Financial risk management fundamentals and governance
Financial risk management fundamentals and governance
This domain tests how risk appetite, governance structures and risk frameworks turn risk measurement into board-level decisions. Expect questions on risk taxonomy, the risk appetite statement, the three lines model, ISO 31000 and COSO ERM, and the roles of the board, board risk committee and CRO.
Core rules and concepts
- Risk is the effect of uncertainty on objectives. Financial risks include market, credit, liquidity, operational and model risk; strategic and reputational risk are usually treated as enterprise-level consequences.
- Distinguish risk capacity (maximum risk the entity can bear), risk appetite (aggregate risk the board is willing to accept) and risk tolerance (acceptable variation around a specific limit). Limits and triggers operationalise appetite.
- Governance allocates accountability: the board approves appetite and framework; the board risk committee oversees; the CRO leads the independent risk function; business units own risk in the first line.
- The IIA Three Lines Model: first line owns and manages risk; second line provides expertise, monitoring and challenge; third line, internal audit, gives independent assurance to the board. It is a model of roles, not three departments.
- ISO 31000 provides a process: establish context, identify, analyse, evaluate, treat, monitor and review, with communication and consultation throughout. COSO ERM links risk to strategy and performance.
Worked example
A board states that it will maintain a Tier 1 capital ratio of at least 10.5% and a 99% one-day VaR limit of $2 million. Treasury proposes a trade that raises expected return but, in stress, lowers the capital ratio to 10.2%. The CRO escalates: the proposal breaches risk appetite even though it is within the VaR limit. The board risk committee must reject, resize or formally approve a temporary appetite change. The reasoning is that appetite is set at board level and limits are cascaded; a business-unit limit cannot override the aggregate statement.
Traps that cost marks
- Treating risk appetite as a slogan rather than approved quantitative and qualitative boundaries.
- Confusing tolerance with capacity; capacity is a constraint, tolerance is a permitted range.
- Describing the three lines as an org chart rather than distinct assurance roles; the second line must challenge the first, and internal audit must remain independent.
- Assuming ISO 31000 prescribes a fixed risk register or scoring scale; it provides principles and a process, not a mandatory template.
- Forgetting that risk culture, incentives and escalation behaviour are governance evidence, not soft extras.