Enterprise Risk Management
Enterprise Risk Management tests whether you can run risk as a firm-wide system: governance and the three lines of defense, a risk appetite that is actually operational, aggregation of risk across units, capital allocation and risk-adjusted performance. The exam favors questions that force you to choose between economic, regulatory and rating-agency capital.
Framework and governance
- COSO ERM (2017) has five components: governance and culture; strategy and objective-setting; performance; review and revision; information, communication and reporting. ISO 31000 supplies a parallel process view.
- First line: business units own and manage risk. Second line: risk, actuarial and compliance set limits and aggregate. Third line: internal audit gives independent assurance.
- Risk capacity is the maximum risk the firm can carry given capital, liquidity and rating constraints; risk appetite is what the board chooses within that capacity; tolerance is the quantified limit at business-line level.
Aggregation and capital allocation
- Enterprise risk is not the sum of standalone risks. Adding VaRs assumes perfect correlation and overstates; aggregation depends on the dependence structure, and tail dependence matters more than average correlation for catastrophe and credit risk.
- Allocate economic capital by a marginal method (co-VaR or Euler allocation) so that allocated amounts add to the diversified total.
- RAROC = (revenues − expenses − expected losses + investment income on capital)/economic capital, compared with a hurdle rate. EVA = (RAROC − hurdle) × capital.
Early warning and stress testing
- KRIs, scenario analysis and reverse stress tests supplement models where historical data are thin: cyber, pandemic, casualty trend.
Worked example
A line writes 100 of premium, incurs 25 of expenses and 60 of expected loss, holds 50 of allocated economic capital and earns 5% on that capital. RAROC = (100 − 25 − 60 + 2.5)/50 = 17.5/50 = 35% against a 12% hurdle, so EVA = (0.35 − 0.12) × 50 = 11.5. If allocated capital rises to 80, RAROC falls to 21.9% and EVA to 7.9 - the line still adds value, but capital allocation, not underwriting, drove the change.
Traps
Summing standalone VaRs and calling it enterprise risk; putting regulatory capital in the RAROC denominator; taking a diversification credit in the numerator and again in the denominator; treating risk appetite as a single number; comparing RAROC across units with inconsistent capital allocation; forgetting that expected loss sits in the numerator while unexpected loss is what capital covers.