Book 1: Foundations of Risk Management

SchweserNotes™ 2024

FRM Part I

SCHWESERNOTESTM 2024 FRM® PART I BOOK 1: FOUNDATIONS OF RISK MANAGEMENT

©2024 Kaplan, Inc. All rights reserved. Published in 2024 by Kaplan, Inc.

ISBN: 978-1-0788-4239-6

Required Disclaimer: GARP® does not endorse, promote, review, or warrant the accuracy of the products or services offered by Kaplan Schweser of FRM® related information, nor does it endorse any pass rates claimed by the provider. Further, GARP® is not responsible for any fees or costs paid by the user to Kaplan Schweser, nor is GARP® responsible for any fees or costs of any person or entity providing any services to Kaplan Schweser. FRM®, GARP®, and Global Association of Risk ProfessionalsTM are

trademarks owned by the Global Association of Risk Professionals, Inc.

These materials may not be copied without written permission from the author. The unauthorized duplication of these notes is a violation of global copyright laws. Your assistance in pursuing potential violators of this law is greatly appreciated.

Disclaimer: The SchweserNotes should be used in conjunction with the original readings as set forth by GARP®. The information contained in these books is based on the original readings and is believed to be accurate.

However, their accuracy cannot be guaranteed nor is any warranty conveyed as to your ultimate exam success.

WELCOME TO THE 2024 SCHWESERNOTES™

Thank you for trusting Kaplan Schweser to help you reach your career and educational goals. We are very pleased to be able to help you prepare for the FRM Part I exam. In this introduction, I want to explain the resources included with the SchweserNotes, suggest how you can best use Kaplan Schweser materials to prepare for the exam, and direct you toward other educational resources you will find helpful as you study for the exam.

SchweserNotes™

The SchweserNotes consist of four volumes that include complete coverage of all FRM assigned readings and learning objectives as well as module quizzes (multiple-choice questions for every reading) to help you master the material and check your retention of key concepts.

Practice Questions

To retain the material, it is important to quiz yourself often. We offer an online version of the SchweserPro™ QBank, which contains hundreds of Part I practice questions and explanations. We also offer Topic Quizzes and Checkpoint Exams online to further help you retain and apply what you have learned.

Mock Exams

Schweser offers four full 4-hour, 100-question practice exams. These online exams are important tools for gaining the speed and skills you will need to pass the exam. The Mock Exams contain answers with full explanations for self-grading and evaluation.

OnDemand Class

Our OnDemand Class provides comprehensive online instruction of every reading in the FRM curriculum. This video lecture series brings the personal attention of a classroom into your home or office with over 30 hours of instruction. The class offers in-depth coverage of difficult concepts as well as a discussion of sample exam questions. All videos are available for viewing at any time throughout the season.

Candidates enrolled in the OnDemand Class also have the ability to email questions to the instructor at any time.

Late-Season Review

Late-season review and exam practice can make all the difference. Our OnDemand Review Package helps you evaluate your exam readiness with products specifically designed for late-season studying. This study package includes the OnDemand Review

(8-hour archived online workshop covering essential curriculum topics) and Schweser’s Secret Sauce® (concise summary of the FRM curriculum).

Part I Exam Weightings

When preparing for the exam, be familiar with the weights assigned to each topic area within the curriculum. The Part I exam weights and questions are as follows:

How to Succeed

The FRM Part I exam is a formidable challenge (covering 62 assigned readings and almost 500 learning objectives), so you must devote considerable time and effort to be properly prepared. There are no shortcuts! You must learn the material, know the terminology and techniques, understand the concepts, and be able to answer 100 multiple-choice questions quickly and (at least 70%) correctly. A good estimate of the study time required is 275 hours on average, but some candidates will need more or less time, depending on their individual backgrounds and experience.

Expect the Global Association of Risk Professionals (GARP) to test your knowledge in a way that will reveal how well you know the Part I curriculum. You should begin studying early and stick to your study plan. You should first read the SchweserNotes and complete the practice questions for each reading. After completing each book, you should answer the provided topic quiz questions to understand how concepts may be tested on the exam.

It is recommended that you finish your initial study of the entire curriculum at least two weeks (earlier if possible) prior to your exam window to allow sufficient time for practice and targeted review. During this period, you should take all of your Schweser Mock Exams. This final review period is when you will get a clear indication of how effective your study efforts have been and which readings require significant additional review. Answering exam-like questions across all readings and working on your exam time management skills will be important determinants of your success on exam day.

Best regards,

Eric Smith, CFA, FRM, FDP Director, Advanced Designations Kaplan Schweser

CONTENTS

Readings and Learning Objectives

STUDY SESSION 1—Risk Management Overview

READING 1

The Building Blocks of Risk Management

Exam Focus

Module 1.1: Introduction to Risk Management Module 1.2: Types of Risk

Key Concepts

Answer Key for Module Quizzes

READING 2

How Do Firms Manage Financial Risk?

