CRM56 cheat sheet
CRM56 · Keep the key ideas within reach.
Risk Management Fundamentals and Governance
Risk = effect of uncertainty on objectives; it bundles upside and downside, and is expressed as likelihood times impact.
Three-lines-of-defense model: business owns risk, risk/compliance functions oversee, internal audit provides independent assurance.
Board risk appetite statement sets aggregate risk tolerance; limits cascade from it to business units and desks.
COSO ERM components: governance and culture, strategy and objective-setting, performance, review and revision, information-communication-reporting.
Risk governance requires defined escalation paths, delegated authorities, and documented committee mandates.
Inherent risk is gross of controls; residual risk is after controls; target risk is the level management accepts.
A risk owner is a named accountable individual, not a committee; committees govern, individuals own.
Segregation of duties separates execution, approval, custody, and reconciliation to reduce fraud and error.
Risk Identification and Risk Assessment
Identification techniques: process mapping, workshops, scenario analysis, loss-data review, checklists, and expert interviews.
Risk register records description, cause, event, consequence, owner, controls, ratings, and treatment status.
Likelihood-impact matrix maps scores to heat-map zones; design the scale so thresholds are explicit and auditable.
Qualitative assessment uses ordinal scales; quantitative assessment uses calibrated ranges or probability distributions.
Bow-tie analysis separates causes (threats) from consequences, with preventive and mitigating controls on each side.
SWOT, PESTLE, and fault-tree analysis support structured identification of internal and external risk drivers.
Correlation matters: aggregating individually acceptable risks can produce an unacceptable portfolio exposure.
Risk taxonomy provides a common language and prevents double counting or gaps across business units.
Risk Measurement and Quantification
Expected loss EL = PD × LGD × EAD; unexpected loss drives economic capital allocation.
Value at Risk (VaR) is a quantile of the loss distribution at a confidence level over a holding period; it says nothing about losses beyond the threshold.
Expected shortfall (CVaR) is the average loss conditional on exceeding VaR; it is coherent and sub-additive.
Parametric VaR ≈ z × σ × √t for a single position; portfolio VaR requires the covariance matrix.
Monte Carlo simulation handles non-linear instruments and fat tails at the cost of model and computational risk.
Stress testing and scenario analysis complement VaR by probing tail events and reverse stress tests identify failure points.
Probability of default models use scorecards, Merton distance-to-default, or transition matrices; validation is mandatory.
Backtesting compares predicted VaR with realized exceptions; too many breaches signals model or calibration failure.
Risk Treatment, Mitigation, and Control
Treatment options: avoid, reduce (mitigate), transfer (insurance, hedging), and accept; each decision is documented with rationale.
Preventive controls stop an event; detective controls find it after the fact; corrective controls limit damage and restore operations.
Control design is assessed separately from operating effectiveness; both must be evidenced.
Residual risk = inherent risk adjusted for control effectiveness; if residual exceeds tolerance, further treatment is required.
Four-eyes review, reconciliation, and access controls are common compensating controls when primary controls fail.
Hedging transfers market risk but introduces counterparty, basis, and liquidity risk that must be measured.
Insurance transfers frequency or severity within policy limits; deductibles, exclusions, and coverage gaps must be mapped.
Control testing samples should be risk-based; failures trigger remediation plans with owners and deadlines.
Enterprise Risk Management Frameworks
ERM integrates risk into strategy and performance rather than treating risk as a standalone compliance exercise.
ISO 31000 cycle: scope and context, risk identification, analysis, evaluation, treatment, communication, monitoring and review.
Three-lines model, risk appetite, and risk aggregation are core ERM building blocks across frameworks.
Risk aggregation requires a common taxonomy, consistent metrics, and reconciliation across silos.
Embedding ERM means linking risk appetite to capital allocation, performance targets, and incentive design.
Maturity models assess ERM across governance, identification, measurement, reporting, and culture dimensions.
Scenario and stress testing are integrated into ERM to test strategy under adverse conditions.
