CrTAS cheat sheet

Three-lines model: first line (business) owns risk; second line (risk/compliance) sets frameworks and challenges; third line (internal audit) provides independent assurance to the board.

Risk appetite is expressed as quantitative statements (limits, tolerances, target ratios) plus qualitative statements; risk capacity is the maximum risk the firm can bear before breaching capital or liquidity constraints.

COSO ERM components: governance and culture, strategy and objective-setting, performance, review and revision, information-communication-reporting; ISO 31000 uses risk identification, analysis, evaluation, treatment, monitoring and review.

Inherent risk vs residual risk: residual = inherent risk after control effectiveness; risk rating matrices typically combine likelihood and impact on a 5x5 scale with defined score bands.

Board risk committee duties: approve risk appetite, oversee top and emerging risks, review stress testing results, and confirm remediation of material findings; escalation triggers are pre-agreed.

Key risk indicators should be measurable, forward-looking, and tied to a threshold with amber/red escalation; a KRI without an owner and action plan is not a control.

Segregation of duties requires that the person who executes a transaction cannot also approve, settle, and reconcile it; conflicts are documented in a conflicts-of-interest register.

Risk taxonomy commonly splits into market, credit, liquidity, operational, compliance/conduct, strategic, and reputational risk; model risk and climate risk are often treated as cross-cutting.

VaR at confidence c over horizon h: the loss threshold not exceeded with probability c; for normal returns VaR = -(μ - z·σ)·V, with z = 1.645 at 95%, 2.326 at 99%.

Parametric VaR scales with the square root of time under i.i.d. returns: 1-day VaR × √10 approximates 10-day VaR; scaling fails with autocorrelation or volatility clustering.

Expected shortfall (CVaR) is the average loss beyond the VaR threshold; it is subadditive and coherent, unlike VaR, which can violate subadditivity.

Historical simulation revalues the portfolio on ranked past scenarios; its accuracy depends on the lookback window and it cannot produce losses larger than those observed in the window.

Monte Carlo VaR requires a covariance matrix and distributional assumptions; the number of simulations drives standard error, and random-number seed choice affects reproducibility.

Backtesting compares daily P&L against VaR; under Basel traffic-light rules, 0-4 exceptions in 250 days is green, 5-9 amber, 10+ red, with capital multipliers rising from 3 to 4.

DV01 is the price change for a 1bp parallel yield shift; duration-based VaR uses modified duration × yield volatility × market value, and convexity matters for large yield moves.

Greeks: delta measures first-order underlying sensitivity, gamma its change, vega volatility sensitivity, theta time decay, rho rate sensitivity; gamma and vega risk are not captured by linear VaR models.

Expected loss = PD × LGD × EAD; EL is priced into spreads and provisions, while unexpected loss is covered by economic capital.

Credit metrics: PD from ratings or default models, LGD = 1 - recovery rate, EAD includes drawn balances plus a credit conversion factor on undrawn commitments.

Merton structural model: equity is a call option on firm assets; default occurs when asset value falls below the debt barrier at maturity, so PD rises with leverage and asset volatility.

Counterparty credit risk exposure is bilateral and path-dependent; current exposure plus potential future exposure (PFE) gives the credit limit measure, often at 95% or 99% confidence.

Credit valuation adjustment (CVA) is the market value of counterparty default risk; it rises with counterparty PD, exposure, and correlation between exposure and default.

Netting reduces exposure to max(sum of positive mark-to-market, 0) only under an enforceable close-out netting agreement; collateral reduces exposure further via threshold, MTA, and haircuts.

Wrong-way risk occurs when exposure increases as counterparty credit quality deteriorates; it requires specific limits, collateral terms, or capital add-ons.

Concentration risk is managed via single-name, sector, and country limits; large-exposure rules typically cap exposure to a single counterparty at a percentage of eligible capital.

Liquidity Coverage Ratio = high-quality liquid assets / net cash outflows over 30 days; the minimum is 100%, with HQLA split into Level 1, 2A, and 2B with haircuts and caps.

Net Stable Funding Ratio = available stable funding / required stable funding, minimum 100%; it penalizes short-term wholesale funding of long-dated or illiquid assets.

Liquidity mismatch is measured by cumulative cash-flow gaps by time bucket; a positive cumulative gap in every bucket through the survival horizon is the standard test.