Exam Focus

Module 2.1: Corporate Risk Management

Module 2.2: Risk Management Methods and Instruments Key Concepts

Answer Key for Module Quizzes

READING 3

The Governance of Risk Management

Exam Focus

Module 3.1: Corporate Governance and Risk Management Module 3.2: Risk Governance Implementation

Key Concepts

Answer Key for Module Quizzes

READING 4

Credit Risk Transfer Mechanisms

Exam Focus

Module 4.1: Credit Risk Transfer Key Concepts

Answer Key for Module Quizzes

STUDY SESSION 2—Pricing Models and Enterprise Risk Management

READING 5

Modern Portfolio Theory and the Capital Asset Pricing Model

Exam Focus

Module 5.1: Modern Portfolio Theory and the Capital Market Line Module 5.2: Deriving and Applying the Capital Asset Pricing Model Module 5.3: Performance Evaluation Measures

Key Concepts

Answer Key for Module Quizzes

READING 6

The Arbitrage Pricing Theory and Multifactor Models of Risk and Return

Exam Focus

Module 6.1: Multifactor Model Assumptions and Inputs Module 6.2: Applying Multifactor Models

Key Concepts

Answer Key for Module Quizzes

READING 7

Principles for Effective Data Aggregation and Risk Reporting

Exam Focus

Module 7.1: Data Quality, Governance, and Infrastructure Module 7.2: Risk Data Aggregation and Reporting Capabilities Key Concepts

Answer Key for Module Quizzes

READING 8

Enterprise Risk Management and Future Trends

Exam Focus

Module 8.1: Enterprise Risk Management Module 8.2: Risk Culture and Scenario Analysis Key Concepts

Answer Key for Module Quizzes

STUDY SESSION 3—Case Studies and Code of Conduct                          

READING 9

Learning from Financial Disasters

Exam Focus

Module 9.1: Case Studies on Interest Rate Risk, Liquidity Risk, and Hedging Strategy

Module 9.2: Case Studies on Model Risk and Rogue Trading

Module 9.3: Case Studies on Financial Engineering, Reputation Risk, Corporate Governance, and Cyber Risk

Key Concepts

Answer Key for Module Quizzes

READING 10

Anatomy of the Great Financial Crisis of 2007–2009

Exam Focus

Module 10.1: The Global Financial Crisis Key Concepts

Answer Key for Module Quizzes

READING 11

GARP Code of Conduct

Exam Focus

Module 11.1: GARP Code of Conduct Answer Key for Module Quizzes

Formulas Index

Readings and Learning Objectives

STUDY SESSION 1

1.The Building Blocks of Risk Management

Global Association of Risk Professionals. Foundations of Risk Management. New York, NY: Pearson, 2023. Chapter 1.

After completing this reading, you should be able to:

1. explain the concept of risk and compare risk management with risk taking.
   1. evaluate, compare, and apply tools and procedures used to measure and manage risk, including quantitative measures, qualitative risk assessment techniques, and enterprise risk management.
   1. distinguish between expected loss and unexpected loss and provide examples of each.
   1. interpret the relationship between risk and reward and explain how conflicts of interest can impact risk management.
   1. describe and differentiate between the key classes of risks, explain how each type of risk can arise, and assess the potential impact of each type of risk on an organization.
   1. explain how risk factors can interact with each other and describe challenges in aggregating risk exposures.

2.How Do Firms Manage Financial Risk?

Global Association of Risk Professionals. Foundations of Risk Management. New York, NY: Pearson, 2023. Chapter 2.

After completing this reading, you should be able to:

1. compare different strategies a firm can use to manage its risk exposures and explain situations in which a firm would want to use each strategy.
   1. explain the relationship between risk appetite and a firm’s risk management decisions.
   1. evaluate some advantages and disadvantages of hedging risk exposures and explain challenges that can arise when implementing a hedging strategy.
   1. apply appropriate methods to hedge operational and financial risks, including pricing, foreign currency, and interest rate risk.
   1. assess the impact of risk management tools and instruments, including risk limits and derivatives.

3.The Governance of Risk Management

Global Association of Risk Professionals. Foundations of Risk Management. New York, NY: Pearson, 2023. Chapter 3.

After completing this reading, you should be able to:

1. explain changes in regulations and corporate risk governance that occurred as a result of the 2007-2009 financial crisis.
   1. describe best practices for the governance of a firm’s risk management processes.
   1. explain the risk management role and responsibilities of a firm’s board of directors.
   1. evaluate the relationship between a firm’s risk appetite and its business strategy, including the role of incentives.
   1. illustrate the interdependence of functional units within a firm as it relates to risk management.
   1. assess the role and responsibilities of a firm’s audit committee.

4.Credit Risk Transfer Mechanisms

Global Association of Risk Professionals. Foundations of Risk Management. New York, NY: Pearson, 2023. Chapter 4.

After completing this reading, you should be able to:

1. compare different types of credit derivatives, explain their applications, and describe their advantages.

• explain different traditional approaches or mechanisms that firms can use to help mitigate credit risk.
  • evaluate the role of credit derivatives in the 2007-2009 financial crisis and explain changes in the credit derivative market that occurred as a result of the crisis.
  • explain the process of securitization, describe a special purpose vehicle (SPV), and assess the risk of different business models that banks can use for securitized products.

STUDY SESSION 2

• Modern Portfolio Theory and the Capital Asset Pricing Model

Global Association of Risk Professionals. Foundations of Risk Management. New York, NY: Pearson, 2023. Chapter 5.

After completing this reading, you should be able to:

1. explain Modern Portfolio Theory and interpret the Markowitz efficient frontier.
   1. understand the derivation and components of the CAPM.
   1. describe the assumptions underlying the CAPM.
   1. interpret and compare the capital market line and the security market line.
   1. apply the CAPM in calculating the expected return on an asset.
   1. interpret beta and calculate the beta of a single asset or portfolio.
   1. calculate, compare, and interpret the following performance measures: the Sharpe performance index, the Treynor performance index, the Jensen performance index, the tracking error,

information ratio, and Sortino ratio.

