice questions from The Nature of Operational Risk

Practice CISI Operational Risk exam questions with answers and explanations. The full course includes 5 mock exams and chapter study tools.

Exam Preview

The Nature of Operational Risk

Question 1 of 15

An international bank is drafting its new operational risk policy to define risk appetite and establish boundaries between operational, market, and credit risk. The Chief Risk Officer proposes that the policy only be signed off by the heads of each division to ensure local buy-in. According to best practices in operational risk management, what is the primary flaw in this approach?

1 / 15

Flashcards

Card 1 of 10Element 1: Risk Basics

Question

How does the Basel Committee on Banking Supervision (BCBS) formally define Operational Risk?

Tap to reveal answer

Focus Learn

Key Examinable Areas5

Distinguish likelihood from consequence in a risk definition.
Classify credit, market, liquidity and operational risk in practical scenarios.
Explain what Invesco, PPI, LIBOR, HSBC, Bank of Bangladesh and other named events show about controls.
State ERM's four practical aims and its firm-wide scope.
Explain why common definitions, data and culture matter to ERM.

Common Pitfalls to Avoid3

Exam Traps3

Key Numbers3

Chapter 1: Risk Basics

Risk is the possibility of an adverse consequence, not the certainty that an event will occur. A firm therefore considers both the likelihood of an event and what it would lose if the event happened. In financial services, the four broad categories are credit, market, liquidity and operational risk. Credit concerns a borrower or counterparty failing to meet an obligation. Market risk concerns adverse changes in financial-instrument values. Liquidity has an asset side (a position cannot be sold promptly at a reasonable price) and a funding side (the firm cannot meet payments when due). Operational risk concerns losses from inadequate or failed processes, people, systems or external events. One incident can engage several categories, so identify the actual cause and consequence before choosi…

Unlock all Focus Learn

Open every chapter’s key areas, pitfalls, exam traps and key numbers.

How to Use Mock Exams Effectively

Start Early: Don’t wait until the week before your exam to take a mock. Start taking practice questions as soon as you finish the first chapter.
Review Explanations: The real value is in the explanations. Read them carefully, even for questions you got right.
Simulate Exam Conditions: Take at least two full mock exams under strict timed conditions to build your stamina.
Separate the Loss Layers: A duplicate payment is the event, weak maker-checker design may be the cause, cash loss and remediation are impacts, and recovery is not the preventive control. Record all four when a scenario is wrong.

Search courses

CISI Operational Risk Mock Exams & Free Sample Questions (2026)

CISI Operational Risk

CISI Operational Risk Mock Exams & Free Sample Questions (2026)

How the Mock Papers Work

Free Sample Questions

Question Bank Coverage

Free CISI Operational Risk Practice Questions & Exam Preview

Exam Preview

Flashcards

Focus Learn

Unlock all Focus Learn

How to Use Mock Exams Effectively

Frequently Asked Questions

CISI Operational Risk Exam Guide: Everything You Need to Know

Top 5 Operational Risk Scenarios in Finance (CISI Guide)

Best CISI Corporate Finance Technical Foundations Mock Exams & Free Sample Papers

Ready to Prepare for Your Exam?

CISI Operational Risk Mock Exams & Free Sample Questions (2026)

CISI Operational Risk

CISI Operational Risk Mock Exams & Free Sample Questions (2026)

How the Mock Papers Work

Free Sample Questions

Question Bank Coverage

Free CISI Operational Risk Practice Questions & Exam Preview

Unlock all Focus Learn

How to Use Mock Exams Effectively

Frequently Asked Questions

Related Insights

CISI Operational Risk Exam Guide: Everything You Need to Know

Top 5 Operational Risk Scenarios in Finance (CISI Guide)

Best CISI Corporate Finance Technical Foundations Mock Exams & Free Sample Papers

Ready to Prepare for Your Exam?