CERP flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Three lines of defense

The first line comprises business units that own and manage risk; the second provides independent risk and compliance oversight; the third, internal audit, gives independent assurance to the board.

COSO ERM 2017 components

Five components: governance and culture; strategy and objective-setting; performance; review and revision; information, communication and reporting, supported by twenty underlying principles.

CRO independence

The chief risk officer typically reports to the CEO with direct access to the board risk committee, and should be independent of revenue-generating business lines.

Risk appetite

The amount and type of risk an organization is willing to accept in pursuit of its strategic objectives, expressed through qualitative statements and quantitative limits.

Capacity versus tolerance

Risk capacity is the maximum risk an organization can bear before breaching capital, liquidity or regulatory constraints; risk tolerance is the acceptable variation around a chosen appetite level.

Risk appetite cascade

Board-approved appetite translates into business-line limits and key risk indicators, which are monitored, reported and escalated when thresholds are breached.

Risk culture

The shared norms, attitudes and behaviors that determine how employees identify, discuss, escalate and act on risk within the organization.

Tone at the top

The signals senior leaders send through decisions, communications and incentives about the importance of risk management and ethical conduct.

Clawback provision

A compensation arrangement allowing the firm to recover previously paid incentive awards after misconduct, financial restatement or significant risk management failures.

Inherent versus residual risk

Inherent risk is the exposure before controls; residual risk is what remains after controls and is the level compared against risk appetite.

Risk register

A structured inventory recording each risk's description, owner, causes, consequences, existing controls, ratings and treatment actions, reviewed and updated periodically.

Risk aggregation

Combining individual risk exposures into an enterprise-wide view, accounting for correlations and diversification while avoiding double counting of the same exposure.

Expected loss formula

Expected loss equals probability of default multiplied by loss given default multiplied by exposure at default; it represents the long-run average credit loss.

Five Cs of credit

Character, capacity, capital, collateral and conditions: a qualitative framework used to assess a borrower's overall creditworthiness.

IFRS 9 three stages

Stage 1 requires twelve-month expected credit losses; stage 2 requires lifetime losses after significant credit deterioration; stage 3 covers assets already credit-impaired.

Value at risk

The maximum loss over a defined horizon at a given confidence level; it quantifies nothing about the severity of losses beyond that threshold.

Expected shortfall

The average loss conditional on losses exceeding the value-at-risk threshold; a coherent risk measure that captures the severity of tail losses.

Liquidity coverage ratio

High-quality liquid assets divided by net cash outflows over a 30-day stress period; the Basel standard requires a minimum of 100 percent.

Operational risk definition

The risk of loss from inadequate or failed internal processes, people and systems, or from external events; it excludes strategic and reputational risk.

Risk and control self-assessment

A process in which business units identify their risks, evaluate control design and effectiveness, and rate residual risk to drive action plans.

Recovery time objective

The maximum acceptable time to restore a business process after a disruption; paired with recovery point objective, which measures tolerable data loss in time.

Compliance risk

The risk of legal or regulatory sanctions, financial loss or reputational damage arising from a failure to comply with laws, rules and standards.

Conduct risk

The risk that the firm's behavior or employee actions harm customers, counterparties or market integrity, even where no rule is technically breached.

Suspicious activity report

A filing made to the financial intelligence unit when transactions suggest money laundering, fraud or other criminal activity by a customer.

Strategic risk

Risk arising from adverse business decisions, poor implementation, or failure to adapt to changes in the competitive, regulatory or economic environment.

Reputational risk

The risk that stakeholder perceptions turn negative and damage revenue, funding or franchise value; usually a consequence of other events rather than a standalone cause.

Emerging risk

A newly developing or changing exposure with high uncertainty and potentially significant impact, identified through horizon scanning and scenario analysis.

ICAAP

The internal capital adequacy assessment process: a firm's own evaluation of the risks it faces, the capital they require, and its plan to maintain adequacy.

Reverse stress test

A test that starts from a defined business failure outcome and works backwards to identify the scenarios and loss levels that would cause it.

RAROC

Risk-adjusted return on capital: risk-adjusted profit divided by the economic capital allocated to an activity, used to compare returns per unit of risk.

BCBS 239 principles

Fourteen Basel principles on risk data aggregation and reporting, covering governance, data architecture, accuracy, completeness, timeliness and supervisory review.

Board risk report content

Typically covers top and emerging risks, limit utilization and breaches, key risk indicators, losses, capital position and remediation status with forward-looking commentary.