Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
For the FTX case study, what was the "backdoor" used for?
The FTX collapse involved fraudulent fund mismanagement, where FTX executives created a 'backdoor' to allow Alameda Research (FTX's sister trading firm) to borrow client funds without their consent.
Step 1: The 'Backdoor' in FTX
The backdoor was a hidden code in FTX's system, allegedly created by Sam Bankman-Fried, which allowed Alameda to access customer deposits without triggering alerts to auditors or compliance teams.
Alameda used these funds for risky trading strategies and investments, leading to the eventual collapse of FTX when a liquidity crunch exposed the missing funds.
Step 2: Why the Other Options Are Incorrect
Option A ('allowed a stablecoin to be removed from the ledger and added to the balance sheet')
Incorrect because FTX's fraud involved misuse of customer funds, not just a stablecoin misclassification.
Option C ('allowed currency traders to smooth profits and conceal losses for over two years')
Incorrect because this sounds more like LIBOR-rigging scandals, whereas FTX misappropriated client funds.
Option D ('allowed a rapid pace of acquisitions but poor integration of acquired companies')
Incorrect because FTX's collapse was due to financial fraud, not poor acquisition strategy.
PRMIA Risk Reference Used:
PRMIA Financial Crime Risk Management -- Discusses insider risk and fraudulent misappropriation of funds.
FTX Collapse Reports -- SEC, CFTC, and DOJ filings confirm that Alameda had unauthorized access to client funds.
Final Conclusion:
FTX's backdoor enabled Alameda to take $65 billion in client funds without permission, making Option B the correct answer.
Process mapping is:
Process Mapping is a risk management tool used to visualize workflows, identify inefficiencies, and detect control gaps. PRMIA defines process mapping as an essential operational risk management tool.
Step 1: Understanding Process Mapping
Helps analyze complex, process-intensive activities (Option A).
Reveals control weaknesses that could lead to operational risks (Option B).
Improves hand-offs and collaboration between teams (Option C).
Step 2: Why 'All of the Above' is Correct
Process mapping serves multiple risk management purposes, making all listed options valid.
PRMIA Risk Reference Used:
PRMIA Operational Risk Management Guidelines -- Recommends process mapping to identify inefficiencies and control gaps.
PRMIA Risk Governance Framework -- Encourages visualization tools for process improvement.
Final Conclusion:
Process mapping improves risk awareness, identifies control gaps, and enhances operational workflows, making Option D the correct answer.
Which of the below is accurate about a risk assessment workshop?
Step 1: What Is a Risk Assessment Workshop?
A risk assessment workshop is a structured session where key stakeholders identify, evaluate, and prioritize risks.
Effective workshops require preparation, clear objectives, and structured discussions to ensure meaningful risk analysis.
Step 2: Why Option B is Correct
PRMIA and best practices recommend thorough preparation, including:
Setting objectives
Defining risk categories
Ensuring participation from risk, compliance, and business units
Providing risk assessment tools/templates
Step 3: Why the Other Options Are Incorrect
Option A ('Run spontaneously') Incorrect because lack of preparation leads to poor discussions and missed risks.
Option C ('Risk management should not attend') Incorrect because risk managers provide key expertise to guide discussions.
Option D ('Compliance experts should not attend') Incorrect because compliance provides regulatory insights essential to risk assessment.
PRMIA Risk Reference Used:
PRMIA Risk Assessment Framework -- Recommends structured, well-prepared workshops.
ISO 31000 Risk Management Standard -- Supports proactive workshop planning.
Final Conclusion:
Risk assessment workshops should be well-prepared to ensure meaningful discussions and effective risk identification, making Option B the correct answer.
Risk and compliance functions often work together; which of the following best desribes the issue with a "zero risk appetite"?
Understanding Zero Risk Appetite in Compliance
A zero risk appetite means the organization does not tolerate any compliance breaches.
However, in real-world risk management, it is often impractical to have zero risk exposure.
Some compliance violations may occur despite strong controls, making a strict zero-risk stance unrealistic.
Why Answer C is Correct
If an organization adopts a zero risk appetite for compliance, any compliance issue, even minor ones, would breach this policy.
This contradicts practical risk management, which allows for some residual risk while maintaining controls.
Why Other Answers Are Incorrect
Option
Explanation
A . A zero risk appetite is illegal under all known regulations.
Incorrect -- It is not illegal, but it is impractical in many industries.
B . It means that there can be a risk self-assessment workshop for the compliance department.
Incorrect -- Self-assessments are part of compliance but do not define zero risk appetite issues.
D . It will result in a compliance investigation conducted by the first line.
Incorrect -- Investigations are typically conducted by the second or third line of defense (compliance or audit), not the first line.
PRMIA Reference for Verification
PRMIA Risk Appetite Guidelines
Basel & ISO 31000 Risk Management Frameworks
Which of the following best describes the role of the compliance department?
Three Lines of Defense Model
The compliance department functions as the second line of defense, ensuring oversight over the first line's compliance controls.
It does not directly implement controls but monitors and advises on compliance risk management.
Responsibilities of the Compliance Department
Ensures regulatory compliance with laws, policies, and industry standards.
Monitors and enforces risk management controls within business operations.
Provides advisory and training on compliance risks.
Why Answer D is Correct
The first line of defense (business operations) is responsible for executing compliance controls.
