Risk Analysis and Measurement
Risk analysis converts identified risks into decision-useful information. Candidates must understand the difference between qualitative (descriptive scales), semi-quantitative (numeric scales with subjective mapping), and quantitative (statistical and simulation) methods, and when each is appropriate.
Key quantitative concepts: probability and frequency, severity and loss given event, expected loss (probability x impact), volatility (standard deviation), Value at Risk (VaR) and its limitations (not a worst case; says nothing beyond the confidence level; can be subadditive), Expected Shortfall / CVaR (average loss beyond VaR), stress testing and scenario analysis for tail and plausible-severe events, and Monte Carlo simulation for aggregating distributions. Understand correlation and diversification, risk aggregation, and the distinction between standalone and portfolio risk. In operational risk, know frequency-severity modeling and loss distribution approaches conceptually.
Traps: treating VaR as a maximum loss; ignoring model risk and data quality; assuming normal distributions for fat-tailed risks; confusing stress testing (severe but plausible scenarios) with sensitivity analysis (single-variable change); and forgetting that correlation often rises in crises.
Rule of thumb: Use quantitative methods where data support them; otherwise use structured qualitative judgment and disclose limitations. Worked example: a portfolio has 1-day 99% VaR of $2 million. This means a 1% chance the loss exceeds $2 million on any given day, not that losses cannot exceed it. Expected Shortfall might be $3.5 million, the average loss in that worst 1% tail.