Risk and Risk Management in Financial Services
What the exam tests
This domain covers the language of risk, the risk management cycle and how firms organise to take and control risk. Expect definitions, risk taxonomy and questions that ask you to distinguish appetite, tolerance and capacity.
Core rules and concepts
- Risk is the effect of uncertainty on objectives; it can be upside or downside, but financial regulation focuses on adverse outcomes.
- Financial risks include credit, market, liquidity and funding; non-financial include operational, conduct, reputational, strategic and model risk. Systemic risk is contagion across the system.
- The risk management process: establish context, identify, analyse, evaluate, treat, monitor and report. It is iterative, not a one-off project.
- Risk appetite is the amount of risk a firm is willing to accept in pursuit of strategy. Risk tolerance is the acceptable deviation from appetite, often expressed as limits. Risk capacity is the maximum risk the firm could absorb before breaching capital or liquidity needs.
- Inherent risk is before controls; residual risk is after controls. Controls reduce likelihood or impact but rarely to zero.
- Treatment options: tolerate, treat, transfer, terminate (and sometimes take or exploit). Insurance and derivatives transfer some risk but create counterparty and basis risk.
- The three lines model: first line owns and manages risk; second line sets frameworks and challenges; third line (internal audit) provides independent assurance. Independence matters.
- Risk registers record likelihood, impact, score, owner and controls. Quantification uses likelihood and impact; expected loss is a credit-specific measure.
Worked example
A firm identifies a cyber outage on its trading platform. On a 5 by 5 matrix, inherent likelihood is 4 and impact is 5, giving a score of 20 (high). Controls such as dual data centres, tested recovery and penetration testing reduce likelihood to 2, so the residual score is 10 (medium). The board's risk appetite says medium operational risks are acceptable if customer impact is contained; the risk is logged, monitored quarterly and assigned to the COO. If a control test fails, the residual score returns to high and must be escalated. The example shows inherent versus residual risk and appetite versus tolerance in practice.
Traps that cost marks
- Treating risk appetite as a single number. It is a framework with qualitative and quantitative statements.
- Confusing tolerance with capacity. Capacity is the hard limit; tolerance is a management buffer.
- Saying risk transfer eliminates risk. It changes it and introduces counterparty, legal and basis risk.
- Describing the three lines as three departments. The first line is the business, not a separate function.
- Forgetting that operational risk includes conduct, cyber, legal and outsourcing failures.