IFMP Risk Management Certification (RMC), Pakistan common mistakes
IFMP Risk Management Certification (RMC), Pakistan · Understand the traps and how to avoid them.
Classifying every uncertainty as the same type of risk-for example, labelling a counterparty default as market risk or a system outage as credit risk-when answering classification questions.
Candidates memorize short definitions in isolation and never build a taxonomy that distinguishes sources of risk, so exam items that use unfamiliar examples trigger guessing.
What to do instead
Build a one-page taxonomy table with columns for risk type, source of loss, typical Pakistani banking/DFI example, and who owns it. Cover market, credit, operational, liquidity, strategic and reputational risk, then re-classify ten new examples daily until classification is automatic.
Describing board risk oversight only as 'the board approves the risk appetite' and failing to explain how the board, risk committee, CRO and three lines of defence interact in a specific decision.
Governance material is read as static org-chart facts; candidates do not practise tracing a decision, so they cannot answer application questions about escalation, challenge or independence.
What to do instead
Write a one-page decision map for two cases-a limit breach and a new product launch-showing who proposes, who challenges, who approves, what is escalated to the board risk committee, and where internal audit sits. Practise explaining the map aloud without notes.
Using risk appetite, risk tolerance, risk capacity and risk limits interchangeably in written answers, and stating an appetite as a vague phrase such as 'we are conservative' without a metric.
The terms sound similar and study notes often list them without showing the cascade from capacity to appetite to tolerance to limit, so candidates repeat loose language.
What to do instead
Memorize a four-level cascade: capacity is the maximum risk the institution can bear; appetite is the risk it chooses to take; tolerance is the acceptable variation around appetite; limits are measurable thresholds. Rewrite each appetite statement with a metric, threshold, escalation trigger and owner.
Reporting a 99% one-day VaR as 'the maximum loss the bank can suffer' or applying a square-root-of-time scaling to every horizon without checking return independence and volatility stability.
VaR is learned as a formula rather than a conditional statement; candidates drop the confidence level, horizon and model assumptions when explaining results, and scaling is applied mechanically.
What to do instead
Always write VaR as a full sentence: 'With 99% confidence, over a one-day horizon, losses are not expected to exceed PKR X under stated assumptions.' For horizon conversion, state the i.i.d. assumption, use square-root scaling only when justified, and show why fat tails or volatility clustering break it.
Calculating expected loss without separating PD, LGD and EAD, or mixing a point-in-time PD with a through-the-cycle LGD and then treating the result as a regulatory capital number.
The three drivers are often memorized as a formula but not as distinct estimates with different uses; candidates also miss that collateral affects LGD and that wrong-way risk changes the joint behaviour of PD and LGD.
What to do instead
Practise ten expected-loss calculations where each input is varied separately and label whether each input is PIT or TTC. For each case, state the effect of collateral, guarantees and wrong-way risk. Keep regulatory capital, economic capital and expected loss on separate lines of a comparison sheet.
Treating operational risk as fraud and human error only, and mislabelling a trading loss caused by a failed control as market risk because the position was a market position.
Candidates classify by the instrument or desk involved rather than by the underlying cause of loss, and they ignore near misses and control failures that produced no loss.
What to do instead
Classify by root cause, not by product: use standard event categories such as internal process failure, external event, systems failure, people and legal/regulatory breach. For twenty incidents, record cause, event type, near-miss status and whether a market or credit exposure merely revealed an operational control failure.
Confusing liquidity risk with insolvency and assessing a bank's liquidity only from its balance-sheet size or capital ratio rather than from contractual and behavioural cash-flow gaps, including contingent outflows.
Liquidity is studied as a definition rather than as a cash-flow discipline; candidates forget that a solvent bank can fail from funding stress and that market liquidity and funding liquidity interact.
What to do instead
Build a simple seven-day and one-month cash-flow ladder with inflows, outflows, committed facilities and contingent outflows under a stress case. Distinguish funding liquidity from market liquidity and explain how a fire sale of assets can transmit stress between them.
Presenting VaR as a complete risk measure and omitting stress testing, scenario analysis, backtesting results and expected shortfall when asked how risk should be measured and reported.
VaR is the most rehearsed technique, so candidates default to it and do not practise combining measures or explaining what VaR misses beyond its threshold.
What to do instead
Create a measurement matrix listing each technique, the question it answers, its key limitation and how it complements the others. For each risk type, write a two-sentence answer that pairs a statistical measure with a stress or scenario measure and states the backtesting or validation evidence required.
Quoting international capital or liquidity ratios as if they apply unchanged in Pakistan, without checking the local prudential regulator's implementing requirements, reporting deadlines or transitional arrangements.
Candidates study global frameworks first and treat local rules as an afterthought, so they miss jurisdiction-specific adjustments, approval processes and effective dates.
What to do instead
Maintain a two-column regulatory map: international standard requirement on the left, local implementing requirement on the right, with the responsible authority, effective date and reporting form. For each ratio or limit, note where local rules are stricter and which internal approvals are required.
Describing enterprise risk management as a software system or a annual risk register exercise, and failing to show how risks are aggregated, correlated and linked to strategy, capital allocation and performance.
Candidates memorize ERM components as a checklist and never practise the aggregation step, so answers stay siloed and cannot address portfolio effects or risk-adjusted performance.
What to do instead
Draft a one-page ERM architecture linking strategy, risk appetite, risk identification, measurement, aggregation, reporting and capital allocation. For a simple two-risk portfolio, show how correlation changes aggregate risk and explain how the result would alter a limit or capital decision.