Answer: The central operational risk function should be responsible for aggregating information from each of the business units about operational risk exposures.

The correct answer is C. The central operational risk function should be responsible for collecting information about specific operational risk exposures from the business units and aggregating this information into a firm-wide risk report. This approach ensures a comprehensive view of the firm's operational risks, allowing for effective risk management and decision-making. Option A is incorrect because reports to the board of directors should focus on key risk metrics that provide an overview and are necessary for strategic decision-making, rather than a more detailed and extensive set of indicators. Business line managers and first-line risk managers should monitor a broader range of indicators to detect potential adverse trends. Option B is incorrect because the responsibility for executing necessary changes to the firm's risk exposures after risk reports are reviewed should lie with the firm's executive committee, not the operational risk committee. Option D is incorrect because while forward-looking risk indicators are valuable, especially in firms with a mature operational risk management function, risk reporting does not have to be exclusively forward-looking. Many firms still use a largely backward-looking approach, such as performing trend or volatility analysis on the firm's operational losses over time, which can also provide valuable insights.

Author: LeetQuiz Editorial Team