• The Arbitrage Pricing Theory and Multifactor Models of Risk and Return

Global Association of Risk Professionals. Foundations of Risk Management. New York, NY: Pearson, 2023. Chapter 6.

After completing this reading, you should be able to:

1. explain the Arbitrage Pricing Theory (APT), describe its assumptions, and compare the APT to the CAPM.
   1. describe the inputs, including factor betas, to a multifactor model and explain the challenges of using multifactor models in hedging.
   1. calculate the expected return of an asset using a single-factor and a multifactor model.
   1. explain how to construct a portfolio to hedge exposure to multiple factors.
   1. describe and apply the Fama-French three-factor model in estimating asset returns.
2. Principles for Effective Data Aggregation and Risk Reporting

Global Association of Risk Professionals. Foundations of Risk Management. New York, NY: Pearson, 2023. Chapter 7.

After completing this reading, you should be able to:

1. explain the potential benefits of having effective risk data aggregation and reporting.
   1. explain challenges to the implementation of a strong risk data aggregation and reporting process and the potential impacts of using poor-quality data.
   1. describe key governance principles related to risk data aggregation and risk reporting.
   1. describe characteristics of effective data architecture, IT infrastructure, and risk-reporting practices.
2. Enterprise Risk Management and Future Trends

Global Association of Risk Professionals. Foundations of Risk Management. New York, NY: Pearson, 2023. Chapter 8.

After completing this reading, you should be able to:

1. describe Enterprise Risk Management (ERM) and compare an ERM program with a traditional silo-based risk management program.
   1. describe the motivations for a firm to adopt an ERM initiative.
   1. explain best practices for the governance and implementation of an ERM program.
   1. describe risk culture, explain the characteristics of a strong corporate risk culture, and describe challenges to the establishment of a strong risk culture at a firm.

• explain the role of scenario analysis in the implementation of an ERM program and describe its advantages and disadvantages.
  • explain the use of scenario analysis in stress testing programs and capital planning.

STUDY SESSION 3

• Learning from Financial Disasters

Global Association of Risk Professionals. Foundations of Risk Management. New York, NY: Pearson, 2023. Chapter 9.

After completing this reading, you should be able to:

1. analyze the following factors that contributed to the given case studies of financial disasters and examine the key lessons learned from these case studies:

  Interest rate risk, including the 1980s savings and loan crisis in the US.

 Funding liquidity risk, including Lehman Brothers, Continental Illinois, and Northern Rock.  Constructing and implementing a hedging strategy, including the Metallgesellschaft case.

 Model risk, including the Niederhoffer case, Long Term Capital Management, and the London Whale case.

  Rogue trading and misleading reporting, including the Barings case.

 Financial engineering, including Bankers Trust, the Orange County case, and Sachsen Landesbank.

 Reputation risk, including the Volkswagen case.  Corporate governance, including the Enron case.  Cyber risk, including the SWIFT case.

1. Anatomy of the Great Financial Crisis of 2007–2009

Global Association of Risk Professionals. Foundations of Risk Management. New York, NY: Pearson, 2023. Chapter 10.

After completing this reading, you should be able to:

1. describe the historical background and provide an overview of the 2007–2009 financial crisis.
   1. describe the build-up to the financial crisis and the factors that played an important role.
   1. explain the role of subprime mortgages and collateralized debt obligations (CDOs) in the crisis.
   1. compare the roles of different types of institutions in the financial crisis, including banks, financial intermediaries, mortgage brokers and lenders, and rating agencies.
   1. describe trends in the short-term wholesale funding markets that contributed to the financial crisis, including their impact on systemic risk.
   1. describe responses made by central banks in response to the crisis.
2. GARP Code of Conduct

Global Association of Risk Professionals. Foundations of Risk Management. New York, NY: Pearson, 2023. Chapter 11.

After completing this reading, you should be able to:

1. describe the responsibility of each GARP Member with respect to professional integrity, ethical

conduct, conflicts of interest, confidentiality of information, and adherence to generally accepted practices in risk management.

• describe the potential consequences of violating the GARP Code of Conduct.

The following is a review of the Foundations of Risk Management principles designed to address the learning objectives set forth by GARP®. Cross-reference to GARP FRM Part I Foundations of Risk Management, Chapter 1.

READING 1

THE BUILDING BLOCKS OF RISK MANAGEMENT

EXAM FOCUS

Study Session 1

This introductory reading provides coverage of fundamental risk management concepts that will be discussed in much more detail throughout the FRM curriculum. For the exam, it is important to understand the general risk management process and its potential shortcomings, the concept of unexpected loss, and some of the underlying points regarding the relationship between risk and reward. Also, the material on the main categories of financial and nonfinancial risks contains several testable concepts.

MODULE 1.1: INTRODUCTION TO RISK MANAGEMENT

LO 1.a: Explain the concept of risk and compare risk management with risk taking.

In an investing context, risk is the uncertainty surrounding outcomes. Investors are generally more concerned about negative outcomes (unexpected investment losses) than they are about positive surprises (unexpected investment gains). Additionally, there is an observed natural trade-off between risk and return; opportunities with high risk have the potential for high returns and those with lower risk also have lower return potential.

Risk is not necessarily related to the size of the potential loss. For example, many potential losses are large but are quite predictable and can be accounted for using risk management techniques. The more important concern is the variability of the loss, especially an unexpected loss that could rise to unexpectedly high levels.

