Associate PRM cheat sheet

Risk is the combination of the probability of an event and its consequences; pure risk offers only loss or no loss, speculative risk offers gain or loss.

Expected loss = probability of default x exposure at default x loss given default; it is a cost of doing business, not a risk to be feared.

Unexpected loss is the volatility of loss around the expected value and is the quantity covered by economic capital.

Three lines model: business units own risk, an independent risk function sets frameworks and oversight, internal audit provides independent assurance.

Board approves risk appetite and tolerates breaches only within stated limits; management executes within that appetite.

Risk appetite is the amount and type of risk an organization accepts; risk tolerance is the acceptable variation around that appetite.

Enterprise risk management aggregates risks across silos; diversification benefits exist only when risks are not perfectly correlated.

Governance requires clear delegation of authority, documented limits, and escalation paths with defined triggers.

Risk identification methods include process mapping, scenario analysis, workshops, loss-event inventories, checklists, and external data benchmarking.

Frequency and severity are modeled separately; expected annual loss = expected frequency x expected severity.

Value at Risk at confidence c is the loss not exceeded with probability c over a stated horizon; it says nothing about the size of losses beyond it.

Expected shortfall (conditional VaR) is the average loss in the tail beyond VaR and is sub-additive, unlike VaR.

Correlation ranges from -1 to +1; combining two risks of equal volatility gives portfolio volatility sqrt(w1^2 s1^2 + w2^2 s2^2 + 2 w1 w2 s1 s2 rho).

Stress testing applies severe but plausible scenarios; scenario analysis explores low-frequency high-severity events that historical data misses.

Key risk indicators are forward-looking metrics with thresholds that trigger escalation before losses materialize.

Risk maps plot likelihood against impact to prioritize risks for treatment and capital allocation.

Credit risk is the risk that a counterparty fails to meet its obligations; components are default risk, exposure risk, and recovery risk.

Credit rating grades map to probability of default; through-the-cycle ratings dampen cyclicality, point-in-time ratings reflect current conditions.

Merton model treats equity as a call option on firm assets; default occurs when asset value falls below the debt threshold at maturity.

Credit migration risk is the risk of downgrade reducing value even without default.

Concentration risk arises from large single-name exposures or correlated sector and geographic exposures; limits cap them.

Credit mitigation includes collateral, guarantees, credit derivatives, and netting; each carries basis, legal, and operational risk.

Credit VaR estimates the loss distribution of a portfolio over a horizon, typically one year, at a chosen confidence level.

Counterparty credit risk includes wrong-way risk, where exposure rises as counterparty credit quality falls.

Market risk is loss from movements in market prices: interest rates, equities, FX, commodities, and their volatilities.

Delta measures change in value per unit change in underlying; gamma measures change in delta; vega measures sensitivity to volatility; theta measures time decay; rho measures rate sensitivity.

Duration approximates percentage price change for a small yield shift; modified duration = Macaulay duration / (1 + yield/k).

Convexity corrects duration estimates for larger yield moves: price change ≈ -D x Δy + 0.5 x C x Δy^2.

Parametric VaR = z x portfolio volatility x portfolio value for a normal distribution; historical VaR uses empirical return quantiles; Monte Carlo simulates paths.

VaR is not sub-additive in general; merging two desks can produce VaR greater than the sum of individual VaRs.

Backtesting compares VaR exceptions to expected counts; too many exceptions signals model failure.

Interest rate risk in the banking book includes repricing gap risk and basis risk; the trading book uses VaR and sensitivities.

Operational risk is loss from inadequate or failed internal processes, people, systems, or external events; it excludes strategic and reputational risk in the Basel definition.

Basel event categories: internal fraud, external fraud, employment practices, clients and business practices, damage to physical assets, business disruption and system failures, execution and delivery.

Frequency follows a low-mean Poisson process; severity is heavy-tailed, so tail events dominate annual loss distributions.

The loss distribution approach convolves frequency and severity distributions to obtain aggregate loss distribution and operational VaR.

Key risk indicators, control self-assessments, and loss databases are the primary operational risk measurement inputs.

Business continuity planning addresses resilience; recovery time objective and recovery point objective define acceptable outage and data loss.

Strategic risk arises from poor business decisions or failure to adapt; reputational risk is loss of stakeholder trust.

Enterprise risk aggregates credit, market, operational, and other risks, accounting for correlation and diversification.

Risk treatment options: avoid, reduce, transfer, and accept; residual risk is what remains after controls.

Four Ts of hazard risk: tolerate, treat, transfer, terminate.

Control effectiveness is assessed by design adequacy and operating effectiveness; a control that is not tested is not evidenced.

Hedging with derivatives transfers price risk but introduces basis risk, counterparty risk, and liquidity risk.

Netting and collateral reduce counterparty exposure; collateral introduces haircut, wrong-way, and operational risks.

Limits should be set at desk, portfolio, and firm level and monitored against utilization with escalation on breach.

Risk reporting must be timely, accurate, and decision-useful; dashboards show exposures, limit utilization, and KRI status.

Segregation of duties, maker-checker controls, and independent validation of models reduce control failure risk.

Professionals must act with integrity, objectivity, competence, confidentiality, and professionalism in all risk decisions.

Conflicts of interest must be disclosed and managed; a risk manager must not be compensated in a way that rewards suppressing risk disclosure.

Model risk must be disclosed; presenting model output as certainty misrepresents the reliability of estimates.

Material risk information must not be withheld from the board, regulators, or stakeholders.

Whistleblowing protections support escalation of unethical or unsafe practices without retaliation.

Client suitability obligations require that products and advice match the client's objectives, risk tolerance, and constraints.

Confidentiality applies to client and firm data; disclosure is permitted only when required by law or authorized.

Regulatory obligations override commercial pressure; documented escalation is the professional response to pressure to misstate risk.