Risk Management and Modeling: Identification, Measurement, and Model Risk
From identification to quantification
Risk management moves from identification (taxonomies, process mapping, scenario workshops, loss-event data) to assessment (likelihood and impact, qualitative heat maps, quantitative distributions) to response (avoid, reduce, transfer, accept) to monitoring. Candidates must distinguish inherent versus residual assessment, and know that risk response must be justified against appetite and cost.
Core modeling toolkit
Expect to reason about frequency-severity models (Poisson frequency, lognormal severity), loss distributions and their tails, value at risk (VaR) and expected shortfall (ES). VaR is a quantile: it says nothing about the size of losses beyond it, and it is not subadditive, so it can penalize diversification. ES is the average loss beyond the VaR threshold and is coherent. Traps: treating VaR as a worst-case loss; confusing 95% VaR with a 5% probability of a loss larger than that figure (that part is correct) but then assuming the excess is small.
Correlation, dependence, and aggregation
Diversification benefits depend on dependence assumptions. Correlation is not causation, and correlation under stress tends to rise. Copulas model tail dependence; assuming multivariate normality understates joint extremes. Monte Carlo simulation is standard for aggregation; its output quality depends on input distributions and dependence structure.
Model risk management
Models can be wrong, misused, or stale. Sound practice includes conceptual soundness review, data quality checks, backtesting, benchmarking, sensitivity analysis, independent validation, documentation, and governance over overrides. Model risk is highest for complex, opaque models used in decisions with large stakes.
Worked rule of thumb
If a model's output drives a decision with material consequences, it needs independent validation proportionate to that consequence. A simple, transparent model with documented limitations often beats a sophisticated model nobody can explain.
Traps to watch
Backtesting a VaR model at 99% requires far more observations than at 95%; small samples produce unreliable conclusions. Also, a model that passes backtesting can still fail under regime change.