As a starting point, risk management includes the sequence of activities aimed to reduce or eliminate an entity’s potential to incur expected losses. On top of that, there is the need to manage the unexpected variability of some costs. In managing both expected and unexpected losses, risk management can be thought of as a defensive technique. However, risk management is actually broader in the sense that it considers

how an entity can consciously determine how much risk it is willing to take to earn future uncertain returns. The concept of risk taking refers to the active acceptance of incremental risk in the pursuit of incremental gains. In this context, risk taking can be thought of as an opportunistic action.

The Risk Management Process

The risk management process is a formal series of actions designed to determine if the perceived reward justifies the expected risks. A related query is whether the risks could be reduced and still provide an approximately similar reward.

There are several core building blocks in the risk management process. They are as follows:

1. Identify risks.
2. Measure and manage risks.
3. Distinguish between expected and unexpected risks.
4. Address the relationships among risks.
5. Develop a risk mitigation strategy.
6. Monitor the risk mitigation strategy and adjust as needed.

Risk managers can deploy several methods to identify relevant risks. The various types of risk are discussed later in this reading, but for now, focus on the identification process. One method to identify risks is brainstorming, which involves soliciting from key business leaders all potential known risks influencing their supervision area. These key leaders may also survey their subordinates (and especially frontline personnel) for a deeper understanding of relevant risks. There may be industry-level resources (e.g., regulatory standards, industry surveys, or expert opinions) that are also available. For a more quantitative approach, a risk manager can analyze actual loss data to discern the magnitudes and frequency of various losses. Scenario analysis is another common tool used for identifying risks.

Part of the risk identification process is to filter risks into degrees of being known or unknown. Figure 1.1 illustrates that risks can move along a spectrum from being expected (i.e., known) to being fully unknown. The unknown category can be subdivided into the known unknowns (i.e., Knightian uncertainty) and the unknown unknowns. The former are items that may impact a firm, while the latter are truly unknown (i.e., tail risk events). Where possible, risk managers should move a risk into the known category, but this does not work for risks that cannot be quantified.

Figure 1.1: Loss Categories

The risk management process involves a four-way decision. The company might decide to avoid risk directly by selling a product line, avoiding certain markets or jurisdictions, or offshoring production. They also might decide to retain risk, depending on the expected rewards relative to the probability and frequency of any expected losses. Another option is to mitigate risk by reducing either the magnitude or the frequency of exposure to a given risk factor. Finally, risk managers could transfer risk to a third party using derivatives or structured products. They could also purchase insurance to outsource risk to an insurance company.

One of the challenges in ensuring that risk management will be beneficial to the economy is that risk must be sufficiently dispersed among willing and able participants in the economy. Unfortunately, a notable failure of risk management occurred during the financial crisis of 2007–2009 when it was subsequently discovered that risk was too concentrated among too few participants.

Another challenge of the risk management process is that it has failed to consistently assist in preventing market disruptions or preventing financial accounting fraud (due to corporate governance failures). For example, the existence of derivative financial instruments greatly facilitates the ability to assume high levels of risk and the tendency of risk managers to follow each other’s actions (e.g., selling risky assets during a market crisis, which disrupts the market by increasing its volatility).

In addition, the use of derivatives as complex trading strategies assisted in overstating the financial position (i.e., net assets on balance sheet) of many entities and complicating the level of risk assumed by many entities. Even with the best risk management policies in place, using such inaccurate information would not allow the policies to be effective.

Finally, risk management may not be effective on an overall economic basis because it only involves risk transferring by one party and risk assumption by another party. It

does not result in overall risk elimination. In other words, risk management can be thought of as a zero-sum game in that some “winning” parties will gain at the expense of some “losing” parties. However, if enough parties suffer devastating losses due to an excessive assumption of risk, it could lead to a widespread economic crisis.

Measuring and Managing Risk

LO 1.b: Evaluate, compare, and apply tools and procedures used to measure and manage risk, including quantitative measures, qualitative risk assessment techniques, and enterprise risk management.

Quantitative Risk Measures

Value at risk (VaR) calculates an estimated loss amount given a certain probability of occurrence. For example, a financial institution may have a one-day VaR of $2.5 million at the 95% confidence level. That would be interpreted as having a 5% chance that there will be a loss greater than $2.5 million on any given day. VaR is a useful measure for liquid positions operating under normal market circumstances over a short period of time. It is less useful and potentially dangerous when attempting to measure risk in non-normal circumstances, in illiquid positions, and over a long period of time.

To further illustrate the concept of VaR, assume you have gathered 1,000 monthly returns for a security, and produced the histogram shown in Figure 1.2. You decide that you want to compute the monthly VaR for this security at a confidence level of 95%. At a 95% confidence level, the lower tail displays the lowest 5% of the underlying distribution’s returns. For this distribution, the value associated with a 95% confidence level is a return of −15.5%. If you have $1,000,000 invested in this security, the one- month VaR is $155,000 (= −15.5% × $1,000,000).

Figure 1.2: Histogram of Monthly Returns

PROFESSOR’S NOTE

The VaR calculated using Figure 1.2 is an example of historical VaR. In Book 4, you will learn about other approaches for calculating VaR.

Economic capital is the amount of liquid capital necessary to cover unexpected losses. For example, if one-day VaR is $2.5 million and the entity holds $2.5 million in liquid reserves, then they have sufficient economic capital (i.e., they are unlikely to go bankrupt in a one-day expected tail risk event).

