AIRAF study plan

Map every component of the risk management framework and governance domain, writing a one-page structural outline of how governance, appetite, policy, and oversight connect

Define risk appetite, tolerance, and limit concepts in your own words and draft three original examples of each

Identify the roles and responsibilities of the board, senior management, and the three lines of defense, then explain in writing where accountability sits for each

Build a personal glossary of at least 25 governance terms with original definitions and one usage sentence each

Explain how governance structures feed into risk identification, describing the information flow from policy to assessment

Draft a governance scenario in which a firm's risk appetite statement conflicts with a business incentive, then reason through the correct escalation path

Compare at least four risk identification techniques and state when each is most appropriate

Construct a risk taxonomy that classifies at least 20 risks by category, driver, and potential impact

Apply qualitative and quantitative identification methods to a worked case, documenting assumptions and limitations

Distinguish inherent risk from residual risk and demonstrate the difference with three original worked examples

Assess how interdependencies and concentration can amplify individually modest risks

Write a short risk register entry for ten distinct risks including cause, event, and consequence statements

Translate identified risks into measurable quantities by selecting appropriate metrics for at least six risks

Compute and interpret basic risk measures such as expected loss, volatility, and a simple percentile-based estimate using a small original dataset

Explain the strengths and weaknesses of value-at-risk and expected shortfall in plain language

Critique three common measurement pitfalls, including model risk and data quality, and propose a control for each

Design a control set for five high-priority risks, specifying control type, frequency, owner, and evidence produced

Evaluate mitigation options such as avoidance, reduction, transfer, and acceptance, and justify a selection for each of the five risks

Distinguish preventive from detective controls and demonstrate both in an original process flow

Assess control cost against expected loss reduction for at least two mitigation decisions

Define key risk indicators for at least eight risks, specifying thresholds, escalation triggers, and reporting frequency

Draft a one-page risk report that communicates exposure, trend, and recommended actions to a senior audience

Explain how monitoring results should feed back into reassessment and control refinement

Design an escalation matrix that maps indicator breaches to accountable owners and response timelines

Summarize the core regulatory obligations relevant to risk governance and describe how they shape reporting requirements

Analyze an ethical dilemma in risk reporting, such as pressure to soften a disclosure, and argue a defensible course of action

Evaluate how reporting quality and data integrity affect regulatory compliance and stakeholder trust

Identify at least five conduct or ethics standards and describe a realistic breach scenario for each

Integrate all six domains into a single end-to-end risk management narrative for a hypothetical firm

Rehearse timed practice questions across every domain and record accuracy by domain

Revisit the two weakest domains and close each identified knowledge gap with targeted notes

Produce a condensed one-page recall sheet linking governance, assessment, measurement, controls, monitoring, and compliance