ERM reporting should flow to the board with clear linkage between risk exposure, appetite, and strategic objectives.
Credit and Counterparty Risk
Credit risk is the risk of loss from a counterparty failing to meet contractual obligations.
Credit risk components: PD, LGD, EAD, maturity; EL = PD × LGD × EAD.
Counterparty credit risk arises on derivatives and securities financing; exposure is uncertain and path-dependent.
Credit exposure metrics: current exposure, potential future exposure (PFE), and credit valuation adjustment (CVA).
Credit scoring and rating models combine financial, behavioural, and qualitative factors; validation and monitoring are required.
Concentration risk arises from large single-name, sector, or geographic exposures; limits cap it.
Collateral mitigates credit risk but introduces legal, operational, and market risk (wrong-way risk).
Wrong-way risk: exposure increases as counterparty credit quality deteriorates.
Market, Liquidity, and Interest Rate Risk
Market risk drivers: interest rates, FX, equity prices, commodities, and volatility; measured via sensitivities (Greeks) and VaR.
Interest rate risk includes repricing, yield-curve, basis, and option risk; gap analysis and duration measure sensitivity.
Duration approximates percentage price change for a small yield change; convexity corrects for larger moves.
Liquidity risk has two forms: funding liquidity (ability to meet obligations) and market liquidity (ability to trade without price impact).
Liquidity metrics: liquidity coverage ratio (LCR), net stable funding ratio (NSFR), and survival horizon under stress.
Basis risk arises when hedged and hedging instruments do not move perfectly together.
Stress testing market and liquidity risk uses historical and hypothetical scenarios plus reverse stress tests.
Model risk arises from incorrect assumptions, calibration error, or misuse; independent validation is required.
Operational, Compliance, and Legal Risk
Operational risk is loss from failed internal processes, people, systems, or external events.
Operational risk categories: internal fraud, external fraud, employment practices, clients/products, physical assets, business disruption, execution/delivery.
Loss-event data, risk and control self-assessments (RCSA), and key risk indicators (KRIs) are core operational risk tools.
Compliance risk is loss from failing to comply with laws, regulations, or internal policies.
Legal risk includes contract enforceability, litigation, and regulatory sanction.
Business continuity planning and disaster recovery address disruption risk; recovery time and point objectives define tolerance.
Key risk indicators should be leading, measurable, and tied to thresholds with defined escalation.
Outsourcing and third-party risk require due diligence, contractual controls, and ongoing monitoring.
Risk Reporting, Monitoring, and Communication
Risk reports should be timely, accurate, complete, and tailored to the audience's decision needs.
Dashboards use heat maps, trend lines, limit-utilisation charts, and exception reports to communicate exposure.
Limit monitoring compares actual exposure to approved limits; breaches require escalation and documented remediation.
Key risk indicators (KRIs) provide early warning; thresholds are green/amber/red with defined triggers.
Board reporting should link risk exposures to appetite, capital, and strategy, not just list losses.
Data quality controls (completeness, accuracy, timeliness) underpin reliable risk reporting.
Escalation protocols define who is informed, when, and via which channel for material risk events.
Forward-looking reporting uses scenarios and stress results rather than relying solely on historical data.
Risk Culture, Ethics, and Professional Standards
Risk culture is the shared values, beliefs, and behaviours that determine how risk is identified and managed.
Tone at the top sets expectations; tone at the middle translates them into business-unit behaviour.
Incentive design aligned with risk appetite reduces excessive risk-taking; misaligned incentives increase it.
Speak-up and whistleblowing channels support early detection of misconduct; retaliation undermines them.
Professional standards include integrity, objectivity, competence, confidentiality, and professional behaviour.
Conflicts of interest must be identified, disclosed, and managed; independence is essential for assurance functions.
Ethical decision frameworks weigh stakeholders, duties, consequences, and long-term reputation.
Culture is assessed through surveys, behavioural indicators, incident patterns, and audit findings.