Risk, uncertainty and risk management
Domain 3 tests risk identification, measurement, management and governance, and the distinction between risk and uncertainty.
Core concepts
- Risk is measurable variation with assessable probabilities; uncertainty covers outcomes that cannot be reliably quantified (parameter, model and process risk).
- Risk process: identify, assess, manage (avoid, reduce, transfer, retain) and monitor, within a board-set risk appetite and tolerance.
- Three lines of defence; the ORSA links risk profile to capital; stress, scenario and reverse stress testing probe tails beyond VaR.
- Diversification reduces capital only where risks are not perfectly correlated, and correlations tend to rise in stress.
Worked example
Two independent lines each have a £4m standard deviation of annual loss and symmetric distributions. At 99.5% the normal quantile is 2.576, so standalone capital is 2.576 × 4 = £10.3m each, £20.6m in total. If independent, combined standard deviation is 4 × √2 = £5.66m, giving capital of £14.6m. Diversification benefit is about £6.0m. If correlation were 1, capital would remain £20.6m, so the benefit is entirely assumption-dependent.
Traps
Treating VaR as the maximum loss; ignoring model and parameter risk behind a normal approximation; double-counting mitigants; assuming stress correlations equal normal correlations; omitting conduct and reputational risk from the register.