AIRAF flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Three lines model

Governance structure separating risk ownership in the business, independent risk and compliance oversight functions, and internal audit assurance, each reporting through distinct channels.

Risk appetite statement

Board-approved articulation of the aggregate amount and types of risk the organization is willing to accept in pursuit of its strategic objectives.

Risk tolerance

The acceptable variation or deviation around a specific risk limit or appetite metric before escalation or corrective action is triggered.

Risk governance framework

The documented set of policies, roles, methodologies, and reporting lines that determine how risk is identified, measured, managed, and overseen.

Board risk committee

Board subcommittee that approves risk appetite, oversees framework adequacy, reviews top and emerging risks, and confirms escalation effectiveness.

Segregation of duties

Control principle requiring that risk-taking, risk-oversight, and assurance activities are performed by separate parties to prevent unchecked authority.

Risk register

Structured inventory of identified risks recording description, cause, consequence, owner, inherent and residual ratings, controls, and review dates.

Inherent versus residual risk

Inherent risk is assessed assuming no controls; residual risk is the remaining exposure after evaluating control design and operating effectiveness.

Bow-tie analysis

Diagram placing the risk event at the center, with threats and preventive controls on one side and consequences and mitigative controls on the other.

Risk heat map

Two-dimensional visual plotting likelihood against impact, with appetite boundaries marked, to prioritize risks and compare exposures across units.

Emerging risk

A newly developing or changing exposure lacking sufficient historical loss data, typically assessed through scenario analysis and horizon scanning.

Risk taxonomy

Hierarchical classification of risk types and sub-types that enables consistent identification, ownership, aggregation, and comparison across the organization.

Expected loss formula

Expected loss equals probability of default multiplied by loss given default multiplied by exposure at default, representing the long-run average credit loss.

Value at Risk

The loss threshold not expected to be exceeded at a stated confidence level over a stated horizon; silent on severity beyond that threshold.

Expected shortfall

The average loss conditional on losses exceeding the VaR threshold; unlike VaR it is sub-additive and captures tail severity.

Sub-additivity

Property requiring the risk of a combined portfolio to be no greater than the sum of component risks; satisfied by expected shortfall but not generally by VaR.

Stress testing

Application of severe but plausible scenarios, including historical and hypothetical ones, to assess losses beyond the calibration window of statistical models.

Backtesting

Comparison of predicted risk measures with realized outcomes; excess exceptions beyond the expected count indicate the model understates risk.

Monte Carlo simulation

Technique generating many random draws from assumed distributions to build a loss distribution; accuracy depends on the assumptions, not iteration count.

Preventive versus detective control

Preventive controls stop an event before occurrence, such as access restrictions; detective controls identify events after occurrence, such as reconciliations.

Control effectiveness assessment

Two-part evaluation of whether a control is designed adequately and whether it actually operated as intended during the review period.

Risk response options

The four treatments available for an identified risk: avoid the activity, reduce exposure through controls, transfer or share it, or accept it with authority.

Key control indicator

Metric tracking control performance, such as reconciliation breaks or overdue access reviews, as distinct from indicators of underlying risk exposure.

Compensating control

Alternative control applied when the primary control is unavailable or impractical, generally leaving higher residual risk that requires documented justification.

Basis risk

Risk that a hedging instrument's value does not move in perfect offset with the hedged exposure, leaving residual unhedged exposure.

Key risk indicator

Metric with defined green, amber, and red thresholds that signals changes in exposure level and triggers escalation when breached.

Leading versus lagging indicator

Leading indicators anticipate future exposure, such as rising exception rates; lagging indicators confirm realized outcomes, such as booked losses.

Hard versus soft limit

A hard limit requires immediate corrective action when breached; a soft limit permits escalation with a documented remediation plan.

Risk reporting layers

Tiered reporting from detailed operational dashboards to management summaries to board-level reporting on aggregate exposure versus appetite.

Compliance risk

The risk of legal or regulatory sanctions, financial loss, or reputational damage arising from failure to comply with applicable laws and rules.

Basel II three pillars

Minimum capital requirements, supervisory review of capital adequacy, and market discipline through public disclosure.

Basel III liquidity ratios

Liquidity coverage ratio requires high-quality liquid assets to cover thirty-day stressed outflows; net stable funding ratio addresses one-year structural funding.

Customer due diligence

Anti-money-laundering obligation to identify customers, verify identity, identify beneficial owners, and monitor activity for suspicious transactions.