CRM56 flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Three lines of defense

A governance model where business units own and manage risk, risk and compliance functions oversee and advise, and internal audit provides independent assurance to the board.

Risk appetite

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed in qualitative and quantitative terms and cascaded into limits.

Residual risk

The level of risk remaining after existing controls and mitigation measures have been applied, compared against the organization's risk tolerance to decide on further treatment.

Risk owner

A named individual accountable for managing a specific risk, including its assessment, controls, treatment decisions, and reporting, distinct from a governing committee.

Risk register

A structured record of identified risks capturing description, cause, consequence, owner, existing controls, likelihood and impact ratings, and treatment status.

Bow-tie analysis

A diagram linking multiple causes and threats on one side to consequences on the other, with preventive controls on causes and mitigating controls on consequences.

Risk taxonomy

A hierarchical classification of risk types providing a common language across the organization, reducing gaps and double counting in identification and aggregation.

Likelihood-impact matrix

A tool plotting assessed likelihood against impact to assign risk ratings and heat-map zones, requiring explicit, auditable scale definitions and thresholds.

Expected loss formula

EL = PD × LGD × EAD, where PD is probability of default, LGD is loss given default, and EAD is exposure at default; it estimates average credit loss.

Value at Risk

A quantile of the loss distribution at a chosen confidence level and holding period; it does not describe the size of losses beyond that threshold.

Expected shortfall

The average loss conditional on losses exceeding the Value at Risk threshold; it is a coherent, sub-additive risk measure capturing tail severity.

Backtesting

Comparing predicted risk measures such as VaR with realized outcomes; an excessive number of exceptions signals model miscalibration or underestimation of risk.

Stress testing

Applying severe but plausible scenarios, historical or hypothetical, to assess portfolio resilience beyond normal statistical measures and to inform capital and limits.

Risk treatment options

The four responses to identified risk: avoid the activity, reduce it through controls, transfer it via insurance or hedging, or accept it with documented rationale.

Preventive versus detective control

Preventive controls stop an event from occurring, while detective controls identify events after they happen; both are assessed for design and operating effectiveness.

Compensating control

An alternative control that reduces risk when a primary control is unavailable or ineffective, used temporarily or permanently with documented justification and monitoring.

ISO 31000 process

A risk management cycle covering scope and context, identification, analysis, evaluation, treatment, plus ongoing communication and consultation, monitoring and review.

Risk aggregation

Combining exposures across business units and risk types using a common taxonomy and consistent metrics, accounting for correlation, to produce an enterprise view.

ERM maturity model

A framework assessing enterprise risk management across dimensions such as governance, identification, measurement, reporting, and culture to guide improvement priorities.

Counterparty credit risk

The risk that a derivative or securities-financing counterparty defaults before final settlement, where exposure is uncertain and evolves with market movements.

Potential future exposure

A forward-looking measure of the maximum credit exposure to a counterparty over a future period at a given confidence level, used to set credit limits.

Credit valuation adjustment

The market value adjustment to derivative portfolios reflecting the counterparty's credit quality, representing the cost of counterparty default risk.

Wrong-way risk

A condition where exposure to a counterparty increases as the counterparty's credit quality deteriorates, producing larger losses than standard models assume.

Duration

A measure of a bond's price sensitivity to interest rate changes, approximating the percentage price change for a small parallel shift in yields.

Liquidity coverage ratio

A regulatory metric requiring high-quality liquid assets sufficient to cover net cash outflows over a thirty-day stress period, addressing short-term funding liquidity risk.

Basis risk

The risk that hedged and hedging instruments do not move in perfect offset, leaving residual exposure due to differences in pricing, timing, or market reference.

Operational risk definition

The risk of loss from inadequate or failed internal processes, people, systems, or external events, including legal risk but excluding strategic and reputational risk.

Risk and control self-assessment

A structured process where business units identify risks, assess control effectiveness, and rate residual exposure, feeding the operational risk register and action plans.

Key risk indicator

A leading metric tracking exposure to a specific risk against defined thresholds, providing early warning and triggering escalation when limits are approached.

Limit breach escalation

A documented process requiring notification to defined authorities when exposure exceeds approved limits, with remediation plans, timelines, and reporting to senior management.

Risk dashboard

A visual reporting tool presenting heat maps, trends, limit utilisation, and exceptions to give decision-makers a concise view of risk exposure against appetite.

Tone at the top

The signals sent by senior leadership through words and actions about the importance of risk management and ethical behaviour, shaping organizational risk culture.