IAI SA7 study plan

Map every learning outcome in the SA7 (Enterprise Risk Management) syllabus to a numbered section of your own notes, flagging the outcomes you cannot yet explain in one sentence.

Distinguish in writing how an ERM framework differs from silo-based risk management, giving three concrete organisational consequences of each approach.

Build a governance map linking board, risk committee, audit committee, CRO and the three lines of defence, stating the reporting line and decision rights of each.

Draft a risk taxonomy for a general insurer covering financial, insurance, operational, strategic and emerging risk classes, with two example risks per class.

Write risk appetite statements for a fictional insurer covering growth, return, solvency and liquidity, each with a tolerance, a limit and an escalation trigger.

Construct a risk register of at least fifteen risks with owner, cause, event, consequence, inherent and residual likelihood/impact ratings, and one named control per risk.

Explain how risk appetite cascades from board statement to business-unit limits to individual underwriting or investment mandates, and where the cascade usually breaks.

Describe four observable indicators of risk culture and how a CRO could test each one without relying on staff surveys alone.

Compute and compare VaR, expected shortfall and probability of ruin for a simple two-asset portfolio, and articulate the practical limitations of each measure.

Explain the role of correlation, tail dependence and diversification benefit in aggregating risk, including why assuming normal distributions understates tail risk.

Design a stress-testing programme: at least six scenarios (historical, hypothetical, reverse stress test) with the portfolio variables shocked and the management action assumed.

Critique a capital model's main assumptions, identifying where parameter, model and dependency error would most distort the output.

Compare economic capital, regulatory capital and rating-agency capital, stating what each is designed to protect and where the three diverge.

Outline the structure and purpose of an ORSA and an ICAAP, listing the narrative sections a regulator would expect and the evidence each section needs.

Explain how capital is allocated to business units using at least two methods, and evaluate the behavioural incentives each method creates.

Summarise the prudential frameworks a risk specialist must know (risk-based solvency regimes, Basel-style bank capital, group supervision) at a level sufficient to answer a discussion question.

Quantify and interpret the main market risk exposures (interest rate, credit spread, equity, property, currency) for a life insurer and a general insurer, contrasting the two.

Evaluate hedging instruments and strategies for each market risk, naming the basis risk, counterparty risk and liquidity cost each introduces.

Explain credit risk sources in an insurer's asset portfolio and reinsurance recoverable, including default, migration and concentration risk.

Assess liquidity risk under both going-concern and stressed conditions, and describe how an insurer's liquidity profile differs from a bank's.

Break insurance risk into underwriting, reserving, catastrophe, lapse and concentration components, and state the data and models used to quantify each.

Build an operational risk taxonomy with key risk indicators, loss-event thresholds and a scenario-based capital assessment for three chosen events.

Design a model risk management process covering inventory, validation, documentation, change control and independent review of at least one model type.

Critique the role of reinsurance and alternative risk transfer as risk mitigation, identifying the residual risks that remain after the transaction.

Analyse four emerging or strategic risks (for example climate transition, cyber, pandemic, artificial intelligence) using a common framework of transmission channel, time horizon, measurability and capital implication.

Explain how conduct risk and reputational risk connect to ERM, and why they are poorly captured by conventional capital models.

Draft a board risk report of no more than two pages that prioritises exposures, states the appetite position and recommends three decisions.

Describe how a CRO should escalate a breach and what governance evidence a regulator would expect to see afterwards.

Synthesise all eight weeks into a one-page concept map linking framework, appetite, measurement, capital, risk classes and reporting.

Practise exam technique by writing three full answers under timed conditions, allocating time per mark and ending each answer with an evaluative conclusion.

Self-mark each timed answer against syllabus learning outcomes and convert every lost mark into a specific revision action.

Recite from memory the definitions, formulae and framework steps you are most likely to be asked to state directly.