IFMP Risk Management Certification (RMC), Pakistan cheat sheet

Risk is the effect of uncertainty on objectives; it includes downside and upside outcomes, so ERM covers threats and opportunities.

Pure risk has only loss or no-loss outcomes; speculative risk has gain or loss outcomes. Financial trading and lending carry both.

The risk management process is iterative: identify, assess and measure, treat, monitor, report, and review against objectives and appetite.

Expected loss (credit) = PD x LGD x EAD; unexpected loss is covered by economic capital at a chosen confidence level.

Diversification reduces unsystematic (firm-specific) risk; systematic (market) risk remains and commands a risk premium.

Risk-adjusted performance measures include RAROC = risk-adjusted return / economic capital and economic profit = return - capital charge.

Risk horizon differs by type: market risk is intraday to days, credit risk months to years, liquidity risk immediate, operational risk ongoing.

Downside risk measures include VaR, expected shortfall, and stress loss; VaR ignores tail severity beyond the confidence threshold.

The board approves the risk appetite, ERM framework, and risk policies; senior management implements them within delegated authority.

Three lines model: first line owns risk, second line provides independent risk and compliance oversight, third line internal audit assures the board.

A board risk committee reviews material risks, limit breaches, stress results, and risk appetite; independent directors strengthen challenge.

The CRO leads an independent risk function with direct access to the board or its risk committee and no revenue accountability.

Segregation of duties separates risk-taking, risk control, settlement, and reconciliation functions to reduce conflicts and fraud.

Model validation is independent of model development; it reviews data, assumptions, methodology, outcomes, and limitations.

Escalation rules define who must be informed of breaches, by when, and what remediation authority applies.

Compensation design uses deferral, malus, and clawback to align risk-taking with long-term outcomes and discourage excessive risk.

An ERM framework links governance, strategy, risk appetite, processes, data, reporting, and assurance in one integrated cycle.

Risk capacity is the maximum risk the institution can bear; risk appetite is the risk it chooses to accept, and appetite is set below capacity.

The hierarchy is risk appetite, then risk tolerance, then risk limits, then triggers; each level is more specific and quantitative.

A risk appetite statement combines qualitative principles with quantitative metrics such as capital, liquidity, earnings volatility, and concentration.

Risk tolerances define acceptable variation around appetite; limits are hard boundaries that trigger escalation and remediation when breached.

A risk register records description, cause, owner, likelihood, impact, controls, residual rating, and action status.

Key risk indicators are forward-looking metrics with thresholds; key performance indicators measure business performance, not risk exposure.

New product, outsourcing, and model approval processes require risk assessment and sign-off before launch.

Market risk is loss from adverse movements in interest rates, FX, equities, commodities, and credit spreads in trading or balance-sheet positions.

Parametric VaR = z x portfolio volatility x portfolio value for the chosen horizon; it assumes normal returns and stable correlations.

Square-root-of-time scaling: sigma_T = sigma_1 x sqrt(T) only when returns are independent and identically distributed.

Duration approximation: percentage price change = -duration x yield change; convexity adds 0.5 x convexity x (yield change)^2.

DV01 is the change in position value for a one-basis-point parallel shift in yields; it aggregates exposure across maturities.

FX exposure is measured by net open position per currency; translation, transaction, and economic exposures differ in scope.

Option Greeks: delta measures underlying price sensitivity, gamma measures delta change, vega volatility sensitivity, theta time decay, rho rate sensitivity.

Expected shortfall is the average loss beyond VaR and is subadditive; market risk limits include notional, sensitivity, VaR, and stop-loss limits.

Credit risk is loss when a borrower or counterparty fails to meet contractual obligations, including late payment, default, or downgrade.

Expected loss = PD x LGD x EAD; LGD = 1 - recovery rate; expected loss is covered by pricing and provisions.

Unexpected credit loss is covered by economic capital at a target confidence level and by regulatory capital under Basel rules.

PD is estimated from ratings, scorecards, financial ratios, or market-based models such as Merton's structural model.

EAD includes drawn balances plus undrawn commitments x credit conversion factor; derivatives use current exposure plus potential future exposure.

