Risk Management Fundamentals and Frameworks
Risk management is the coordinated set of activities that directs and controls an organization with regard to risk. The candidate must be comfortable with the core definitional vocabulary: risk (effect of uncertainty on objectives, with both upside and downside), inherent risk (before controls), residual risk (after controls), risk appetite (amount of risk willing to be pursued), risk tolerance (acceptable deviation from appetite), risk capacity (maximum risk the organization can bear), and control (any measure that modifies risk).
Know the major frameworks at a conceptual level. ISO 31000 provides principles, a framework, and a process (communication and consultation, scope/context, assessment, treatment, monitoring and review, recording and reporting). COSO ERM organizes risk around governance and culture, strategy and objective-setting, performance, review and revision, and information/communication/reporting. The Three Lines Model separates management ownership of risk (first line), independent risk and compliance oversight (second line), and independent assurance (third line). Also recognize the risk management process cycle and the concept of the risk universe.
Common traps: confusing appetite (willingness) with capacity (ability); treating residual risk as the starting point; describing the second line as providing assurance (that is the third line); assuming frameworks are prescriptive standards rather than flexible guidance.
Rule of thumb: Appetite is chosen, capacity is constrained, tolerance is the buffer. Worked example: a firm sets a market-risk appetite of a 5% maximum annual loss on capital, with tolerance allowing up to 6% before escalation; capacity is 10% before solvency is threatened. A 5.5% loss triggers escalation but not a breach of capacity.