Qualitative Risk Assessment

Scenario analysis is a process that considers potential future risk factors and the associated alternative outcomes. The typical method is to compare a best-case scenario to a worst-case scenario, which shocks variables to their extreme known values. This process factors the potential impact of several categories of risk and influences risk manager decision making by attempting to put a value on an otherwise qualitative concept (i.e., what-if analysis). This exercise is an attempt to understand the assumed full magnitude of potential losses even if the probability of the loss is very small.

Stress testing is a form of scenario analysis that examines a financial outcome based on a given “stress” on the entity. This technique adjusts one parameter at a time to estimate the impact on the firm. For example, it is plausible for interest rates to adjust severely in an economic crisis. Stress testing will estimate the impact of this one parameter on the entity.

There are two types of parameters that could be considered using either scenario analysis or stress testing. The first type of parameter is historically sourced. This parameter has the benefit of being observable, but the past trend may not continue into the future. The second type of parameter is an estimated variable, which is a hypothetical forecast based on a risk manager’s assumptions. This approach can introduce estimation error and model risk, but it may be a useful exercise to fully understand a firm’s sensitivity to qualitative risk factors.

Enterprise Risk Management

In practice, the term enterprise risk management (ERM) refers to a general process by which risk is managed within an organization. An ERM system is highly integrative in that it is deployed at the enterprise level and not siloed at the department level. The value in this top-down approach is that risk is not considered independently, but rather in relation to its potential impact on multiple divisions of a company.

One challenge with the ERM approach is a tendency to reduce risk management to a single value (e.g., either VaR or economic capital). This attempt is too simplistic in a dynamic-risk environment. Risk managers learned from the financial crisis of 2007– 2009 that risk is multi-dimensional, and it requires consideration from various vantage points. Risk also develops across different risk types, as you will learn later in this reading. The reality is that proper application of an ERM framework requires both statistical analysis and informed judgment on the part of risk managers.

The ultimate goal of an ERM is to understand company-wide risks and to integrate risk planning into strategic business planning. If the risk management process does not link information with action, then it is an exercise in futility. ERM is not just about risk aggregation at the company level. It considers risk holistically and its appropriate influence on strategic planning for an organization.

Expected and Unexpected Loss

LO 1.c: Distinguish between expected loss and unexpected loss and provide examples of each.

Expected loss (EL) considers how much an entity expects to lose in the normal course of business. These losses can be calculated through statistical analysis with relative reliability over short time horizons. The EL of a portfolio can generally be calculated as a function of: (1) the probability of a risk occurring; (2) the dollar exposure to the risk event; and (3) the expected severity of the loss if the risk event does occur.

For example, a retail business that provides credit terms on sales of goods to its customers (i.e., no need to pay immediately) incurs the risk of nonpayment by some of those customers. If the business has been in operation for at least a few years, it could use its operating history to reasonably estimate the percentage of annual credit sales that will never be collected. The amount of the loss is therefore predictable and is treated as a regular cost of doing business (i.e., bad debt expense on the income statement). It can be priced into the cost of the goods directly in the case of the retail business. In a banking context, EL could be modeled as the product of a borrower’s probability of default (PD), the bank’s exposure at default (EAD), and the magnitude of the loss given default (LGD).

EL = EAD × PD × LGD

Banks will often address ELs by charging a higher spread (and possibly a shorter time horizon) for riskier borrowers. Most expected losses can be logically considered as a function of several more granular losses.

PROFESSOR’S NOTE

When EL can be modeled with confidence, it can be treated like a predictable expense or a variable cost.

Unexpected loss (UL) considers how much an entity could lose in excess of their average (expected) loss scenarios. There is considerable challenge involved with predicting unexpected losses because they are, by definition, unexpected.

For example, consider a commercial loan portfolio that is focused on loans to automotive manufacturing companies. During an economic expansion that favors such companies (because individuals have more disposable income to spend on items such as automobiles), the lender will realize very few, if any, loan defaults. However, during an economic recession, there is less disposable income to spend and many more loan defaults are likely to occur from borrowers. It is also likely that many of these losses will be clustered at the same time. This is an example of correlation risk, when

unfavorable events happen together. The correlation risk drives potential losses to unexpected levels.

Another example of correlation risk lies with real estate loans secured by real property. Borrowers tend to default on loans (i.e., default rate risk) at the same time that the real property values fall (i.e., recovery rate risk—the creditor’s collateral is worth less, thereby compromising the recovery rate on the funds lent to the borrowers). These two risks occurring simultaneously could also bring potential losses to unexpected levels.

The Relationship Between Risk and Reward

LO 1.d: Interpret the relationship between risk and reward and explain how conflicts of interest can impact risk management.

As previously mentioned, there is a natural trade-off between risk and reward. In general, the greater the risk taken, the greater the potential reward. However, one must consider the variability of the potential reward. The portion of the variability that is measurable as a probability function could be thought of as risk (EL) whereas the portion that is not measurable could be thought of as uncertainty (unexpected loss).

For example, government bonds have less credit/default risk than corporate bonds. Therefore, government bonds will trade with lower yields than corporate bonds (all else equal). However, for a given maturity, the full relationship between risk and return goes further than merely credit risk (e.g., liquidity risks and taxation impacts may make the relationship less clear). Additionally, the risk tolerances (i.e., ability and willingness to take on certain risks) of market participants may change over time. When risk tolerances are high, the spread between riskless and risky bonds may narrow to an abnormally low level, which again disguises the true relationship between risk and return.

