CIMA P3 Risk Management cheat sheet

COSO ERM (2017) organises risk work into five components: governance and culture; strategy and objective-setting; performance; review and revision; information, communication and reporting.

Risk appetite is the amount of risk an entity is willing to accept in pursuit of value; risk tolerance is the acceptable variation around a specific objective, so appetite is portfolio-level and tolerance is objective-level.

Inherent risk is measured before controls; residual risk is measured after controls; target residual risk is the level management chooses to retain, and the gap to inherent risk is the control effect.

Risk capacity is the maximum risk an entity can bear before breaching constraints such as capital, liquidity or regulatory limits; appetite must not exceed capacity.

A risk register records risk description, cause, consequence, owner, inherent and residual likelihood and impact, controls, and response; a risk map plots likelihood against impact to prioritise.

Expected loss = probability x impact; for a portfolio, expected loss is the sum of individual expected losses, while unexpected loss depends on correlation and drives capital requirements.

Risk correlation reduces diversification benefit: perfectly positively correlated risks aggregate linearly, so diversification only reduces total risk when correlations are below 1.

Three lines model: operational management owns and manages risk (first line), a risk and compliance function monitors and advises (second line), internal audit provides independent assurance (third line).

Key risk indicators should be measurable, predictive of loss events, and owned by a named manager; a KRI breaching its threshold triggers escalation under the risk policy.

PESTLE covers political, economic, social, technological, legal and environmental factors; it scans the macro-environment, not the firm's own resources.

Porter's five forces assesses industry attractiveness through supplier power, buyer power, threat of new entrants, threat of substitutes and competitive rivalry.

SWOT analysis pairs internal strengths and weaknesses with external opportunities and threats; it is descriptive, so pair it with TOWS to generate matching strategies.

Scenario analysis models several plausible futures rather than one forecast; each scenario must be internally consistent and assigned a probability or plausibility rating.

Sensitivity analysis varies one variable at a time to show which assumptions most affect the outcome; it ignores correlations between variables.

Simulation (Monte Carlo) varies many inputs simultaneously from probability distributions to produce a distribution of outcomes and confidence intervals.

Value at risk states the maximum loss over a defined horizon at a given confidence level; it says nothing about the size of losses beyond that threshold.

Strategic drift arises when incremental change lags environmental change; it is detected by comparing the realised strategy with the intended strategy over time.

Real options reasoning values managerial flexibility to defer, expand, contract or abandon; the option value is higher when uncertainty and the ability to respond are greater.

The four TARA responses are transfer, avoid, reduce and accept; a fifth, exploit, applies to positive risk (upside) in an opportunity-seeking posture.

Risk transfer shifts financial consequence, not accountability: insurance, hedging and outsourcing transfer loss but the entity retains reputational and contractual exposure.

Risk avoidance eliminates the activity and therefore the risk, but also forgoes the associated return; it is appropriate only when risk exceeds appetite and cannot be mitigated economically.

Risk reduction uses preventive controls (lower likelihood) or corrective and detective controls (lower impact); residual risk after response must be compared with tolerance.

Control cost is justified when marginal reduction in expected loss exceeds the marginal cost of the control; controls beyond that point destroy value.

Segregation of duties prevents one person from initiating, authorising, recording and reconciling a transaction; it is a preventive control against fraud and error.

A control self-assessment asks process owners to evaluate their own controls; it is cheaper than independent testing but carries self-reporting bias.

Hedging with derivatives reduces price risk but introduces basis risk, counterparty risk and liquidity risk from margin calls.

Business continuity planning sets a recovery time objective (RTO) and recovery point objective (RPO); the plan must be tested, and test results drive revision.

Board accountability for risk cannot be delegated: the board sets appetite, approves the risk framework, and monitors exposure through a risk committee.

Tone at the top describes the signals senior management send through decisions and incentives; culture is revealed by what is rewarded and what is tolerated, not by written values.

A risk-aware culture requires psychological safety so staff can escalate bad news without penalty; whistleblowing channels must be independent of line management.

Three common cultural risk archetypes are risk-blind (unaware), risk-averse (excessive caution) and risk-aggressive (excessive risk-taking); each needs a different intervention.

Cyber risk is an operational risk with confidentiality, integrity and availability dimensions; it cannot be fully transferred because reputational and regulatory consequences remain.

