CPA Australia Financial Risk Management common mistakes
CPA Australia Financial Risk Management · Understand the traps and how to avoid them.
Treating risk appetite as a slogan and answering governance questions by listing committees (board, audit, risk committee) without stating their distinct decision rights, escalation triggers and limits.
Candidates memorise an org chart from study notes and never connect the risk appetite statement to delegated limits, reporting lines and board oversight of the risk profile. The exam asks who decides and on what evidence, not who exists.
What to do instead
For each governance body, write one line on decision rights (approve, challenge, escalate), one on the limit it owns, and one on the report it receives and how often. Practise converting a risk appetite statement into cascaded limits and a breach-escalation path, and state the three-lines-of-defence roles in terms of independence and reporting, not job titles.
Computing VaR, expected shortfall and stress losses correctly in isolation but then drawing the wrong risk-management conclusion, such as treating a 99% one-day VaR as the maximum possible loss or as a 99% probability of loss.
Candidates focus on the arithmetic and skip the interpretation, so they misread the confidence level, ignore the tail beyond VaR, and forget the time horizon scaling assumption (square-root of time) and its limits under fat tails and autocorrelation.
What to do instead
Before calculating, write the sentence you will need: 'We are X% confident losses will not exceed Y over Z days; the remaining (100-X)% average loss is expected shortfall.' Then state two limitations (tail blindness, horizon scaling, non-subadditivity of VaR, backtesting window) and when ES or stress testing is preferred. Drill one interpretation sentence per metric until it is automatic.
Mixing up the credit risk parameter chain: quoting PD, LGD and EAD as if interchangeable, applying through-the-cycle PD to a point-in-time pricing decision, or omitting the downturn LGD and maturity adjustment in regulatory capital.
The three parameters appear together in expected loss and capital formulas, so under time pressure candidates grab whichever number is in the stem. The distinction between regulatory (through-the-cycle, downturn) and economic (point-in-time) calibration is under-rehearsed.
What to do instead
Anchor on EL = PD x LGD x EAD and write, for each parameter, its definition, its data source and its calibration basis. For every credit question, first label the purpose (pricing, provisioning under expected credit loss, regulatory capital, limit setting) and then select the appropriate calibration. Practise converting a 12-month PD to a lifetime PD and explaining the maturity adjustment.
Confusing liquidity risk with solvency and answering funding questions with capital ratios, or treating the liquidity coverage ratio and net stable funding ratio as interchangeable buffers.
Capital and liquidity are taught side by side and both look like 'having enough money'. Candidates also miss that LCR addresses a 30-day stressed outflow while NSFR addresses a one-year stable funding structure, so they apply the wrong ratio to a short funding shock.
What to do instead
Build a two-column table: capital (loss absorbency, going concern versus gone concern) against liquidity (cash-flow timing, 30 days versus one year). For each scenario in a question, classify the shock as timing (liquidity) or value (solvency) and name the metric and the management action: contingency funding plan, asset sales, central bank facility, deposit pricing.
Answering operational risk questions only with 'human error' and controls, missing the taxonomy (process, people, systems, external events) and the distinction between expected loss provisioning and tail operational risk capital under the standardised approach.
Operational risk feels intuitive, so candidates under-prepare the formal framework, then cannot map a scenario to a Basel event type or explain why insurance is a partial mitigant with basis and recovery risk.
What to do instead
Memorise the seven Basel event types with one concrete example each and a matching control. For any scenario, state the event type, the root cause, the control that failed, the residual risk after mitigation and the capital or provisioning treatment. Note explicitly that insurance covers recovery with delay and exclusions, not the event itself.
Describing a hedge qualitatively ('use an interest rate swap') without specifying direction, notional, tenor, reference rate, and whether it is a cash flow or fair value hedge and how it is accounted for.
Candidates know the instrument names but not the mechanics, so they cannot say which leg pays fixed, what exposure is being offset, or how hedge effectiveness and ineffectiveness flow to profit or loss and other comprehensive income.
What to do instead
Use a four-line hedge template: exposure and its direction; instrument and pay/receive legs; notional and tenor matched to the exposure; accounting treatment and effectiveness testing. Work one worked example each for a floating-rate borrower using a pay-fixed swap and an exporter using a forward, including the mark-to-market on the derivative and the offsetting change in the hedged item.
Ignoring basis risk, counterparty credit risk and collateral mechanics when recommending a derivative hedge, presenting the hedge as eliminating risk entirely.
Textbook hedging is taught as a clean offset, so candidates overlook that the hedging instrument rarely matches the exposure exactly (grade, location, timing), that OTC derivatives create counterparty exposure, and that margin calls create liquidity demands in stress.
What to do instead
For every hedging recommendation, add a residual-risk paragraph covering basis, timing mismatch, counterparty exposure and collateral or margin calls, plus one mitigation for each (cross-hedge review, central clearing or collateral agreements, liquidity buffer sizing). Practise quantifying basis risk as the variance of the difference between hedged item and instrument returns.
Using a single scenario or a historical simulation only, and failing to state model limitations, validation evidence and governance when asked how a risk model should be trusted.
Model risk management is often skimmed as a compliance topic, so candidates cannot describe independent validation, backtesting, benchmarking, sensitivity analysis, or the model inventory and tiering that determine validation depth.
What to do instead
Prepare a validation checklist: conceptual soundness, data quality, methodology and assumptions, outcomes analysis (backtesting, benchmarking), sensitivity and stress, limitations and compensating controls, approval and periodic review. Apply it to one model (VaR or a PD scorecard) and be ready to name what would cause a model to be redeveloped versus recalibrated.
Confusing enterprise risk aggregation with simple summation, and failing to distinguish risk correlation, diversification benefit and concentration risk when asked about the firm-wide risk profile.
Candidates add up departmental risks and assume the total is the sum, missing that correlations change in stress, that diversification benefits can disappear exactly when needed, and that concentrations (single counterparty, sector, funding source) can dominate the aggregate.
What to do instead
Explain aggregation as a correlation-dependent process: name the method (variance-covariance, copula, scenario-based), state the diversification assumption and how it behaves in stress, and identify the top two concentrations with limits. Practise a short answer showing why stressed aggregation uses higher correlations and no diversification credit.
Managing to the metric rather than the risk: recommending actions that improve a reported ratio (window-dressing the LCR at reporting dates, shifting exposures between banking and trading book, or choosing a model that lowers capital) without assessing the underlying risk or the regulatory and conduct consequences.
Exam questions reward identifying the ratio, so candidates stop there and propose the cheapest numeric fix, forgetting arbitrage limits, disclosure, supervisory scrutiny and the difference between regulatory and economic capital.
What to do instead
For every recommendation, add a second sentence on the economic effect and a third on the constraint: regulatory approval, disclosure, supervisory expectation, or conduct risk. State explicitly where regulatory and economic capital diverge and why a bank should hold the higher of the two, and flag window-dressing as a governance and reputational failure rather than a valid strategy.