The compliance department (second line) provides oversight and governance to ensure compliance adherence.
Why Other Answers Are Incorrect
Option
Explanation
A . The compliance department is responsible for implementing the first line's compliance risk management controls.
Incorrect -- The first line (business units) implement compliance controls, while compliance oversees.
B . The compliance department is responsible for providing oversight over the auditor's implementation of compliance risk management controls.
Incorrect -- Internal audit is part of the third line of defense, not directly overseen by compliance.
C . The compliance department is responsible for providing oversight over the board's implementation of compliance risk management controls.
Incorrect -- The board provides high-level governance; compliance ensures business adherence to regulations.
PRMIA Reference for Verification
PRMIA Governance & Compliance Oversight Framework
Basel Committee's Guidelines on Compliance Risk Management
Ideally, the facilitator of a risk assessment workshop should:
Step 1: Role of a Risk Assessment Facilitator
The facilitator's main role is to guide discussions without bias, ensuring objective risk identification.
PRMIA's Risk Governance Framework highlights neutral facilitation as key to effective risk workshops.
Step 2: Why Option C Is Correct
Objectivity ensures unbiased risk assessment.
Expressing personal opinions can influence risk ratings, leading to distorted outcomes.
Step 3: Why the Other Options Are Incorrect
Option A ('Guide the workshop toward a pre-determined conclusion')
Incorrect because risk workshops should discover risks, not confirm pre-set beliefs.
Option B ('Attendees can override results')
Incorrect as risk results should be evidence-based, not subject to override.
Option D ('Attend via video connection')
Incorrect as facilitators must engage actively, making remote facilitation less effective.
PRMIA Risk Reference Used:
PRMIA Risk Governance Framework -- Stresses objectivity in risk assessment facilitation.
PRMIA Risk Identification Best Practices -- Encourages unbiased workshops.
Final Conclusion:
Facilitators must remain neutral and objective, making Option C the correct answer.
Which of the below is a definition of climate risk?
Step 1: Definition of Climate Risk
PRMIA and global financial regulators define climate risk as the financial, operational, and societal risks arising from climate change.
Climate risks impact businesses through physical risks (e.g., floods, wildfires) and transition risks (e.g., regulatory changes, carbon pricing).
Step 2: Why the Other Options Are Incorrect
Option A ('Climate risk has been moved out of all risk taxonomies due to international agreement')
Incorrect because climate risk is now a central part of risk taxonomies, as emphasized by PRMIA, Basel III, and TCFD.
Option B ('Climate risk refers to the growing impacts of credit risk on the business environment')
Incorrect because credit risk is just one aspect of climate risk, not the full definition.
Option C ('Climate risk refers to change in the business climate during a recession')
Incorrect because climate risk is about environmental change, not economic cycles.
PRMIA Risk Reference Used:
PRMIA Climate Risk Guidelines -- Defines climate risk as a financial and societal risk due to climate change.
TCFD (Task Force on Climate-Related Financial Disclosures) -- Outlines regulatory expectations for climate risk management.
Final Conclusion:
Climate risk involves physical and transition risks from climate change, making Option D the correct answer.
Exam domains verified against: Official PRMIA 8020 exam guide, last checked October 2026.
Measures the skills of Risk Analysts. Covers fundamental concepts of risk governance, management, and assessment. Introduces key principles, regulatory frameworks, and industry best practices for identifying and addressing risks. Key skill measured: Understanding the foundational principles of risk management.
Measures the skills of Compliance Officers. Covers policies, structures, and processes that define how organizations oversee risk. Explores regulatory compliance, ethical considerations, and corporate governance frameworks to ensure accountability. Key skill measured: Applying governance frameworks to organizational risk policies.
Measures the skills of Risk Managers. Covers structured approaches for risk identification, evaluation, and mitigation. Includes industry-standard frameworks that guide risk strategy and decision-making. Key skill measured: Establishing a risk management framework for organizations.
Measures the skills of Financial Risk Analysts. Covers methodologies for evaluating risks in different domains, including qualitative and quantitative approaches. Focuses on assessing vulnerabilities, threats, and potential impacts on business operations. Key skill measured: Conducting risk impact analysis for financial threats.
Measures the skills of Risk Data Specialists. Covers the collection, analysis, and communication of risk-related data. Highlights the role of data-driven decision-making in mitigating uncertainties and ensuring compliance. Key skill measured: Interpreting risk data for informed decision-making.
Sample question from this domain above: Q4
Measures the skills of Risk Data Specialists. Covers the collection, analysis, and communication of risk-related data. Highlights the role of data-driven decision-making in mitigating uncertainties and ensuring compliance. Key skill measured: Interpreting risk data for informed decision-making.
Measures the skills of Quantitative Risk Analysts. Covers mathematical and statistical techniques used to predict risk scenarios. Explores model development, validation, and application in financial and operational risk management. Key skill measured: Applying statistical models for risk prediction.
Measures the skills of Insurance Risk Specialists. Covers strategies for transferring risk through insurance and other financial instruments. Focuses on risk transfer mechanisms, policy structuring, and claims management. Key skill measured: Assessing risk transfer options through insurance.
Measures the skills of Business Risk Consultants. Covers real-world applications of risk management concepts. Examines case studies on risk governance, assessment, and mitigation strategies across different industries. Key skill measured: Analyzing historical risk events for strategic insights.
Common questions about the exam itself
