CISI Risk in Financial Services cheat sheet

Risk is the combination of the probability of an event and its consequences; in financial firms the consequence is usually measured as a monetary loss or a capital impact.

Pure risk offers only loss or no loss (fire, fraud, liability); speculative risk offers gain or loss (trading positions, new products). Risk management addresses both but capital planning focuses on the downside.

Core risk categories: credit, market, liquidity, operational, conduct, strategic, reputational, and systemic. Regulatory capital frameworks explicitly cover credit, market and operational risk; the others are managed through governance and buffers.

Risk management process cycle: identify, assess/measure, treat (avoid, reduce, transfer, accept), monitor and report, then review. Treating risk includes insurance and hedging as transfer mechanisms.

Expected loss EL = PD x EAD x LGD for credit exposures; unexpected loss is covered by capital, expected loss by pricing and provisions.

Risk appetite is the amount and type of risk a firm is willing to accept in pursuit of its objectives; risk tolerance is the acceptable variation around that appetite for a specific risk type.

Three lines of defence: business units own risk (first line), risk and compliance functions oversee (second line), internal audit provides independent assurance (third line).

Risk register records each identified risk with owner, likelihood, impact, controls, residual rating and review date; it is the practical link between risk appetite and day-to-day control.

Diversification reduces unsystematic (specific) risk but not systematic (market-wide) risk; correlation assumptions are the main weakness of diversification models in stress periods.

Board responsibilities include setting strategy and risk appetite, approving the risk framework, appointing senior management, and overseeing internal control and remuneration structures.

Independence tests for non-executive directors typically cover no material business relationship, no recent employment with the firm or its auditor, no family ties to executives, and no cross-directorships.

Separation of the roles of chair and chief executive avoids concentration of power; many codes also require the chair not to be a former CEO of the same firm.

Audit committee: composed of independent non-executive directors, oversees financial reporting, external audit and internal audit independence; it should meet auditors without executive management present.

Risk committee: oversees the risk appetite statement, risk framework and senior risk appointments, and receives the chief risk officer's reports; the CRO should have direct access to the board.

Remuneration committees should align pay with prudent risk-taking, using deferral, malus and clawback so that bonuses can be reduced or recovered after poor risk outcomes.

'Comply or explain' governance codes allow deviation from a provision provided the firm explains why; 'apply and explain' codes require explanation of how principles are applied.

Senior managers and certification regimes make named individuals personally accountable for defined areas of responsibility, supported by a map of responsibilities.

Whistleblowing arrangements require protected disclosure channels, anti-retaliation safeguards and reporting to the board or audit committee on concerns raised.

Objectives of financial regulation: protect consumers, maintain market confidence and integrity, reduce financial crime, and promote financial stability; prudential rules target firm safety, conduct rules target customer outcomes.

Basel III capital stack: Common Equity Tier 1, Additional Tier 1 and Tier 2 capital, measured against risk-weighted assets, plus a leverage ratio and liquidity coverage ratio and net stable funding ratio.

Minimum Basel III requirements: CET1 at 4.5%, Tier 1 at 6% and total capital at 8% of risk-weighted assets, before capital conservation, countercyclical and systemic buffers.

Liquidity coverage ratio requires high-quality liquid assets sufficient to cover 30 days of net cash outflows under stress; the net stable funding ratio compares available to required stable funding over one year.

Risk-weighted assets are computed under standardised or internal-model approaches for credit, market and operational risk; operational risk uses the standardised approach based on business indicator components.

Conduct regulation focuses on fair treatment of customers, product governance, conflicts of interest, financial promotions and complaints handling; breaches can trigger redress and fines.

Anti-money laundering regime: customer due diligence, beneficial ownership identification, enhanced due diligence for politically exposed persons and high-risk jurisdictions, ongoing monitoring and suspicious activity reporting.

Recovery and resolution planning: recovery plans restore a failing firm, resolution plans allow orderly wind-down without taxpayer support; bail-in tools write down or convert liabilities to absorb losses.

Deposit protection and investor compensation schemes reimburse eligible customers up to set limits if a firm fails, supporting confidence and reducing contagion risk.

Credit risk is the risk of loss because a counterparty fails to meet its obligations; it arises in lending, bonds, derivatives, settlement and trade finance.

The five Cs of credit: character, capacity, capital, collateral and conditions; used as a qualitative lending assessment framework alongside quantitative scoring.

Expected loss EL = PD x EAD x LGD; provisions under expected credit loss models cover 12-month or lifetime expected losses depending on whether credit risk has increased significantly.

Probability of default is the likelihood of default within a horizon (commonly one year); exposure at default is the amount outstanding at default including undrawn commitments; loss given default is the percentage not recovered.

Credit ratings map to default probabilities; internal ratings-based approaches require firms to estimate PD, LGD and EAD with supervisory approval and use them in capital calculations.

Credit risk mitigation: collateral, guarantees, credit derivatives and netting; only eligible mitigants that are legally certain and enforceable reduce regulatory capital requirements.

Concentration risk arises from large exposures to a single counterparty, sector or country; large exposure limits cap exposures as a percentage of eligible capital.

Credit migration and default correlation drive portfolio credit risk; models such as CreditMetrics and KMV estimate portfolio loss distributions from rating transitions and asset correlations.

Counterparty credit risk on derivatives includes current exposure plus potential future exposure; wrong-way risk arises when exposure increases as counterparty credit quality deteriorates.

Market risk is the risk of loss from movements in market prices: interest rates, foreign exchange rates, equity prices, commodity prices and credit spreads.

Value at risk estimates the maximum loss over a horizon at a confidence level; a 99% one-day VaR of 5 million means losses should exceed 5 million on about 1 day in 100.

VaR limitations: it says nothing about the size of losses beyond the threshold, assumes historical correlations, and is not sub-additive, so it can understate tail risk.

Expected shortfall (conditional VaR) is the average loss in the worst outcomes beyond the VaR threshold; Basel market risk rules moved to expected shortfall at 97.5% confidence.

Sensitivity measures: duration and DV01 for interest rates, delta for options, beta for equities; these translate price moves into profit and loss for a given shock.

Stress testing and scenario analysis complement VaR by applying extreme but plausible shocks, including historical episodes and hypothetical scenarios, to portfolios and capital.

Backtesting compares predicted VaR with actual profit and loss; too many exceptions indicates model weakness and can increase regulatory capital multipliers.

Interest rate risk in the banking book arises from repricing mismatches; gap analysis and duration measure exposure to parallel and non-parallel yield curve shifts.

Hedging instruments include futures, forwards, swaps and options; basis risk remains when the hedge does not move exactly with the hedged exposure, and model risk arises from flawed pricing assumptions.