CPA Australia Financial Risk Management cheat sheet

Risk is the effect of uncertainty on objectives; it is measured as exposure times probability times severity, and treated through avoid, reduce, transfer, or accept decisions.

Market, credit, liquidity, operational, and strategic risk are distinct categories; reputational and model risk are usually treated as cross-cutting overlays rather than standalone silos.

The three lines model: business units own risk (first line), an independent risk function sets frameworks and monitors (second line), internal audit provides independent assurance (third line).

Board risk appetite is expressed as quantitative tolerance limits (earnings at risk, capital drawdown, liquidity coverage) plus qualitative statements; limits must be cascaded to desks and monitored against triggers.

COSO ERM and ISO 31000 both require risk identification, assessment, treatment, monitoring, and communication, with governance and culture as foundations rather than afterthoughts.

Risk-adjusted performance measures link return to capital: RAROC = risk-adjusted return / economic capital; EVA = net operating profit after tax minus a capital charge.

Three core risk cultures fail predictably: overconfidence after long calm periods, siloed escalation where bad news does not travel upward, and incentive structures that reward volume without risk adjustment.

Regulatory capital frameworks (Basel III/IV) separate Pillar 1 minimums, Pillar 2 supervisory review, and Pillar 3 market discipline; APRA's CPS 220 adds fit-and-proper and risk-appetite requirements for Australian entities.

A risk register records each risk with owner, cause, consequence, inherent and residual rating, controls, and treatment plan; residual rating must reflect control effectiveness testing, not control existence.

VaR at confidence c over horizon h is the loss not exceeded with probability c; it says nothing about the size of losses beyond that quantile, so Expected Shortfall (mean of tail losses) is used alongside it.

Parametric VaR = z times portfolio volatility times position value; for a 99% one-day normal assumption z is about 2.33, and scaling to a 10-day horizon multiplies by the square root of 10 under i.i.d. returns.

Historical simulation revalues the portfolio against the last N historical return scenarios and takes the appropriate order statistic; its accuracy depends entirely on the window covering relevant stress.

Monte Carlo VaR draws correlated scenarios from a chosen distribution and revalues; it handles non-linearity and path dependence but carries model risk and computational cost.

VaR is not sub-additive in general, so portfolio VaR can exceed the sum of component VaRs; Expected Shortfall is sub-additive and coherent, which is why Basel's FRTB moved to ES at 97.5%.

Delta measures first-order sensitivity to the underlying, gamma the change in delta, vega sensitivity to volatility, theta to time decay, and rho to interest rates; a delta-hedged book remains exposed to gamma and vega.

Backtesting compares realised P&L against VaR exceptions; under Basel's traffic-light approach, 5 or more exceptions in 250 days at 99% triggers a higher capital multiplier.

Stress testing and scenario analysis complement VaR by applying historical or hypothetical shocks (rate spikes, equity crashes, basis blowouts) to the current portfolio without a probability weighting.

Interest rate risk in the banking book is measured through repricing gap and duration/EVE analysis; a parallel rate shock of plus or minus 200 basis points is a common supervisory sensitivity test.

Expected loss = PD times LGD times EAD; unexpected loss is covered by economic capital, and pricing must recover expected loss plus funding and capital costs.

PD is a through-the-cycle or point-in-time probability of default over a horizon (usually one year); LGD is one minus recovery rate, and EAD includes current drawn balance plus a credit conversion factor on undrawn lines.

Credit ratings map to PD bands; internal ratings-based approaches require validated PD, LGD, and EAD models, while the standardised approach uses supervisory risk weights.

Credit risk mitigation reduces EAD or LGD only if the collateral is legally enforceable, promptly realisable, and subject to haircuts reflecting price volatility and liquidation period.

Credit concentration risk arises from single-name, sector, and geographic exposure; large-exposure limits cap exposure to any one counterparty as a percentage of eligible capital.

Credit default swaps transfer default risk in exchange for a premium; the CDS spread approximates annualised default probability times LGD, so a 300bp spread with 60% LGD implies roughly 5% annual PD.

Wrong-way risk occurs when exposure to a counterparty increases as the counterparty's credit quality deteriorates, typically through collateral that is correlated with the counterparty.

