Free PRMIA 8020 Exam Dumps June 2026

Step 1: Compliance Function and the Three Lines of Defense Model

The Three Lines of Defense (3LoD) model ensures that risk management responsibilities are properly segregated:

First Line: Business units (own and manage risk).

Second Line: Compliance and risk management (independent oversight).

Third Line: Internal audit (provides assurance).

Step 2: Why Compliance Must Be Independent

PRMIA and Basel Compliance Principles state that compliance should not report to business units, as this creates a conflict of interest.

Compliance must be independent to ensure objective oversight of regulatory adherence.

Step 3: Why the Other Options Are Incorrect

Option A ('Report to the business') Incorrect because compliance must provide independent oversight, not report to business units.

Option C ('Outsource compliance if risk function exists') Incorrect because compliance and risk functions have distinct roles.

Option D ('Outsource risk if compliance exists') Incorrect because risk management is a core function, not an outsourcing candidate.

PRMIA Risk Reference Used:

PRMIA Compliance Risk Governance -- States compliance must be independent under the Three Lines of Defense model.

Basel Compliance Principles -- Recommends separate reporting structures for compliance and business units.

Final Conclusion:

Compliance must be independent from the business to avoid conflicts of interest, making Option B the correct answer.

Step 1: Definition of a Critical Business Service in Operational Resilience

A Critical Business Service is one whose failure could result in severe harm to customers, financial markets, or the firm's viability.

Regulators (e.g., Bank of England, Basel Committee, PRMIA) define three primary factors for identifying critical services:

Customer impact

Market integrity impact

Firm viability impact

Step 2: Why Option C Is Incorrect

Risk appetite is an internal business decision, not an external measure of criticality.

A service can be critical even if its disruption stays within risk appetite.

Criticality is based on external impacts, not just internal risk limits.

Step 3: Why the Other Options Are Correct

Option A ('Material customer detriment') Correct as customer harm defines critical services.

Option B ('Harm to market integrity') Correct as market stability is a regulatory priority.

Option D ('Threaten firm viability') Correct as critical services often determine business survival.

PRMIA Risk Reference Used:

PRMIA Operational Resilience Framework -- Defines criteria for critical business services.

Basel Committee Operational Risk Guidelines -- Highlights customer, market, and firm viability as resilience factors.

Final Conclusion:

Risk appetite is an internal benchmark, not a measure of critical service designation, making Option C the correct answer.

Definition of Key Risk Indicators (KRIs)

KRIs are quantitative metrics used to monitor risk levels and detect early warning signs of potential risk events.

Top-down KRIs are identified at the senior management level and focus on enterprise-wide risk exposure.

Key Properties of Top-Down KRIs

Selected by senior management to ensure alignment with strategic objectives.

Tied to material external and internal loss exposures to capture critical financial, operational, and strategic risks.

Used to manage changes in the business environment to ensure proactive risk response, especially under stress conditions.

Why Other Answers Are Incorrect

Option

Explanation

B . Selected by senior management, used to manage changes in the business environment, especially under periods of stress, and reported on a daily basis.

Incorrect -- Top-down KRIs are not reported daily; they are monitored periodically (e.g., quarterly).

C . Selected by junior management, used to manage changes in the business environment, especially under periods of stress, and reported on an annual basis.

Incorrect -- Junior management does not define top-down KRIs; senior management does. Also, annual reporting is too infrequent.

D . Can only be selected by the board in line with risk ratings.

Incorrect -- The board provides oversight, but senior risk management selects KRIs, not just the board.

PRMIA Reference for Verification

PRMIA Risk Indicator Guidelines

Basel Committee on Banking Supervision (BCBS) Principles for Effective Risk Data Aggregation