CISI Risk in Financial Services common mistakes
CISI Risk in Financial Services · Understand the traps and how to avoid them.
Treating 'risk' as synonymous with 'loss' and choosing the answer that only describes downside, even when the question asks for the formal definition of risk in a financial-services context (uncertainty of outcome, both favourable and unfavourable deviation from expectation).
Everyday usage equates risk with danger, and candidates skim the stem, recognise the word 'risk', and pick the option mentioning loss, volatility of losses, or 'chance of something bad happening'. The exam's definitional questions deliberately include a pure-downside distractor.
What to do instead
Before answering any definitional item, write the two-part test in your head: does the option capture uncertainty, and does it allow both upside and downside? Eliminate any option that mentions only loss, only downside, or certainty. Practise by restating the definition in your own words once per study session so the exam wording becomes familiar.
Confusing risk appetite, risk tolerance, risk capacity and risk profile, and selecting 'tolerance' whenever the stem mentions 'the amount of risk the firm is willing to seek or accept'.
The four terms overlap in ordinary English and revision guides often list them without contrast. Candidates memorise one definition and pattern-match on the word 'willing' rather than on whether the statement is about the firm's overall desire for risk (appetite), the maximum acceptable variation around it (tolerance), the financial ability to absorb it (capacity), or the resulting aggregate position (profile).
What to do instead
Build a four-row table with a one-line definition, an owner (board for appetite, senior management for tolerance, capital/earnings for capacity), and a concrete example for each. Test yourself by writing a sentence using the wrong term and correcting it. In the exam, locate the subject of the sentence: is it desire, deviation, ability, or aggregate?
Choosing 'eliminate the risk' or 'avoid the activity' as the correct risk treatment when the scenario describes a core business exposure that cannot be exited, instead of identifying reduce, transfer, or retain.
Candidates read a scary scenario (large credit concentration, volatile trading book) and default to the most decisive-sounding option. They forget that avoidance is only realistic for non-core or unacceptable exposures, and that the exam expects the treatment consistent with the firm's appetite and the nature of the exposure.
What to do instead
Learn the treatment ladder with a decision rule: can the exposure be removed without destroying the business (avoid); can it be shared contractually (transfer, e.g. insurance, hedging, syndication); can controls lower frequency or severity (reduce); is it within appetite and cheaper to absorb (retain). Then check the stem for signals such as 'core activity', 'contractual', 'collateral', 'limits'.
Mixing up the three lines of defence, especially assigning risk ownership, monitoring, or assurance to the wrong line, or placing internal audit inside the second line.
The model is taught as a diagram and candidates remember 'three' but not the functional split. Distractors exploit the plausible idea that the risk function 'owns' risk or that compliance 'provides independent assurance'.
What to do instead
Anchor each line with a verb: first line owns and manages risk (business units); second line sets frameworks, limits, and independent oversight (risk and compliance); third line provides independent assurance to the board (internal audit). For each practice item, name the actor in the stem and the verb in the option, then check they match.
Answering governance questions as if the CEO or CRO is responsible for the risk framework, rather than the board, and missing the distinction between board oversight and executive implementation.
In practice executives are visible and vocal about risk, so candidates attribute accountability to them. Exam items are testing the governance principle that the board sets appetite and is accountable, while management implements.
What to do instead
Memorise a short accountability chain: shareholders appoint the board; the board approves appetite, framework, and reports to shareholders; committees (audit, risk) support the board; executives implement and report upward. When an option names an individual executive as 'accountable to shareholders', treat it as a red flag.
Treating the regulator as a single undifferentiated body and picking answers that attribute prudential capital rules, conduct supervision, or market listing rules to the wrong authority or the wrong objective.
Candidates revise the regulatory environment as a list of acronyms without mapping each to its statutory objective, so they choose whichever name looks familiar. Distractors swap objectives (financial stability versus consumer protection versus market integrity).
What to do instead
Create a three-column map: authority, statutory objective, and typical instrument (capital requirements, conduct rules, listing and disclosure). For each practice question, identify the objective implied by the stem (e.g. 'solvency of a bank' or 'fair treatment of a customer') before looking at the options, then select the authority whose objective matches.
Confusing prudential regulation with conduct regulation when the stem describes a capital buffer, liquidity ratio, or stress test, and selecting a consumer-protection or disclosure answer.
Both are 'regulation' and candidates under time pressure respond to the topic word rather than the mechanism. The exam deliberately offers one prudential and one conduct option that both sound plausible.
What to do instead
Use a two-question filter: is the harm being addressed a firm failure (prudential) or unfair customer outcomes and market misconduct (conduct)? Then check the instrument: capital, liquidity, leverage, and stress testing are prudential; disclosure, suitability, treating customers fairly, and market abuse controls are conduct. Apply the filter before reading the options.
Applying the five Cs of credit or a scoring model mechanically and missing the decisive factor in the scenario, such as character and repayment history versus capacity and cash flow, or ignoring collateral valuation and loan-to-value in the final answer.
Candidates learn the list and then pick the option that names the most terms rather than the factor the stem actually emphasises. Scenario stems often describe a borrower with strong collateral but unstable income, or vice versa, and the correct answer turns on that contrast.
What to do instead
For each credit scenario, underline the borrower facts and label each as capacity (cash flow, debt service), capital (equity contribution), collateral (value, LTV, enforceability), character (track record), or conditions (industry, purpose). The correct option should address the weakest labelled factor, not the most numerous.
Reversing the direction of a market risk relationship, for example stating that bond prices rise when yields rise, or that a long position gains when prices fall, and then choosing the option consistent with the reversed logic.
Candidates know the vocabulary of duration and interest-rate sensitivity but recall the sign of the relationship incorrectly under exam pressure, especially when the question is phrased as a fall in yields rather than a rise.
What to do instead
Before evaluating options, sketch the position: is the firm long or short, and what happens to price if the risk factor moves up? Write the inverse rule explicitly (yields up, bond prices down; long position loses when price falls). Re-derive rather than recall, and check every option against that sketch.
Misreading VaR outputs as a maximum possible loss, or treating a 99% one-day VaR figure as the loss expected on 99 days out of 100, and choosing the option that states either misreading.
VaR is taught with a formula and a confidence level, and the tail probability is easily inverted. Candidates also import the intuition that a risk measure should bound losses, which VaR does not do.
What to do instead
State the sentence aloud in full each time: 'We are 99% confident that losses will not exceed X over one day', which means the loss exceeds X on about 1 day in 100, and says nothing about how large that exceedance is. Eliminate options using 'maximum', 'guaranteed', or the inverted probability. Pair VaR with expected shortfall so you can recognise the tail-limitation distractor.