CERP common mistakes
CERP · Understand the traps and how to avoid them.
When asked who owns an enterprise risk, names the risk function or the CRO, and describes the three lines of defence as sequential review steps rather than distinct accountability roles.
Candidates memorise the labels 'first, second, third line' without mapping them onto who actually owns, challenges, and assures a risk, so any ownership question gets deflected to the risk department.
What to do instead
Before answering, assign each role explicitly: the business owns and manages the risk, the risk function sets the framework and challenges, internal audit gives independent assurance, and the board approves appetite and oversees. Practise rewriting a governance description so every risk has a named accountable executive, not a function.
Writes risk appetite as adjectives such as 'low', 'conservative' or 'prudent', with no measure, threshold, escalation trigger or owner, or sets one firm-wide appetite statement with no cascade to business-level limits.
Appetite gets confused with a policy statement or a tone-at-the-top sentence; qualitative language feels safe, so the candidate never commits to a number the examiner can test.
What to do instead
Build each statement as measure + limit + early-warning trigger + escalation owner (for example, credit losses as a percentage of revenue, with a trigger and a board escalation path). Then show the cascade from board statement to portfolio limit to individual transaction limit, and explain how the statement constrains strategy.
Produces an enterprise total by adding individual risk exposures together, or ranks risks by averaging their likelihood and impact scores, rather than aggregating through shared drivers, concentrations and correlations.
Arithmetic feels rigorous, and rating scales invite simple averaging; the candidate has not practised cases where aggregation changes the answer.
What to do instead
Aggregate by common driver and concentration (same counterparty, same funding source, same vendor, same scenario) and state explicitly why simple addition overstates or understates the total. Always distinguish inherent from residual risk and check whether aggregation reorders the top risks.
Answers credit questions by naming PD, LGD and EAD without converting them into expected loss or capital, or accepts collateral and guarantees at face value without testing eligibility and wrong-way risk.
Definitions are memorised as vocabulary rather than as inputs to a calculation, and credit risk mitigation is treated as a documentation issue instead of a risk transfer with conditions.
What to do instead
Drill EL = PD x LGD x EAD and be able to separate expected loss from unexpected loss and economic capital. For any mitigation, ask whether it is legally effective, operationally realisable and correlated with the borrower (wrong-way risk) before reducing the exposure.
Applies a single duration figure to every rate scenario, treats a parallel shift as the only scenario, and mixes repricing-gap earnings measures with economic-value measures in the same answer.
Formulas are memorised without their assumptions, so duration is used as a universal sensitivity and the earnings-versus-value distinction collapses.
What to do instead
Keep the two lenses separate: short-horizon net interest income from repricing gaps, and economic value of equity from discounted cash flows. Practise non-parallel shifts, basis risk, embedded optionality and non-maturity deposit behaviour, and state the assumption behind every sensitivity number you quote.
Describes operational risk responses only as 'strengthen controls' or 'increase oversight', without framing the risk as cause-event-impact or scoring inherent risk, control effectiveness and residual risk separately.
Operational risk invites narrative answers, and candidates default to generic management language instead of the structured assessment the question is testing.
What to do instead
Write every operational risk answer as cause, event, impact, then score inherent risk, assess control design and operating effectiveness, and derive residual risk against a defined scale. Pair it with a KRI that has a threshold and a named escalation action.
Treats compliance risk as a legal question ('is it permitted?') and stops at the regulatory breach, ignoring customer harm, conduct outcomes, voided transactions and regulatory change.
Candidates equate compliance with legal sign-off and separate conduct from compliance, so the risk-management dimension of the question goes unanswered.
What to do instead
Define compliance risk broadly: sanctions, fines, invalid contracts, remediation costs, customer detriment and reputational damage. Answer with a risk-based compliance approach, a regulatory change inventory, and a conduct lens on how products are sold and customers are treated.
Dismisses reputational risk as unquantifiable and emerging risk as speculative, so gives no process answer such as horizon scanning, scenario analysis or early-warning indicators.
If a risk cannot be put in a formula, candidates assume there is nothing to say, missing that the exam is testing the management process rather than a point estimate.
What to do instead
Describe an explicit process: horizon scanning with defined sources and owners, scenario analysis, stakeholder mapping, and proxy quantification (revenue at risk, funding cost impact, customer attrition). Show how an emerging risk graduates into the formal risk register with an owner and indicators.
Runs a single severe scenario, jumps directly from scenario to capital impact, and skips the transmission channels and management actions; presents the stress result as if it were a forecast.
The mechanics of the calculation feel like the hard part, so the narrative logic and the capital-plan linkage get compressed out.
What to do instead
Answer in sequence: scenario narrative, transmission channels to revenue and balance sheet, projected financials, capital and liquidity ratios, then credible management actions and their constraints. Use more than one severity, and state that stress results are conditional projections, not forecasts.
Sends the board the same granular pack used by management, or reports only backward-looking metrics with no comparison to appetite, no limit status and no forward view.
Candidates reuse management information habits and think 'more data means better reporting', ignoring that the board's role is oversight and decision-making.
What to do instead
Split the two audiences explicitly: management gets granular, operational, frequent data; the board gets aggregated, forward-looking information with appetite and limit status, emerging risks and clear asks. For any metric, practise writing the one-sentence board-level 'so what' and the decision it supports.