Enterprise Risk Management (ERM) common mistakes
Enterprise Risk Management (ERM) · Understand the traps and how to avoid them.
When asked to quantify a risk, the candidate reports only a point estimate (e.g., a single expected loss figure) and never states the confidence level, time horizon, or distributional assumption behind it, so the number is uninterpretable and ungraded as a quantitative answer.
Candidates learn formulas such as expected loss = probability x impact and treat producing the number as the end of the task, forgetting that in ERM every quantitative measure is conditional on a stated confidence level and horizon (for example a 99% one-year VaR versus a 95% figure). The exam frequently tests whether the candidate knows that a metric without its parameters is meaningless.
What to do instead
Adopt a fixed reporting template for every quantitative answer: measure name, confidence level, time horizon, distribution or model assumption, and units. Before finalizing, re-read the prompt and check whether it specified parameters; if it did not, state the assumption explicitly. Practise by rewriting five past quantitative answers into this five-part form until it becomes automatic.
The candidate treats risk appetite, risk tolerance, and risk capacity as interchangeable synonyms, using whichever term appears in the prompt and answering as if the three were one concept.
The terms sound similar and are often used loosely in practice, so candidates memorize a single definition and apply it everywhere. The exam deliberately tests the distinctions: capacity is the maximum risk the organization can bear before breaching constraints, appetite is the amount it is willing to pursue for return, and tolerance is the acceptable variation around the appetite.
What to do instead
Build a three-row comparison table with columns for definition, who sets it (board, management, or external constraint), and a one-line example. Drill by taking ten short scenarios and labelling each as capacity, appetite, or tolerance with a one-sentence justification. Review the table immediately before the exam.
When asked to identify or classify risks, the candidate lists only the risk event (for example 'a supplier fails') without tracing it to the underlying driver, the affected objective, and the transmission channel, producing a flat list rather than a structured risk statement.
Candidates default to brainstorming hazards instead of applying a cause-event-impact structure. ERM questions often reward identifying root drivers and the objectives at risk, and a bare event list cannot be scored against those criteria.
What to do instead
Write every risk identification in a fixed cause-event-impact sentence: 'Because of [driver], [event] may occur, affecting [objective] through [channel].' Practise converting twenty single-word risks into this format. In the exam, count how many of your answers include all three components and rewrite any that do not.
The candidate confuses inherent risk with residual risk, or reports a residual risk without describing the specific controls that produce the reduction, so the two figures appear arbitrary.
Textbook definitions are easy to recite, but under time pressure candidates skip the control step and jump from identified risk to a lower number. The exam tests whether the candidate can articulate the control environment as the mechanism linking the two measures.
What to do instead
For every risk entry, force a four-column layout: inherent rating, control description, control effectiveness assessment, residual rating. Never write a residual figure without naming the controls and judging their design and operating effectiveness. Rehearse with five scenarios where controls are partially effective, since those expose the confusion most clearly.
The candidate answers a model-risk question by asserting that a validated model is 'approved and therefore reliable', rather than discussing limitations, assumptions, backtesting results, and the conditions under which the model would fail.
Candidates conflate governance sign-off with predictive accuracy. Validation confirms that a model is fit for its intended use under stated assumptions; it does not eliminate model risk, and exam questions probe exactly this gap.
What to do instead
Prepare a standard model-risk answer skeleton: purpose and use, key assumptions, data limitations, validation and backtesting evidence, known failure conditions, and ongoing monitoring triggers. Apply it to at least three model types (credit scoring, VaR, operational-loss frequency-severity) so the skeleton transfers to unfamiliar contexts.
When a question involves correlation or diversification, the candidate assumes independence or assumes that historical correlation will hold in stress, without stating the assumption or discussing tail dependence and correlation breakdown.
Simple additive formulas are easier to remember, so candidates apply them outside their valid conditions. Crisis experience shows correlations rise in stress, and the exam tests awareness that diversification benefits shrink precisely when they are most needed.
What to do instead
Whenever aggregation or portfolio effects appear, write one sentence on the dependence assumption and one on how it behaves in stress. Memorize the qualitative point that tail dependence and correlation breakdown reduce diversification in extremes, and practise stating it in under two sentences so it fits within time limits.
The candidate describes a risk response as 'mitigate' or 'monitor' without naming the specific action, the owner, the cost, and the residual exposure after the action, leaving the response indistinguishable from a vague intention.
The standard response categories (avoid, reduce, transfer, accept) are easy to list, so candidates stop at the label. Exam questions on response selection reward specificity: who does what, at what cost, and what remains.
What to do instead
Use a response template: chosen option, rationale versus alternatives, specific actions, accountable owner, cost and effort, expected residual risk, and review trigger. Practise by taking a single risk and drafting three competing responses with this template, then justifying the selection in two sentences.
The candidate treats the three lines model as a hierarchy of seniority, describing internal audit as 'above' risk management, or assigns risk ownership to the second line rather than the business.
Organizational charts encourage a vertical reading, and the word 'lines' suggests ranking. In fact the model separates ownership (first line), oversight and challenge (second line), and independent assurance (third line), and the exam tests whether ownership stays with the business.
What to do instead
Draw the model horizontally with a one-line mandate and a one-line boundary for each line, and memorize the rule that the second line advises and challenges but never owns the risk. Test yourself with five scenarios asking 'who owns this risk and who assures it' until the answers are immediate.
The candidate computes a risk metric such as expected shortfall, VaR, or a capital figure correctly in arithmetic but misinterprets what the number means, for example claiming that a 99% one-year VaR of 50 million means losses cannot exceed 50 million.
Candidates focus preparation on calculation mechanics because those feel testable, and neglect interpretation. VaR says nothing about the size of losses beyond the threshold, and confusing the confidence level with a maximum loss is a classic error the exam targets.
What to do instead
For each metric, memorize a one-sentence correct interpretation and a one-sentence common misinterpretation. For VaR, state that losses exceed the threshold with the complementary probability and that the magnitude beyond it is unconstrained; for expected shortfall, state that it is the average loss conditional on exceeding the threshold. Practise writing both sentences from memory.
The candidate answers a governance or framework question by listing component names (for example the elements of a risk framework) without explaining how the components connect, who is accountable, or how information flows to the board.
Framework diagrams are memorized as labels, and under time pressure candidates reproduce the list rather than the logic. ERM questions frequently ask about integration and escalation, which a bare list cannot address.
What to do instead
For each framework, prepare one paragraph describing the flow: identification to assessment to response to monitoring to reporting, naming the accountable role at each step and the escalation trigger. Practise condensing it to four sentences, then expand back to a full paragraph, so the structure is available at any required length.