swiss cheese

问题如下：

An operational risk manager is presenting to a group of representatives from financial institutions about the advantages and disadvantages of different approaches that firms use to manage operational risk. The manager provides an example of a financial institution that uses the Swiss cheese model as a control structure to manage the risk of operational losses due to incorrect transaction processing. Which of the following correctly describes an expected impact of the firm’s use of the Swiss cheese model?

选项：

A.Controls are structured in a way that a failure of a single key control would directly result in an operational loss.

B.Controls are structured in a way that every layer of controls would have to fail in order for an operational loss to occur.

C.When using this model, the probability of each subsequent control failure is dependent on whether a previous control for the same process failed.

D.By using this model, the probability of an extreme operational loss decreases significantly but the probability of small operational losses increases.

解释：

B is correct. The Swiss cheese model describes the layering of multiple controls, in which control weaknesses in each layer appear like holes in a slice of Swiss cheese and act like their position constantly changes. In this model, all the control layers would have to fail simultaneously (i.e. the holes in all layers would need to be aligned) in order for an operational loss to result. A is incorrect. The multiple control layers in a Swiss cheese framework imply that a failure of one control does not automatically result in a loss, since other control layers would need to fail too. C is incorrect. Controls should be structured so that the probability of failure of different controls should be independent. While a decreasing probability of subsequent control failures would be beneficial, in practice achieving this might not be realistic. D is incorrect. The controls are assumed to be independent, and given this structure in which multiple controls must fail for an operational loss to occur, the probability of both smaller and larger losses is likely to decrease after the model is implemented.