CAIIB · Bank Financial Management · Module B — Risk Management
CAIIB BFM Unit 16 — Operational Risk and Integrated Risk Management: Free MCQs with Explanations
By Swarnakshi Jha (ex-banker) · Updated 29 October 2026 · Paper II of the December 2026 cycle (Saturday 12 December 2026)
This is the free practice page for CAIIB BFM Unit 16 — Operational Risk and Integrated Risk Management (Module B — Risk Management). The CAIIB Mock Centre holds 183 questions on this unit alone, every one with a why-right / why-wrong explanation; below are the facts examiners keep returning to, five practice questions with explanations, and the traps that cost marks.
BFM · Module B183 MCQs in the Mock Centre5 free belowPaper on 12 December
Key facts examiners test from this unit
Operational risk, its nature and classification — operational risk is loss from failed processes, people and systems, or external events; legal risk is in, strategic and reputational risk are out.
Principles, organisation and processes — the 2011 Basel paper sets 11 principles from culture to disclosure; the Board approves the framework and appetite, the ORMC sets policy and approves new products, the ORMD assesses and reports, and internal audit stays independent.
Measuring operational risk — BIA charges 15% of average positive gross income over three years; TSA applies betas of 12%, 15% or 18% to eight business lines; the AMA uses the bank's own approved model.
Changed since the textbook
Banks still on the Basic Indicator Approach (30 Jun 2026). HDFC Bank's Pillar 3 disclosure at 30 June 2026 still computes operational-risk capital under the Basic Indicator Approach: RBI's 2023 standardised approach had no start date, and RBI's credit-risk Directions of April 2026 (from 1 April 2027) did not include operational risk. Source: HDFC Bank
Financial Stability Report: cyber risk survey (30 Jun 2026). RBI's Financial Stability Report of June 2026 found AI-driven cyberattacks to be the top perceived risk for banks and NBFCs. Source: Business Standard
5 free practice questions — tap an option
Five practice questions from this unit. Answers lock on the first tap, exactly as in the exam, and an explanation opens underneath. The Mock Centre has all 183 questions on this unit, from easy to tough, with caselets and key-in numericals, why every other option is wrong and the exam tip — and tracks your score and revision dates.
Question 1 of 5
In the cause-based classification, "inadequate segregation of duties" and "lack of management supervision" are:
Why (d): The textbook lists inadequate segregation of duties, lack of management supervision and inadequate procedures as process-oriented causes based on operational control. (a) is wrong: People causes are negligence, incompetence, insufficient training, integrity and key-man dependence. (b) is wrong: Technology causes are poor technology, obsolete applications, lack of automation and similar. (c) is wrong: External causes are natural disasters, third-party failures and a deteriorating social or political context.
Question 2 of 5
In the Basel event-type definitions, what separates internal fraud from external fraud?
Why (d): Internal fraud involves at least one internal party; external fraud is committed by a third party. (a) is wrong: The definitions do not depend on the amount. (b) is wrong: Insurance does not change the event type. (c) is wrong: Both kinds of fraud can use technology.
Question 3 of 5
The Basel Committee's March 2021 Principles for Operational Resilience define operational resilience as:
Why (b): The Basel Committee defines operational resilience as a bank's ability to deliver critical operations through disruption: identifying threats, responding, adapting, recovering and learning. RBI's 2024 Guidance Note follows it. IT disaster recovery and operational risk management are parts of it, not the definition. (a) is wrong: Disaster recovery is one part of resilience. (c) is wrong: Capital absorbs losses; resilience is about continuing operations. (d) is wrong: That describes operational risk management.
Question 4 of 5
If the eight TSA betas are simply averaged, the result is:
Why (d): (3 × 18 + 2 × 15 + 3 × 12) ÷ 8 = 120 ÷ 8 = 15%, the alpha of the BIA, as the textbook points out. (a) is wrong: 12% is only the lowest beta. (b) is wrong: 18% is only the highest beta. (c) is wrong: The arithmetic gives 15%.
Question 5 of 5
Which of these is a key risk indicator rather than part of an RCSA?
Why (b): A KRI is a metric tracked over time, such as suspense-account entries, which the textbook cites as raising suspicion about operations; the other three are parts of the RCSA process. (a) is wrong: A checklist is a tool of the RCSA process. (c) is wrong: Self-assessing control gaps is the RCSA itself. (d) is wrong: The action plan is the last step of an RCSA.
0 of 5 answered.
Traps in this unit
Discrimination is not internal fraud.
Reputational risk is outside the definition.
The ORMD assesses new products; the ORMC approves them.
Practise all 183 questions on Unit 16. The free CAIIB demo opens Units 1–2 of every paper with full explanations; the BFM Online Mock Centre unlocks all 7,600+ BFM questions, the full-length papers with caselets and key-ins, module mocks and Smart Revision for 18 months (₹1,499).
Independent study aid — not affiliated with, endorsed by, or sponsored by the Indian Institute of Banking & Finance (IIBF). Exam pattern, dates, fees and passing criteria are set by IIBF — always confirm the current rules at iibf.org.in. CAIIB content follows rules and developments up to IIBF's cut-off of 30 June 2026 (where a rule changed later, the update box says so); verify from official sources before relying on them in practice.