CERP cheat sheet

Three lines of defense: the first line owns and manages risk, the second line (risk and compliance) sets frameworks and challenges, and the third line (internal audit) provides independent assurance to the board.

COSO ERM 2017 has five components supported by 20 principles: governance and culture; strategy and objective-setting; performance; review and revision; information, communication and reporting.

ISO 31000 process: scope and context, then risk identification, analysis, evaluation and treatment, with communication and consultation plus monitoring and review running throughout.

Hierarchy of risk documents: risk appetite statement, then risk policies, then standards and procedures, then limits and thresholds.

The CRO should be independent of P&L-owning business lines and have direct access to the board or its risk committee.

A board risk committee typically approves the ERM framework and risk appetite, oversees the CRO, and reviews aggregate risk reporting.

Limits cascade from board appetite to business-unit and desk level; each limit has a named owner, a metric, a threshold and an escalation path.

Governance failure is evidenced by unclear risk ownership, absent escalation, or limits that cannot be traced back to the approved risk appetite.

Risk appetite is the amount and type of risk the firm accepts to pursue objectives; risk tolerance is the acceptable deviation from that level; risk capacity is the maximum risk bearable given capital, liquidity and regulatory constraints.

Appetite statements should be forward-looking, linked to strategy, and expressed through both quantitative metrics and qualitative statements.

Common quantitative metrics: CET1 ratio floors, credit loss tolerance as a percentage of revenue or capital, minimum liquidity ratios, VaR or sensitivity limits, and operational loss thresholds.

Zero appetite is appropriate for regulatory non-compliance, fraud and deliberate misconduct, but still requires detection and monitoring controls.

The risk appetite framework requires board approval, periodic review, and a defined escalation path when limits are breached.

Limit reporting should show utilization together with headroom and trend, not only current status.

Appetite must be consistent with the capital plan; a strategy that cannot be funded within appetite requires the board to approve a changed appetite.

Appetite thresholds should be tested against stress scenarios to confirm the firm stays within tolerance under adverse conditions.

Risk culture is evidenced by behavior rather than documents: escalation speed, near-miss reporting rates, quality of challenge in committees, and handling of limit breaches.

Incentive structures must align with risk appetite; compensation that rewards volume without risk adjustment undermines risk culture.

FSB Principles for Sound Compensation include deferral of variable pay, malus and clawback, and risk-adjusted performance measures.

Strategy setting should include assessment of risks embedded in strategic options and comparison of risk-adjusted returns across alternatives.

The board and senior management own culture; the second line monitors culture indicators and internal audit provides independent assessment.

Culture indicators include staff surveys, whistleblowing volumes and outcomes, policy breach rates, and attrition in control functions.

A tone at the top that tolerates exceptions predicts control failures in the first line.

A typical risk taxonomy covers credit, market, liquidity and ALM, operational, compliance and legal, strategic, reputational and emerging risk.

Residual risk is inherent risk adjusted for control effectiveness; residual risk, not inherent risk, is compared against appetite.

Risk rating combines likelihood and impact; heat maps plot these two dimensions and define thresholds for escalation.

The risk register records description, risk owner, cause, consequence, existing controls, ratings, treatment plan and review date.

Aggregation must avoid double counting, because the same exposure (for example a single counterparty) can appear in credit, market and liquidity views.

Simple summation overstates enterprise risk because it ignores diversification; correlation assumptions drive the aggregate and must be documented.

Main identification inputs are RCSA results, scenario analysis, internal and external loss data, KRI trends and audit findings.

Each KRI needs a threshold and an owner; leading indicators give earlier warning than lagging loss data.

Expected loss = PD x LGD x EAD; expected loss is priced into the loan and covered by provisions, while unexpected loss is covered by capital.

The five Cs of credit: character, capacity, capital, collateral and conditions.

Credit risk mitigation through collateral, guarantees, netting and credit derivatives reduces loss but introduces legal risk, operational risk and wrong-way risk.

Concentration limits apply to single names, connected counterparty groups, sectors and geographies.

Under IFRS 9 and CECL: stage 1 carries 12-month expected credit loss, stage 2 lifetime ECL after a significant increase in credit risk, stage 3 credit-impaired assets.

Under the Basel IRB approach, risk-weighted assets = 12.5 x capital requirement K x EAD, where K depends on PD, LGD and maturity.

Early warning indicators such as delinquency, covenant breach, rating downgrade and adverse news trigger watchlist migration.

Credit approval authority should be independent of relationship management to avoid conflicts of interest.

VaR is a quantile of the loss distribution; it is not subadditive in general and gives no information about the size of losses beyond the confidence level.

Expected shortfall (CVaR) is the average loss in the tail beyond VaR; it is a coherent risk measure and is the basis of the Basel FRTB internal models measure.

Duration approximation: change in price is approximately -D x P x change in yield; adding convexity gives -D x P x dy + 0.5 x C x P x (dy)^2.