PROFESSOR’S NOTE

The risk/reward trade-off becomes much more complex to analyze for assets that are either thinly traded or not publicly traded. This is especially true for illiquid assets.

Because risk and reward are linked, it is very important for risk managers to properly consider relevant risks. As previously mentioned, a bank’s EL could be modeled as the product of a borrower’s PD, the bank’s EAD, and the magnitude of the LGD. Risk managers could drill down on the PD to discern underlying loss drivers that need to be monitored. Some of the drivers could be the borrower’s financial condition (e.g., sales growth trends, input cost trends, etc.) or it could be an external factor (e.g., weakening global trade or unfavorable tax policy changes). The potential list of loss drivers could be exhaustive. The advent of artificial intelligence and machine learning greatly enhances a risk manager’s ability to consider and isolate economically important loss drivers to monitor.

In complex systems (e.g., financial markets), extreme unexpected losses (risk) sometimes occur. These tail risk events can be tragic for a risk management system.

This is especially true when the correlation between risk factors increases. The triggers for lockstep movement between risk factors could be structural changes such as behavioral shifts, industry trends, government interventions, and new innovations.

Danger arises when the frequency of tail events increases because the pace of structural uncertainty accelerates.

One of the biggest structural concerns is the potential for conflicts of interest. Those in the position to be most aware of the presence, probability, and potential impact of various risk factors are sometimes the ones who try to profit from its presence. This reality could be seen in the actions of rogue traders. It may also be seen from managers who conceal knowledge of a risk factor to maximize short-term stock price movements to enhance personal compensation through stock-based remuneration structures.

The best way to combat the potential for conflicts of interest to skew risk recognition is the following three-step process:

1. Risk recognition by frontline employees and division managers.
2. A robust risk management system with daily oversight.
3. Periodic independent audits to ensure that steps 1 and 2 are functioning properly.

MODULE QUIZ 1.1

l. Which of the following statements regarding risk and risk management is correct?

1. Risk management is more concerned with unexpected losses than expected losses.
   1. There is a relationship between the amount of risk taken and the size of the potential loss.
   1. The final step of the risk management process involves developing a risk mitigation strategy.
   1. If executed properly, the risk management process may allow for risk elimination within an economy.
2. Which of the following items is not a building block of the risk management process?
   1. Identifying relevant risk.
   1. Measuring risks.
   1. Avoiding all known risks.
   1. Attempting to quantify any expected losses.
3. Examining the impact of a dramatic increase in interest rates on the value of a bond investment portfolio could be performed using which of the following tools?
4. Stress testing.
5. Enterprise risk management.
   1. I only.
   1. II only.
   1. Both I and II.
   1. Neither I nor II.
6. Which of the following items would be associated with unexpected losses?
7. Loan defaults are increasing simultaneously while recovery rates are decreasing.
8. Lending losses are covered by charging a spread between the cost of funds and the lending rate.
   1. I only.
   1. II only.

• Both I and II.
  • Neither I nor II.
• Which of the following statements is incorrect with respect to the relationship between risk factors?
  • The risk/reward trade-off is easier to consider for individual stocks than for private equity investments.
  • Risk management conflicts of interest can be easily mitigated through stock- based compensation.
  • Risk managers should consider granular loss drivers.
  • Risk management conflicts of interest can be mitigated through periodic internal audits.

MODULE 1.2: TYPES OF RISK

LO 1.e: Describe and differentiate between the key classes of risks, explain how each type of risk can arise, and assess the potential impact of each type of risk on an organization.

All firms face risks. These risks can be subcategorized as market risks, credit risks, liquidity risks, operational risks, legal and regulatory risks, business and strategic risks, and reputation risks.

Market Risk

Market risk refers to the fact that market prices and rates are continually in a state of change. The four key subtypes of market risk are interest rate risk, equity price risk, foreign exchange risk, and commodity price risk. The key to mitigating these risks is to understand the relationship between positions. As these relationships change, risk management methods need to change as well.

  Interest rate risk refers to uncertainty flowing from changes in interest rate levels.

If market interest rates rise, the value of bonds will decrease. Another form of interest rate risk is the potential for change in the shape of (or a parallel shift in) the yield curve. Interest rate risk may arise from having positions that are either completely or partially unhedged. This occurs when underlying transactions do not fully offset. In this instance, the loss could be attributed to basis risk, which means that the presumed correlation between the price of a bond and the price of the hedging vehicle used to hedge that bond has changed unfavorably.

 Equity price risk refers to the volatility of stock prices. It can be broken up into two parts: (1) general market risk, which is the sensitivity of the price of a stock to changes in broad market indices, and (2) specific risk, which is the sensitivity of the price of a stock due to company-specific factors (e.g., rising cost of inputs, strategic weaknesses, etc.). General market risk cannot be diversified away, while specific risk can be mitigated by holding assets with less than perfect correlations.

 Foreign exchange risk refers to monetary losses that arise from either fully or partially unhedged foreign currency positions. Foreign exchange risk results from imperfect correlations in currency price movements as well as changes in

international interest rates. Potentially large losses could reduce an entity’s competitive edge relative to its foreign competitors.

 Commodity price risk refers to the price volatility of commodities (e.g., precious metals, base metals, agricultural products, energy) due to the concentration of specific commodities in the hands of relatively few market participants. The resulting lack of trading liquidity tends to increase the amount of price volatility compared to financial securities. In addition, commodities may face significant price discontinuities (i.e., prices suddenly jump from one level to another).