Migration risk is the loss from credit quality deterioration short of default; it is captured by rating transition matrices and credit value-at-risk frameworks.

Covenants, collateral, guarantees, and netting agreements are the primary structural mitigants; close-out netting is enforceable only where legal opinion confirms it in the relevant jurisdiction.

Liquidity risk splits into funding liquidity (ability to raise cash) and market liquidity (ability to sell assets without moving prices); a firm can fail on either while solvent.

The liquidity coverage ratio requires high-quality liquid assets to cover 30 days of net stressed cash outflows; the net stable funding ratio requires available stable funding to exceed required stable funding over one year.

HQLA is tiered: Level 1 (central bank reserves, high-grade sovereigns) at no haircut, Level 2A (agency, high-grade corporate) at 15%, Level 2B (lower-rated equity, some corporates) at 25-50%, with a cap on Level 2 assets.

Cash flow gap analysis buckets contractual and behavioural inflows and outflows by tenor; cumulative gaps must stay within board-approved limits at every bucket.

Survival horizon is the number of days a firm can meet obligations under a stress scenario using its counterbalancing capacity before corrective action.

Funding concentration is measured by the share of liabilities from the largest depositors or wholesale providers; reliance on short-term wholesale funding to finance long-dated assets is the classic maturity mismatch failure mode.

Liquidity stress scenarios include idiosyncratic (rating downgrade, deposit run), market-wide (asset price collapse, interbank freeze), and combined shocks, with assumed haircuts on HQLA.

Contingency funding plans specify early warning indicators, escalation triggers, and a menu of actions (asset sales, secured borrowing, central bank facilities) with pre-assessed execution time.

Operational risk is loss from failed internal processes, people, systems, or external events; it excludes strategic and reputational risk in the Basel definition but those are managed at enterprise level.

The Basel event taxonomy has seven categories: internal fraud, external fraud, employment practices, clients/products/business practices, damage to physical assets, business disruption and system failures, and execution/delivery/process management.

Loss distribution approach models annual loss as frequency (Poisson) times severity (lognormal or similar); capital is a high quantile (99.9%) of the aggregate loss distribution, sensitive to the severity tail.

Key risk indicators are forward-looking metrics with thresholds that signal rising exposure; they must be leading, measurable, and owned, not lagging loss counts.

RCSA (risk and control self-assessment) identifies processes, risks, and controls, then rates likelihood and impact; it is only useful when control testing evidence supports the rating.

Model risk arises from incorrect development, inappropriate use, or poor implementation; model validation must be independent of developers and cover conceptual soundness, data, and outcomes analysis.

Model governance requires an inventory, tiering by materiality, documented assumptions and limitations, periodic revalidation, and approval by a model risk committee.

The three lines model and a risk appetite statement are enterprise-level controls; KRIs, incident data, and audit findings feed the dashboard the board uses to challenge management.

Business continuity and cyber resilience plans require tested recovery time objectives; an untested plan is an assumption, not a control.

Forwards lock a price for future delivery with counterparty credit exposure; futures are standardised, exchange-cleared, margined daily, and carry basis risk against the hedged exposure.

Options confer a right, not an obligation; the buyer pays a premium and has limited loss, while the writer faces potentially unlimited loss and posts margin.

Put-call parity: call minus put equals spot minus the present value of the strike (C - P = S - K e^(-rT)) for European options on a non-dividend stock.

Delta hedging neutralises first-order price exposure but leaves gamma and vega exposure; a hedge must be rebalanced as delta changes, and rebalancing frequency trades cost against tracking error.

An interest rate swap exchanges fixed for floating payments; the fixed rate is set so the swap has zero value at inception, and its value later equals the present value of remaining differential cash flows.

A cross-currency swap exchanges principal and interest in two currencies, hedging both FX and interest rate risk; the FX forward is a single-period special case.

Hedge accounting under IFRS 9 requires documented risk management objective, hedge effectiveness assessment on a prospective basis, and reclassification of gains and losses to match the hedged item.

Basis risk arises when the hedging instrument and hedged exposure are not perfectly correlated (different index, tenor, or credit); it is the residual risk a hedge cannot remove.

Cleared derivatives under central counterparties reduce counterparty credit risk through daily variation margin and initial margin, but concentrate risk in clearing members and create liquidity demands in stress.