AICB Bank Risk Practices (BKR, Malaysia) common mistakes
AICB Bank Risk Practices (BKR, Malaysia) · Understand the traps and how to avoid them.
Treating the three lines of defence as interchangeable, so the candidate answers that the internal audit function 'owns' or 'manages' a risk (e.g., credit approval, market limit monitoring) rather than providing independent assurance over it.
The model is often memorised as a list of functions without the accountability distinction. Candidates conflate 'oversight' with 'ownership' and forget that the first line owns and manages risk, the second line sets frameworks and challenges, and the third line gives independent assurance to the board/audit committee.
What to do instead
Before answering, assign the activity to a line: does it execute the transaction or process (first line), design/monitor the framework and limits (second line), or independently assure (third line)? Practise classifying 20 typical activities (limit setting, KYC onboarding, model validation, internal audit, risk appetite drafting, stress testing execution) and check your mapping against the accountability principle.
Confusing the board's risk appetite statement with the risk management framework or with operational limits, and selecting 'the board sets individual credit limits' or 'management approves the risk appetite' as correct.
Risk appetite, risk capacity, risk tolerance and limits are taught as a hierarchy but candidates collapse them. They also mix up who approves what: the board approves appetite and framework, management translates appetite into limits and policies.
What to do instead
Learn the hierarchy explicitly: risk capacity (maximum risk the bank can bear given capital/liquidity) → risk appetite (board-approved statement of willingness to take risk) → tolerances/thresholds → operational limits delegated to management. For each layer, note the approving body. Test yourself by asking 'who approves this and at what level of the hierarchy?' for each item.
Applying the standardised approach risk weights or the wrong exposure classification under the Basel/BNM capital framework - for example using a flat corporate weight for an SME retail exposure, or treating a residential mortgage as unsecured retail.
Candidates memorise a few headline risk weights but not the qualifying criteria (e.g., retail regulatory retail portfolio thresholds, SME classification, loan-to-value dependence for mortgages). They also overlook that BNM's capital framework is Basel-based with local calibrations, so generic Basel numbers may not match the Malaysian rulebook.
What to do instead
Build a one-page table of exposure classes with the qualifying criteria and the applicable risk weight, and mark the LTV bands for secured residential and commercial property. Whenever a question gives an exposure, first classify it against the criteria, then apply the weight. Rehearse with the BNM capital adequacy framework documents rather than third-party summaries.
Calculating credit risk mitigation as if the whole exposure is covered by collateral, ignoring haircuts, maturity mismatch, currency mismatch and the requirement that the collateral be legally enforceable and promptly realisable.
Candidates learn 'secured = lower risk weight' and skip the conditions. The exam tests the eligibility criteria and the adjustments, so a simplistic subtraction of collateral value from exposure produces the wrong capital or expected-loss figure.
What to do instead
For any CRM question, run a checklist: is the collateral eligible under the approach used, is it legally enforceable in the relevant jurisdiction, are haircuts applied, do the exposure and collateral maturities align, and is there currency mismatch? Only then compute the covered and uncovered portions separately.
Mixing up the market risk measures - reporting VaR as a worst-case loss, treating expected shortfall as identical to VaR, or forgetting that VaR is silent on the size of losses beyond the confidence level.
VaR, expected shortfall, sensitivity measures (PV01, delta, duration) and stress testing are often revised as a single 'market risk' block. Candidates lose the specific definitions and the limitations the exam likes to test (tail risk, non-subadditivity, model dependence, horizon and confidence-level assumptions).
What to do instead
Write a comparison table: definition, what it captures, what it misses, typical parameters (e.g., 1-day or 10-day horizon, 99% confidence), and regulatory use. Add a sentence on why expected shortfall addresses VaR's tail blindness. Then practise interpreting a stated VaR figure precisely: 'a loss of X or more on 1 day in 100, under normal market conditions'.
Treating operational risk as only 'people and process' errors and omitting external events, systems failures, legal risk and the distinction between expected losses and tail events, or misclassifying a conduct/litigation event as credit risk.
The Basel event-type taxonomy (internal fraud, external fraud, employment practices, clients/products/business practices, damage to physical assets, business disruption and system failures, execution/delivery/process management) is often skimmed. Candidates default to 'human error' and miss the taxonomy-driven answer.
What to do instead
Memorise the seven event types with one concrete Malaysian banking example each. When an event appears in a question, classify it against the taxonomy before choosing an answer, and check whether the question is about the event type, the control failure, or the capital treatment - these lead to different correct answers.
Confusing the liquidity coverage ratio with the net stable funding ratio - applying a 30-day stress horizon to the NSFR, or treating both as short-term ratios - and ignoring the quality of high-quality liquid assets.
Both are Basel III liquidity standards and are revised together. Candidates remember 'LCR 100%' and 'NSFR 100%' but not that LCR is a 30-calendar-day stress measure of HQLA against net cash outflows, while NSFR is a one-year structural funding measure of available stable funding against required stable funding.
What to do instead
Anchor each ratio to its question: 'can the bank survive a 30-day stress?' (LCR) versus 'is the funding structure stable over one year?' (NSFR). Learn the HQLA tiers and the haircuts, and the ASF/RSF weightings for deposits and loans. Practise classifying balance-sheet items into HQLA, ASF or RSF.
Answering compliance questions by naming the wrong Malaysian regulator or the wrong instrument - for example attributing prudential capital rules to the Securities Commission, or citing the wrong Act for a conduct or AML obligation.
Malaysia has a multi-regulator landscape (BNM, Securities Commission, Labuan FSA, and the relevant ministries) and a layered rulebook of Acts, guidelines and policy documents. Candidates learn generic 'regulator' answers and do not map each obligation to its source.
What to do instead
Build a regulator-to-mandate map: BNM for banking prudential, payments and AML/CFT; Securities Commission for capital markets and fund management; Labuan FSA for Labuan entities. For each major obligation (capital adequacy, liquidity, AML/CFT reporting, conduct, outsourcing, technology risk), note the issuing body and the instrument name. Verify names against the regulator's own published list.
Treating stress testing as a single 'worst-case scenario' exercise and missing the requirement for multiple, internally consistent scenarios, reverse stress testing, and linkage of results to capital planning and risk appetite.
Candidates reduce stress testing to 'apply a severe recession and see if capital holds'. The exam tests the governance and use-test dimensions: scenario design, severity calibration, reverse stress testing to the point of business-model failure, and how results feed the ICAAP and capital buffer decisions.
What to do instead
Learn stress testing as a cycle: identify risks and choose scenarios (historical, hypothetical, reverse) → calibrate severity → project P&L, balance sheet and capital → compare against risk appetite and buffers → take management action → report to the board. Be able to explain what reverse stress testing adds and why 'use test' matters to the regulator.
Reading risk reports as isolated numbers - concluding a portfolio is fine because the average metric is within limit, while ignoring concentration, migration, vintage and the difference between regulatory and economic capital.
Candidates focus on the headline ratio and miss the interpretive layer the reporting domain tests: trends, limit utilisation, breaches and their escalation, data quality, and the distinction between regulatory capital (formula-driven, minimum requirements) and economic capital (internally modelled, risk-based).
What to do instead
For any reporting question, ask three things: what is the trend, where is the concentration or migration, and what action does the breach or limit utilisation trigger? Separately, write a short comparison of regulatory versus economic capital - purpose, calculation basis, and use in decision-making - and practise interpreting a small table of exposures by segment and vintage rather than a single aggregate.