Credit Risk

Credit risk refers to a loss suffered by a party whereby the counterparty fails to meet its contractual obligations. Credit risk may arise if there is an increasing risk of default by the counterparty throughout the duration of the contract. There are four subtypes of credit risk: (1) default risk, (2) bankruptcy risk, (3) downgrade risk, and (4) settlement risk.

 Default risk refers to potential nonpayment of interest and/or principal on a loan by the borrower. The PD is central to risk management.

 Bankruptcy risk is the chance that a counterparty will stop operating completely. The risk management concern is that the liquidation value of any collateral might be insufficient to recover a loss flowing from a default.

 Downgrade risk considers the decreased creditworthiness of a counterparty. A creditor may subsequently charge the downgraded entity a higher lending rate to compensate for the increased risk. For a creditor, downgrade risk may eventually lead to default risk.

 Settlement risk could be illustrated using a derivatives transaction between two counterparties. At the settlement date, one of them is in a net gain (“winning”) position and the other is in a net loss (“losing”) position. The position that is losing may simply refuse to pay and fulfill its obligations. This risk is also known as counterparty risk (or Herstatt risk¹).

Consider an example where one investor’s net gain on a futures contract is $500,000 at settlement. The counterparty must pay this amount, but they have encountered financial difficulty and are only able to pay $400,000. This estimated payment is called the recovery value, and the $100,000 that will be lost is known as the loss given default (LGD). Expressed in percentages, the recovery rate is 80% and the LGD is 20%. If the recovery rate was 0%, then the counterparty would be in complete default and possibly in a bankruptcy scenario.

Risk managers use sophisticated modeling to properly consider credit risk. Following is a list of some very important considerations relative to this risk identification process:

 Is the interest rate charged on the instrument commensurate with the risk taken?  Is a portfolio of instruments diversified both geographically and by industry?

 Have correlations between instruments and other known risk factors been properly considered?

 Are any firm-specific or industry-specific financial ratios indicating a cause for concern?

  Is a lender exposed to a large number of small loans or a small number of large loans?

Concentration risk can be a real concern.

  What is the PD for the various instruments owned?

  Are the probabilities of default correlated in any way?

Liquidity Risk

Liquidity risk is subdivided into two parts: (1) funding liquidity risk and (2) market liquidity risk. If liquidity risk becomes systemic, it could lead to elevated credit risk (e.g., a potential default scenario).

  Funding liquidity risk occurs when an entity is unable to pay down (or refinance) its debt, satisfy cash obligations to counterparties, or fund capital withdrawals. This risk can be illustrated from the perspective of the banking industry, which has a natural mismatch between assets and liabilities (e.g., short-term deposits mismatched with longer-term loans). Improper risk management of this fundamental mismatch led to bank defaults during the financial crisis of 2007–2009.

 Market liquidity risk (also known as trading liquidity risk) refers to losses flowing from a temporary inability to find a needed counterparty. This risk can cripple an entity’s ability to turn assets into cash at any reasonable price. Transactions with an element of immediacy might need to be consummated with a significant discount, which typically translates into a huge loss. The impact of market liquidity risk could include impairments in an entity’s ability to control market risk and to cover any funding shortfalls.

Operational Risk

Operational risk refers to potential losses flowing from inadequate (or failed) internal processes, human error, or an external event.² The details of operational risk could relate to factors such as inadequate computer systems (technology risk), insufficient

internal controls, incompetent management, fraud (e.g., losses due to intentional

falsification of information), employee mistakes (e.g., losses due to incorrect data entry or accidental deletion of a file), natural disasters, cyber security risks, or rogue traders.

Within a financial institution, the leveraged nature of derivatives transactions makes them highly susceptible to operational risk. This is further amplified by the models used to price complex assets that may be less liquid than mark-to-market rules require. A very robust system of internal controls is required within an entity. Otherwise, there is a risk of significant losses due to various operational risks, which can be challenging to quantify.

Legal and Regulatory Risk

Legal risk is the potential for litigation to create uncertainty for a firm. In the context of a two-way financial transaction, an example of legal risk is one party suing the other party in an attempt to terminate the transaction. Regulatory risk refers to uncertainty

surrounding actions by a governmental entity. An example of regulatory risk could be a change in tax law or margin requirements that alter the payoff for a given trade. In practice, legal and regulatory risks are highly integrated with both operational and reputation risk (discussed shortly).

Business and Strategic Risk

Business risk refers to variability in inputs that influence either revenues (e.g., customer demand trends, product pricing policies, etc.) or cost structures (e.g., the cost of production inputs, supplier negotiations, etc.). Diverse business elements such as new product innovations, shipping delays, and production cost overruns could also be labeled as business risks.

Strategic risk involves long-term decision making about fundamental business strategy. These long-term strategic initiatives may involve large capital investments in either equipment or human capital. For example, an entity could spend millions of dollars developing a new product that ultimately fails in the marketplace because consumers find it unsuitable for their needs. Alternatively, the regulatory landscape could change and materially alter the profitability of a project. Another example of strategy risk is a bank that changes its lending standards to originate more loans only to find that the risk of the loans elevates to a disastrous level during a period of market distress.