Concentration risk arises from single-name, group, sector, or country exposures; limits and diversification reduce correlated default losses.

Credit risk mitigation includes collateral, guarantees, insurance, and credit derivatives; legal enforceability and wrong-way risk must be assessed.

IFRS 9 expected credit loss uses 12-month ECL in Stage 1 and lifetime ECL in Stages 2 and 3 after significant risk increase or impairment.

Operational risk is loss from inadequate or failed internal processes, people, systems, or external events; Basel excludes strategic and reputational risk.

Basel event types: internal fraud, external fraud, employment practices, clients and business practices, physical asset damage, system failures, and process execution.

Loss data collection includes internal losses, external losses, near misses, and scenario estimates; data feed capital, reporting, and control fixes.

RCSA identifies risks and controls, rates inherent and residual risk, and assigns owners and remediation actions.

Business impact analysis identifies critical processes, dependencies, RTOs, and RPOs for continuity and resilience planning.

Basel III replaced advanced operational risk approaches with a standardized approach based on a business indicator and internal loss multiplier.

Key operational controls include authorization, segregation, reconciliation, backup, access control, training, and insurance.

Outsourcing risk requires due diligence, service-level agreements, exit plans, concentration monitoring, and oversight of subcontractors.

Funding liquidity risk is the inability to meet cash obligations as due; market liquidity risk is the inability to trade assets without large price concessions.

LCR = high-quality liquid assets / net cash outflows over 30 days; Basel minimum is 100%, and inflows are capped at 75% of outflows.

NSFR = available stable funding / required stable funding over one year; Basel minimum is 100% to limit short-term funding reliance.

HQLA comprises Level 1 assets at no haircut and Level 2A and 2B assets with haircuts and caps; central bank eligibility matters.

Maturity laddering compares contractual and behavioural cash inflows and outflows across time buckets to identify gaps.

Liquidity stress tests cover idiosyncratic, market-wide, and combined scenarios, including deposit runs and wholesale funding loss.

Funding concentration indicators include reliance on short-term wholesale funding, single counterparties, and foreign currency funding.

A contingency funding plan sets triggers, available sources, responsibilities, and communication steps for liquidity stress.

VaR estimates the maximum loss at a confidence level over a horizon; it does not describe the size of losses beyond that threshold.

Parametric VaR assumes normal returns; historical VaR uses empirical returns; Monte Carlo VaR simulates paths from a model.

Expected shortfall = average loss conditional on loss exceeding VaR; it is coherent and captures tail severity.

VaR backtesting counts exceptions against actual losses; Basel traffic-light zones use 250 trading days and escalating capital penalties.

Stress testing applies deterministic severe scenarios; scenario analysis can be historical, hypothetical, or reverse stress testing.

Reverse stress testing starts from a failure outcome and identifies scenarios that could cause it, exposing hidden vulnerabilities.

Fat tails and volatility clustering violate normality; extreme value theory and filtered historical simulation model tail risk.

Correlation breakdown in stress can make diversification disappear; stress correlations should be set higher than normal-period estimates.

Basel III minimum capital: CET1 4.5%, Tier 1 6%, total capital 8% of risk-weighted assets, plus a 2.5% capital conservation buffer.

Basel III adds a leverage ratio and liquidity standards (LCR and NSFR) to constrain excessive leverage and funding fragility.

In Pakistan, the State Bank of Pakistan regulates banks and DFIs and issues Prudential Regulations; SECP regulates NBFIs and capital markets.

SBP implements Basel III for banks and supervises risk management, capital adequacy, liquidity, and AML/CFT compliance.

ICAAP requires a bank to assess material risks, stress capital, set internal targets, and document its capital adequacy to the supervisor.

Enterprise risk management integrates market, credit, operational, liquidity, strategic, and reputational risks into one appetite and reporting framework.

COSO ERM and ISO 31000 provide principles for governance, risk identification, assessment, treatment, monitoring, and communication.

Recovery and resolution planning prepares a firm for severe stress and orderly wind-down without taxpayer bailout.