IOB LBO common mistakes
IOB LBO · Understand the traps and how to avoid them.
Treating 'suitability' as a single yes/no test and approving a wealth advice recommendation without documenting the client's risk tolerance, time horizon, and capacity for loss as separate inputs.
Candidates memorise the phrase 'know your customer' and conflate attitude to risk with ability to bear loss, so they skip the capacity-for-loss assessment that drives the recommendation.
What to do instead
For every advice scenario, write out four distinct lines: attitude to risk (questionnaire result), capacity for loss (financial facts), time horizon, and objective. Then state explicitly whether the product fits all four, and flag any mismatch as a suitability failure even if the client insists.
Applying the wrong capital treatment to a lending exposure, e.g. using the standardised approach risk weight when the scenario describes an internal-ratings-based (IRB) bank, or ignoring credit risk mitigation when collateral is described.
Candidates learn risk weights as a table to recall rather than as a function of approach, exposure class, and mitigation, so they default to the first number they remember.
What to do instead
Before calculating, state three things in writing: which approach the bank uses, the exposure class, and whether eligible collateral or guarantees apply. Only then select the risk weight, and show the mitigation step separately so partial credit is visible.
Describing AI governance as 'the model must be explainable' without naming the specific controls: model inventory and ownership, validation independence, data lineage, bias testing, ongoing monitoring, and human override.
Candidates read high-level AI principles and reproduce the headline, but exam questions ask which control addresses which risk, and generic answers score poorly.
What to do instead
Build a one-page control map linking each AI risk (bias, drift, hallucination, opacity, third-party dependency) to a named control and an accountable function. Practise stating the control, its evidence artefact, and its review frequency.
Confusing operational risk events with conduct risk events, and mis-classifying a mis-selling or market-abuse case as an operational loss with no regulatory consequence.
Both appear in the same incident logs and both produce losses, so candidates stop at the financial impact and miss the customer-harm and regulatory-reporting dimension.
What to do instead
For each scenario, ask two separate questions: was there a process or system failure (operational), and was there a breach of expected market or customer conduct (conduct)? Record both where they apply, and add the reporting obligation (internal escalation, regulator notification, client remediation).
Treating ESG as reputation and marketing, so answers on ESG integration omit double materiality, taxonomy alignment, and the difference between screening, integration, and engagement as investment approaches.
Candidates absorb ESG communications from asset managers rather than the regulatory and investment framework, so they cannot distinguish an exclusion screen from a best-in-class selection or a stewardship activity.
What to do instead
Learn the four approaches as separate definitions with a one-line example each (negative screening, norms-based screening, ESG integration, active ownership/engagement). Separately, state financial materiality versus impact materiality and where taxonomy alignment is reported.
Answering fund and asset management questions on liquidity and valuation without distinguishing dealing frequency, notice periods, swing pricing, and gate provisions, and without saying who bears dilution.
Candidates treat 'liquidity management' as one concept and cannot map the tool to the fund type or the investor outcome.
What to do instead
Create a table of liquidity tools against fund type (daily-dealing UCITS-style fund versus less liquid alternative fund), stating the trigger, the mechanism, and who bears the cost. Practise explaining swing pricing in two sentences with the dilution direction made explicit.
Giving a digital transformation answer that lists technologies (cloud, APIs, blockchain, generative AI) without linking each to a customer outcome, a process change, and a control or risk it introduces.
Buzzword recall is easy and feels like coverage, but the exam rewards the ability to connect a technology to a business case and its governance consequences.
What to do instead
Use a fixed three-part structure for every technology mentioned: the customer or operational problem it solves, the measurable benefit, and the new risk or control required. If you cannot supply all three, drop the technology from the answer.
Ignoring the retail banking customer-journey and vulnerability dimension, e.g. answering a complaints or arrears question purely on process steps without addressing vulnerable customers, forbearance options, and fair treatment outcomes.
Candidates focus on procedural compliance and forget that retail questions often test outcomes for the customer, including those in financial difficulty.
What to do instead
For any retail scenario, add a short paragraph on customer circumstances: identification of vulnerability, appropriate forbearance or communication adjustments, and the fair-treatment outcome. Name the escalation route and the record kept.
Confusing credit risk with counterparty credit risk and settlement risk, and therefore missing wrong-way risk and the need for collateral and netting in derivatives exposures.
All three involve a counterparty failing to pay, so candidates apply a single lending framework and miss pre-settlement versus settlement timing and exposure correlation.
What to do instead
Draw a timeline of a derivative trade: pre-settlement exposure (mark-to-market plus potential future exposure), settlement exposure, and the collateral and netting arrangements at each stage. Then test wrong-way risk by asking whether collateral value correlates with counterparty default.
Presenting risk management as a list of frameworks (three lines of defence, risk appetite statement, ICAAP) without stating how they operate in practice: who owns the risk, what the limit is, what triggers escalation, and what evidence exists.
Framework names are memorable and appear comprehensive, but scenario questions test the operating detail and the accountability line.
What to do instead
For each framework, write one sentence naming the first-line owner, the second-line oversight, the governing committee, and the escalation trigger. Rehearse a short worked example, such as a limit breach, showing detection, escalation, remediation, and board reporting.