Phishing and social engineering target people, so technical controls alone are insufficient; security awareness training and simulated phishing are the matching controls.

Ransomware defence combines offline immutable backups, network segmentation, patching, least-privilege access and a tested incident response plan.

Under GDPR-style regimes, personal data breaches must be notified to the regulator typically within 72 hours of awareness, and to affected individuals where there is high risk.

Third-party and supply chain cyber risk is managed through due diligence, contractual security and audit rights, and periodic reassessment; concentration on one vendor creates systemic exposure.

Risk universe is the complete set of risks an entity faces, grouped by category (strategic, operational, financial, compliance) and used to allocate risk ownership.

Risk aggregation combines individual risk exposures into a portfolio view; simple summation overstates total risk when risks are imperfectly correlated.

A risk owner is accountable for managing a risk and its response; a risk actionee is responsible for carrying out a specific control or action.

Risk appetite statements should specify risk type, a metric, a threshold and a time horizon, for example maximum acceptable loss from a single operational event.

The risk management process cycle is: establish context, identify, analyse, evaluate, treat, monitor and review, with communication and consultation throughout.

Risk identification techniques include brainstorming, interviews, Delphi, fault tree analysis, event inventories and process mapping.

Risk evaluation compares analysed risk against appetite to decide whether the risk is acceptable, needs treatment, or must be escalated.

Embedding ERM means risk is integrated into planning, budgeting, capital allocation and performance appraisal, not run as a separate compliance exercise.

Ansoff matrix generates growth options: market penetration, product development, market development and diversification, with diversification carrying the highest risk.

The Boston Consulting Group matrix classifies business units as stars, cash cows, question marks and dogs using market growth and relative market share.

Game theory models competitor response; a Nash equilibrium is a set of strategies where no player gains by changing unilaterally.

Decision trees value sequential decisions with probabilities; expected value is calculated by rolling back from the terminal outcomes.

Expected value ignores risk preference; a risk-averse decision maker may prefer a lower certain outcome to a higher expected value with variance.

Stress testing applies extreme but plausible scenarios to quantify survival; it complements probability-based analysis by focusing on tail events.

A strategic risk is one arising from the entity's strategy, its execution, or misalignment with the environment, and it is owned at board level.

Country risk assessment covers political, economic, sovereign and transfer risk, and affects the discount rate applied to foreign projects.

Control environment, risk assessment, control activities, information and communication, and monitoring form the five COSO internal control components.

Preventive, detective and corrective controls should be layered so a single control failure does not leave the risk unmanaged.

A key control is one whose failure would materially increase risk; only key controls need full documentation and independent testing.

Control testing samples transactions and evaluates design and operating effectiveness; a control that exists but is not operated is ineffective.

The three lines model places internal audit outside management, reporting to the audit committee to preserve independence.

Risk financing options include insurance, captive insurance, self-insurance reserves and hedging; retention is appropriate where loss frequency and severity are low.

Insurance does not reduce the probability of loss and typically excludes reputational damage, regulatory fines and known or expected losses.

Key control indicators such as exception rates, reconciliation breaks and overdue actions provide early warning that controls are degrading.

The audit committee oversees financial reporting and internal control; the risk committee oversees the risk framework and appetite, and the two may be combined in smaller entities.

Independence of non-executive directors is compromised by prior executive roles, material consultancy fees, family ties or long tenure.

The chief risk officer should have direct access to the board risk committee and sufficient stature to challenge business units.

Culture is assessed through behavioural indicators: escalation rates, near-miss reporting, incentive design, attrition in control functions and audit findings recurrence.

The cyber kill chain stages are reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives; controls can break the chain at any stage.

Defence in depth assumes any single control may fail, so independent layers protect the same asset.

Multi-factor authentication and least-privilege access are among the highest-impact controls against credential-based attacks.

Cyber insurance covers response costs and some business interruption but excludes fines where uninsurable and does not cover reputational loss.

Incident response requires defined roles, a communication plan, forensic readiness and post-incident review that feeds control improvement.

Risk maturity models typically progress from ad hoc, to repeatable, to defined, to managed and measured, to optimised, with embedding as the key transition point.

Risk reporting should be decision-useful: report movements in exposure against appetite, not simply a long list of risks.

A risk appetite statement without a linked metric and escalation trigger is unenforceable in practice.

Risk registers should be reviewed at a defined frequency and whenever a material event, strategy change or new regulation occurs.