DV01 is the change in value for a one basis point move in yields and is used to set and monitor interest rate sensitivity limits.

LCR = high-quality liquid assets / net cash outflows over 30 days, minimum 100%; NSFR = available stable funding / required stable funding, minimum 100%.

IRRBB is measured through change in economic value of equity and change in net interest income under prescribed rate shocks.

Basel VaR backtesting traffic light at 99% over 250 days: green at 4 or fewer exceptions, yellow at 5 to 9, red at 10 or more.

Market risk limits include notional caps, sensitivity limits (delta, vega, DV01), VaR limits and stop-loss triggers.

Operational risk is the risk of loss from inadequate or failed internal processes, people and systems, or from external events; it excludes strategic and reputational risk.

Basel event types: internal fraud, external fraud, employment practices and workplace safety, clients products and business practices, damage to physical assets, business disruption and system failures, execution delivery and process management.

RCSA output links each risk to its controls, rates residual risk, and produces issues with owners and due dates.

Under the Basel standardized measurement approach, capital = business indicator component x internal loss multiplier, where the business indicator component is 15% of the business indicator.

Third-party and cloud risk requires due diligence, contractual controls, exit plans and assessment of provider concentration.

Business continuity metrics: recovery time objective, recovery point objective, and maximum tolerable period of disruption.

NIST Cybersecurity Framework functions: identify, protect, detect, respond and recover.

Operational resilience is managed around important business services and impact tolerances rather than around individual systems.

Compliance risk is the risk of legal or regulatory sanctions, financial loss or reputational damage from failure to comply with laws, regulations and standards.

The compliance function sits in the second line, is independent of the business, and reports to the board or a board committee.

Programme elements: policies and procedures, training, monitoring and testing, issue management, regulatory change management and board reporting.

AML programme components: customer due diligence, beneficial ownership identification, transaction monitoring, sanctions screening and suspicious activity reporting.

Conduct risk covers harm to customers and market integrity, including mis-selling, unsuitable advice, market manipulation and unfair treatment.

UDAAP prohibits unfair, deceptive or abusive acts or practices in consumer financial products and services.

Legal risk includes contract enforceability, litigation exposure and regulatory enforcement actions.

Regulatory change management requires a tracked inventory of requirements, impact assessment, implementation and post-implementation testing.

Strategic risk arises from adverse business decisions, poor execution, competitive shifts, acquisitions, or failure to adapt to regulation and technology.

Reputational risk is usually a second-order consequence of another risk event; it is managed through conduct standards, communication and stakeholder analysis.

Reputational risk resists precise quantification; common approaches are scenario analysis, sentiment monitoring and limits on higher-risk activities.

Emerging risks are characterized by novelty and high uncertainty; horizon scanning and scenario workshops are the primary identification tools.

Climate risk splits into physical risk (acute and chronic) and transition risk (policy, technology, market and reputation).

Every emerging risk item should have a named owner and be reported to the board even when quantification is weak.

Concentrating strategy in a single product, geography or counterparty concentrates strategic and reputational exposure.

Regulatory capital stack: CET1, additional Tier 1 and Tier 2; buffers include the capital conservation buffer of 2.5%, the countercyclical buffer of 0 to 2.5%, and G-SIB or D-SIB surcharges.

Stress testing projects losses, revenue and capital ratios under baseline, adverse and severely adverse scenarios over a multi-year horizon.

ICAAP requires risk identification, quantification, capital aggregation, capital planning and board sign-off, and feeds the supervisory review process.

A capital plan must show sources and uses of capital and demonstrate post-stress capital adequacy before dividends and share buybacks.

Reverse stress testing starts from a defined business failure outcome and works backwards to the scenarios that would cause it.

RAROC = (revenue - costs - expected loss) / economic capital, and is used to price transactions and allocate capital.

Economic capital reflects the firm's own risk estimates while regulatory capital follows prescribed rules; the two can diverge materially.

Model risk management covers development, independent validation, ongoing monitoring and governance, applying three-lines discipline to models.

A board risk report typically covers top and emerging risks, appetite and limit utilization, breaches, KRIs, losses, capital position and remediation status.

Board responsibilities are to approve risk appetite and the risk framework, oversee and challenge management, and ensure reporting is timely and complete.

Escalation is pre-defined: threshold breach, then risk owner and CRO, then board risk committee, with documented remediation and timelines.

BCBS 239 sets 14 principles for risk data aggregation and reporting covering governance, data architecture, accuracy, completeness, timeliness and supervisory review.

Reporting should be aggregated across risk types and disaggregated by legal entity and business line where the board needs it.

Monitoring distinguishes leading indicators (KRIs) from lagging indicators (losses, audit findings); both belong in the reporting pack.

Minutes, committee terms of reference and documented challenge are the evidence that board oversight actually occurred.