AIRAF cheat sheet

Three-lines model: first line owns and manages risk, second line sets frameworks and oversight, third line provides independent assurance; each line reports through separate channels.

COSO ERM components: governance and culture, strategy and objective-setting, performance, review and revision, information-communication-reporting.

Risk appetite is the aggregate level of risk the board accepts; risk tolerance is the acceptable deviation around a specific limit or metric.

Board risk committee responsibilities: approve appetite statement, oversee framework adequacy, review top and emerging risks, and confirm escalation paths.

Framework components: risk policy, taxonomy, appetite statement, roles and responsibilities, methodology, data and systems, and reporting cadence.

Segregation of duties requires that risk-taking, risk-oversight, and risk-assurance activities reside in different reporting lines.

Three-lines model is a governance structure, not a control; it does not by itself reduce or transfer risk.

Escalation thresholds are defined ex ante by limit breaches, severity ratings, or time elapsed without remediation, not by discretion.

Risk register fields: unique ID, description, cause, event, consequence, inherent rating, controls, residual rating, owner, and review date.

Inherent risk is assessed before controls; residual risk is assessed after control effectiveness is evaluated.

Risk = likelihood × impact for qualitative scoring; heat maps plot the two axes with appetite boundaries marked.

Bow-tie analysis separates threats and preventive controls on the left from consequences and mitigative controls on the right, with the event at the center.

Root-cause analysis (5 Whys, fishbone) distinguishes the cause of an event from its symptom and its consequence.

Emerging risk indicators are forward-looking and typically lack loss history, so scenario and horizon-scanning methods replace frequency data.

Risk taxonomy hierarchies allow aggregation; inconsistent naming across units blocks enterprise-level roll-up and comparison.

Correlation and concentration must be captured at assessment stage, since individually acceptable exposures can combine into unacceptable aggregate risk.

Expected loss = PD × LGD × EAD; unexpected loss is covered by economic capital rather than by pricing or provisions.

Value at Risk is a quantile of the loss distribution at a stated confidence and horizon; it says nothing about the size of losses beyond that quantile.

Expected shortfall (CVaR) is the average loss conditional on exceeding the VaR threshold and is sub-additive, unlike VaR.

VaR is not sub-additive in general, so portfolio VaR can exceed the sum of component VaRs; diversification benefit can be negative under VaR.

Stress testing complements probabilistic models by applying severe but plausible scenarios outside historical calibration windows.

Backtesting compares predicted VaR with realized losses; exceptions above the expected count signal model understatement.

Monte Carlo simulation draws from assumed distributions; output quality is bounded by the validity of those assumptions, not by iteration count.

Sensitivity measures (DV01, beta, duration) give first-order change; convexity and gamma capture second-order curvature for larger moves.

Control types: preventive (stops the event), detective (identifies after occurrence), corrective (limits or repairs impact), and directive (guides behavior).

Control effectiveness is assessed on design adequacy and operating effectiveness separately; a well-designed control that is not performed fails.

Four risk responses: avoid, reduce (mitigate), transfer (share), and accept; acceptance requires documented authority at the correct level.

Insurance transfers frequency-and-severity risk subject to deductibles, limits, exclusions, and counterparty credit risk of the insurer.

Key control indicators are metrics on control performance (e.g., reconciliation breaks, overdue access reviews), distinct from key risk indicators on exposure.

Compensating controls substitute for an unavailable primary control but usually carry higher residual risk and require explicit justification.

Hedging reduces market risk but introduces basis risk, counterparty risk, and liquidity demands from margin or collateral calls.

Control testing samples must be sufficient and random or risk-targeted; self-attestation alone is weak evidence of operating effectiveness.

Key risk indicators require thresholds set as green/amber/red bands, defined owners, and escalation triggers tied to breach duration.

Leading indicators predict future exposure; lagging indicators confirm realized outcomes such as losses and incidents.

Limit monitoring distinguishes soft limits (escalation and remediation plan) from hard limits (breach requires immediate action or position reduction).

Reporting layers: operational dashboards for detail, management summaries for decisions, board reports for appetite and aggregate exposure.

Aggregation must reconcile across business units; inconsistent definitions or currencies distort enterprise totals and trend comparisons.

Loss-event data collection thresholds should be low enough to capture near misses and high-frequency small losses that drive control failures.

Trend analysis compares current exposure with prior periods and with risk appetite; a stable metric can still hide shifting composition.

Report timeliness matters: stale data on fast-moving exposures reduces the value of the report regardless of its accuracy.

Compliance risk is the risk of legal or regulatory sanctions, financial loss, or reputational damage from failure to comply with laws and regulations.

Three pillars of Basel II: minimum capital requirements, supervisory review (ICAAP/SREP), and market discipline through disclosure.

Basel III added leverage ratio, liquidity coverage ratio, and net stable funding ratio to the risk-based capital framework.

Know-your-customer and anti-money-laundering duties require customer due diligence, beneficial ownership identification, and suspicious activity reporting.

Conflicts of interest are managed by disclosure, information barriers, or recusal; disclosure alone does not eliminate the conflict.

Whistleblowing channels must permit confidential or anonymous reporting and be protected against retaliation.

Market conduct rules prohibit insider dealing and market manipulation; personal account dealing typically requires pre-clearance.

Record retention and data privacy obligations apply to risk data used in models and reporting, not only to client-facing records.