Interest rate risk in the banking book: repricing gap = rate-sensitive assets minus rate-sensitive liabilities; ΔNII ≈ gap × Δrate, while EVE sensitivity captures long-run value effects.

Duration gap = asset duration - (liabilities/market value of assets) × liability duration; a positive duration gap means equity falls when rates rise.

Funding concentration is measured by the share of liabilities from the largest counterparties and by reliance on short-term wholesale and secured funding; diversification limits are set per source.

Contingency funding plan defines early-warning indicators, escalation roles, a menu of funding actions, and a liquidity buffer sized to survive a combined idiosyncratic and market stress.

Deposit stability analysis distinguishes insured, retail, operational, and non-operational wholesale deposits; stable funding weights rise with stickiness and insured status.

Operational risk is the risk of loss from inadequate or failed processes, people, systems, or external events; it excludes strategic and reputational risk in the Basel definition.

Loss-event taxonomy: internal fraud, external fraud, employment practices, clients/products/business practices, damage to physical assets, business disruption and system failures, execution/delivery/process management.

Model risk arises from inappropriate use, flawed design, incorrect implementation, or misuse of outputs; model inventory, tiering by materiality, independent validation, and ongoing monitoring are core controls.

Model validation covers conceptual soundness, data quality, implementation testing, outcomes analysis (backtesting, benchmarking), and assessment of limitations and compensating controls.

Three model-risk mitigations: documentation and approved-use statements, effective challenge by an independent party, and periodic revalidation triggered by material change or performance drift.

Compliance risk is managed through a regulatory obligation register, control mapping, monitoring and testing plans, and a regulatory change process with effective-date tracking.

Key control indicators and near-miss reporting supplement loss data; operational risk capital under the standardized approach is based on the business indicator component times a marginal coefficient.

Root-cause analysis after an incident should distinguish control design failure from control operating failure; only the latter is fixed by retraining alone.

Intraday liquidity is monitored against real-time gross settlement obligations; tools include opening balances, incoming payments, central bank facilities, and collateral pledged to the central bank.

Payment message standards: SWIFT MT (MT103 customer transfer, MT202 bank transfer) versus ISO 20022 (pacs.008, pacs.009, camt.053 statement); coexistence and translation mapping are operational risks.

Settlement conventions: T+1 or T+2 for securities, real-time gross settlement for large-value payments, and deferred net settlement for retail systems; failed settlements create replacement-cost and liquidity risk.

Reconciliation controls include three-way match (trade, confirmation, settlement), nostro/vostro account reconciliation, and unresolved-break aging with escalation thresholds.

Payment fraud controls: dual authorization, call-back verification on new payment instructions, beneficiary account validation, and segregation of payment initiation from release.

Collateral management: daily margin calls, eligibility criteria, haircuts, and substitution rights; a collateral inventory view across legal entities prevents over-pledging.

Cash management: target balances, notional pooling versus physical pooling, and sweep arrangements; cash forecasting accuracy is measured by variance between forecast and actual flows.

Straight-through processing rates and exception queues are the main operational KPIs for treasury; manual interventions are the leading source of payment errors.

Stress testing: scenario design (historical, hypothetical, reverse), shock calibration, transmission to P&L and capital, and a documented management action plan; reverse stress tests identify the loss that breaches viability.

Capital stack: Common Equity Tier 1, Additional Tier 1, and Tier 2; risk-weighted assets derive from credit, market, and operational risk; capital ratios = capital / RWA.

Buffers: capital conservation buffer, countercyclical buffer, and G-SIB/D-SIB surcharge stack on top of minimum requirements; breaching buffers restricts distributions.

Leverage ratio = Tier 1 capital / total exposure measure, typically a 3% minimum; it constrains balance-sheet expansion when risk weights are low.

Risk reporting principles: accuracy, completeness, timeliness, and traceability to source; a report should state as-of date, currency, scope, and data lineage.

Limit monitoring reports show utilization against limits with amber/red thresholds; breaches require documented remediation with owner and deadline.

Reconciliation between risk and finance numbers (P&L attribution, RWA variance) is a key control; unexplained variance must be investigated, not netted away.

ICAAP/ILAAP documentation links risk appetite to capital and liquidity adequacy, including stress results, concentrations, and the outcome of the board's challenge.