IFoA SP9 common mistakes
IFoA SP9 · Understand the traps and how to avoid them.
Describing an ERM framework by listing generic components (COSO, ISO 31000, three lines of defence) and never mapping them to the named board, committee, executive or business-unit roles in the scenario.
Candidates memorise framework diagrams and reproduce them under time pressure, treating the question as a recall test rather than a board-level design question.
What to do instead
Before writing, identify the entity's decision-makers and committees from the scenario. For each framework element, state who owns it, what artefact evidences it (terms of reference, risk policy, escalation route) and how it changes a specific decision.
Producing a risk list that mixes causes, events and consequences, so entries read like 'cyber attack due to poor training leads to loss' without separating the three elements.
Brainstorming is done free-form under time pressure, and candidates do not apply a taxonomy or risk-statement convention consistently.
What to do instead
Use a cause-event-impact format for every entry, then test coverage against categories such as strategic, operational, financial, insurance, conduct and emerging. Assign an owner and a trigger indicator to each material entry.
Populating a risk register with likelihood/impact scores but no scoring rationale, no control effectiveness assessment and no residual-risk view.
Candidates treat the register as a list to be completed rather than a decision tool, and skip the link between controls, inherent risk and residual risk.
What to do instead
For each top risk, show inherent score, named controls with assessed effectiveness, residual score, rationale for the movement, and the owner who accepts the residual position. State how often the register is refreshed.
Presenting a VaR, Monte Carlo or scenario output as a single number without stating assumptions, parameter uncertainty, data limitations, validation or backtesting.
Candidates equate producing a model output with answering the modelling question, and model risk is treated as an afterthought rather than a core ERM issue.
What to do instead
Accompany every output with key assumptions, sources of parameter and model risk, sensitivity or stress results, validation and backtesting evidence, and an explicit statement of how the number informs a decision or limit.
Writing that risk appetite is 'the level of risk the firm is willing to accept' and then quoting a single tolerance figure, without distinguishing appetite, tolerance, limit, target and escalation trigger.
These terms are often used loosely in practice, and candidates collapse them into one definition rather than showing how they cascade through the organisation.
What to do instead
Separate the appetite statement (qualitative direction), tolerance (acceptable range), limit (hard boundary), target (desired operating point) and escalation trigger. For one risk type, show the metric, threshold, owner, escalation route and the risk-reward trade-off being made.
Responding to a culture or conduct question with 'the firm should improve its risk culture' and no specific levers, indicators, accountability or behavioural evidence.
Culture feels subjective and candidates are unsure how to operationalise it, so they retreat to generic exhortation rather than using culture drivers and measurable indicators.
What to do instead
Use explicit levers such as tone at the top, incentive design, speak-up channels, training, breach handling and performance management. Propose measurable indicators (near-miss reporting rates, repeat breaches, survey results, escalation speed) and name the accountable executive and board committee.
Writing a risk report as a comprehensive data dump, with no audience-specific message, no forward-looking view and no decisions requested from the reader.
Candidates focus on demonstrating technical knowledge rather than communication, and do not consider the board or regulator as the primary audience with limited time.
What to do instead
Structure the report around the audience: top risks and movements, emerging issues, limit breaches, forward-looking scenarios, and explicit 'decisions required' or 'for noting' sections. Cut detail that does not change a decision and state the key message in one sentence at the top.
Calculating regulatory capital only and treating that as capital management, without discussing economic capital, diversification benefit, capital allocation to business units or the link to risk appetite.
Candidates default to formula recall and regulatory solvency, which are easier to reproduce than the judgement-based allocation and ORSA-style narrative.
What to do instead
Compare regulatory and economic capital, explain diversification benefit and its limits, describe an allocation method (standalone versus marginal), and link the result to risk appetite, pricing and business-unit performance.
Listing emerging risks such as AI, climate change or geopolitical fragmentation generically, without assessing the firm's specific exposure, time horizon, materiality or response options.
Candidates rely on recent headlines and generic reading, and do not translate an emerging theme into a firm-specific exposure or trigger indicator.
What to do instead
For each emerging risk, state the firm-specific transmission channel, the time horizon, a materiality assessment under plausible scenarios, leading indicators to monitor, and response options (avoid, reduce, transfer, accept, exploit). Assign ownership and review frequency.
Ending an answer with recommendations that have no owner, timeline, cost, KPI or reporting route, so the recommendations are not embedded in governance or decision-making.
Candidates treat the recommendation as the end of the analysis and run out of time before describing implementation and monitoring.
What to do instead
Convert each recommendation into an action with a named owner, deadline, resource or cost estimate, success KPI, reporting line and review point. Show how the action changes a specific decision, such as capital allocation, product approval or limit setting.