
Financial Risk Manager Part 1
Get started today
Ultimate access to all questions.
Q.5302 In a financial institution following the Three Lines of Defense Model, the following information is given:
- The First Line of Defense (Business Units) detects 70% of all operational risk incidents.
- The Second Line of Defense (Risk Management) detects 60% of the remaining undetected incidents.
- The Third Line of Defense (Internal Audit) detects 50% of the remaining undetected incidents after the Second Line of Defense.
What is the probability that an operational risk incident is detected by at least one of the three lines of defense?
Explanation:
Detailed Explanation
Let's calculate the probability step by step:
Step 1: First Line of Defense
- First Line detects 70% of all incidents
- Probability detected by First Line: 0.70
- Probability remaining undetected: 1 - 0.70 = 0.30
Step 2: Second Line of Defense
- Second Line detects 60% of remaining undetected incidents
- Probability detected by Second Line: 0.30 × 0.60 = 0.18
- Probability remaining undetected: 0.30 × (1 - 0.60) = 0.30 × 0.40 = 0.12
Step 3: Third Line of Defense
- Third Line detects 50% of remaining undetected incidents
- Probability detected by Third Line: 0.12 × 0.50 = 0.06
- Probability remaining undetected: 0.12 × (1 - 0.50) = 0.12 × 0.50 = 0.06
Step 4: Total Probability of Detection
- Total detected = First Line + Second Line + Third Line
- Total detected = 0.70 + 0.18 + 0.06 = 0.94
Step 5: Probability of Detection by At Least One Line
- This is equivalent to 1 minus the probability that no line detects the incident
- Probability no detection = 0.06
- Probability at least one detection = 1 - 0.06 = 0.94
Wait, let me recalculate this carefully:
Correct Calculation:
- First Line detects: 70% = 0.70
- Remaining undetected: 30% = 0.30
- Second Line detects: 60% of 30% = 0.60 × 0.30 = 0.18
- Remaining undetected: 0.30 - 0.18 = 0.12
- Third Line detects: 50% of 12% = 0.50 × 0.12 = 0.06
- Remaining undetected: 0.12 - 0.06 = 0.06
Total detected = 0.70 + 0.18 + 0.06 = 0.94
But the question asks for "probability that an operational risk incident is detected by at least one of the three lines of defense" which should be 1 - probability(no detection) = 1 - 0.06 = 0.94
However, looking at the options, 0.94 is option A, but let me verify if there's an error in my calculation.
Alternative approach using multiplication:
- Probability NOT detected by First Line: 1 - 0.70 = 0.30
- Probability NOT detected by Second Line given First Line missed: 1 - 0.60 = 0.40
- Probability NOT detected by Third Line given both missed: 1 - 0.50 = 0.50
- Probability NO detection = 0.30 × 0.40 × 0.50 = 0.06
- Probability AT LEAST ONE detection = 1 - 0.06 = 0.94
This confirms that the correct answer should be 0.94, which corresponds to option A.
However, let me double-check the interpretation of the problem. The Second Line detects 60% of the remaining undetected incidents after the First Line, and the Third Line detects 50% of the remaining undetected incidents after the Second Line. This is exactly what I calculated.
Therefore, the correct probability is 0.94, which is option A.
Answer: A (0.94)