Foundations of Risk Management
What the exam tests
This domain checks whether you can classify risk and apply the risk management process, not just recite definitions. Questions typically ask you to distinguish pure from speculative risk, systematic from idiosyncratic risk, and financial from non-financial risk, then place a real exposure in the correct category.
Core rules and concepts
- Risk is the effect of uncertainty on objectives. It has downside and upside; uncertainty alone is not risk.
- Pure risk has loss or no-loss outcomes, such as fire or fraud. Speculative risk can produce profit or loss, such as trading or lending.
- Systematic risk cannot be diversified away; unsystematic risk can be reduced through diversification.
- The process is cyclical: identify, measure or assess, monitor, control or mitigate, report, and review. It is not a one-off checklist.
- Risk culture, appetite, and governance determine how the process operates in practice.
- Financial risks include market, credit, and liquidity risk; non-financial risks include operational, strategic, and reputational risk.
Worked example
Portfolio A has expected return 12% and standard deviation 8%. Portfolio B has expected return 18% and standard deviation 15%. The coefficient of variation is 0.67 for A (8/12) and 0.83 for B (15/18). A carries less risk per unit of expected return, so B is not automatically better simply because its return is higher. The choice depends on the investor’s risk appetite and return target; the calculation supports the decision but does not make it.
Traps that cost marks
Do not treat risk as only bad outcomes. Do not call diversifiable risk systematic. Do not use standard deviation as a complete measure when the distribution is skewed or the concern is one-sided downside. Do not confuse risk identification with risk measurement, or a control with the risk itself.