Reputation Risk

Reputation risk is the danger that a firm will suffer a loss in public perception (or consumer acceptance) due to either: (1) a loss of confidence in the firm’s financial soundness or (2) a perception of a lack of fair dealing with stakeholders. Reputation risk is often one of the outcomes of experiencing a loss in another risk category. For example, a significant credit risk experienced by a bank could create a reputational impact for the firm. Likewise, the exponential growth in technology (and the internet) could lead to operational risks such as a cyberattack. Social media can also amplify reputation risk as users can spread information quickly that may or may not be accurate. The impact of reputation risk on an entity could start with lost profits and eventually lead to insolvency as public perception of the entity diminishes together with the value of the entity.

Overall, an entity should clearly define its holistic appetite for assuming risk. The entity might decide to be very conservative in assuming credit risk, while behaving with an entrepreneurial spirit with respect to business risk. There is also a tremendous interconnection between the different types of risk. For example, a company might be exposed to currency risk because of a new innovation that requires either international sales or internationally-sourced production inputs.

Risk Factor Interactions

LO 1.f: Explain how risk factors can interact with each other and describe challenges in aggregating risk exposures.

A significant danger in risk management occurs when independent risk factors are correlated. For example, a granular factor that leads to default risk for a loan could ultimately spill over into credit risk, operational risk, business risk, and reputation risk. This is most dangerous with unexpected losses. Realizing the potential for correlation between risks will help a risk manager measure and manage unexpected losses with marginally more certainty. For example, a risk manager could consider historical correlations between identified risk factors and forecast the nature of these relationships to measure the risk planning process.

Another significant challenge for risk managers is understanding how risk aggregation can be applied to measure all risks at the enterprise level. To consider the potential for complexity, consider the difference between quantifying the market risk associated with an individual stock versus a derivatives transaction. Market risk for a stock can be modeled using past volatility and the notional amount at risk. However, derivatives can be considerably more complex. Their volatility can be significantly higher than that of an individual stock. Sometimes, exposures to multiple derivatives contracts can cancel each other out, which means that notional value would not even apply, although risk is still involved. Market participants have resorted to using option Greeks (e.g., delta, gamma, theta, and vega) to model uncertainty, but these values cannot be aggregated with other positions to the enterprise level.

VaR has emerged as a popular attempt at risk aggregation, but it has some drawbacks. First, there are a few different versions of VaR used in practice. Second, VaR uses several simplifying assumptions, and risk managers can alter the computed value by adjusting the number of days or the confidence level used in the calculation. Third (and perhaps the most important challenge), VaR is intended to determine a loss threshold level. It measures the largest loss at a specified cutoff point, not the magnitude of tail risk. For this reason, some risk managers (and regulators) have turned their attention to scenario analysis, stress testing, and expected shortfall, which is a statistical measure designed to estimate the magnitude of aggregate tail risk losses. The drawbacks of relying on VaR as a single risk metric were clearly discovered during the financial crisis of 2007–2009.

However, VaR is still a very valuable enterprise-level risk metric. One valuable use is to consider risk exposures across business units. The related measure of economic capital is also extremely useful for risk managers. It enables a conceptually simple method of considering risk, which involves calculating a risk-adjusted return on capital

(RAROC), shown as follows:³

RAROC = after-tax risk-adjusted expected return / economic capital

This formula is essentially reward per unit of risk, and the numerator needs to be adjusted for expected losses. The practical application of the RAROC formula involves comparing the calculated value to the cost of equity. Only reward-to-risk measures that

exceed the cost of capital should be considered acceptable. Four specific practical applications are:

1. Business comparison. This metric permits comparison of business units even when different levels of economic capital exist for each segment.
2. Investment analysis. This approach could be used to evaluate potential new product offerings. For example, a bank could use this technique to decide whether to branch out into a new credit product.
3. Pricing strategy. Firms could use RAROC to determine if their current pricing strategy provides sufficient return relative to the estimated risk taken.
4. Risk management. In the most basic sense, this metric can be used to highlight areas where risk is not being properly covered with expected rewards.

The overall point of risk management is to consider the drivers of risk and whether sufficient reward is generated relative to the level of risk assumed. Risks can be avoided, retained, mitigated, or transferred. This is the heart of the risk management process.

MODULE QUIZ 1.2

l. In considering the major classes of risks, which risk would best describe an entity with weak internal controls that could easily be circumvented with a lack of segregation of duties?

1. Business risk.
   1. Legal and regulatory risk.
   1. Operational risk.
   1. Strategic risk.
2. Local Bank, Inc., (LBI) has loaned funds to a private manufacturing company, named We Make It All (WMIA). The current balance of the loan is $1 million, and it is secured by a piece of land and the corresponding building owned by WMIA. Due to an economic downturn, WMIA suffered a loss for the first time in its 10-year operating history and is currently experiencing some cash flow difficulties. In addition, the land and building that is held as collateral has recently been appraised at only

$800,000. Based only on the information provided, which of the following risks faced by LBI have increased?

1. Bankruptcy risk and default risk.
   1. Bankruptcy risk and settlement risk.
   1. Default risk and downgrade risk.
   1. Default risk, downgrade risk, and settlement risk.
2. Which of the following statements is correct relative to risk aggregation?
   1. Enterprise-level risk should be reduced to a single number (e.g., value at risk) for ease.
   1. Expected shortfall provides a more complete understanding of the potential magnitude of losses.
   1. Risk aggregation is most straightforward for derivatives contracts.
   1. Measuring dispersion using the option Greeks can streamline the risk aggregation process.

 KEY CONCEPTS                                                                         

LO 1.a

Risk is uncertainty surrounding outcomes. A risk management process is a series of actions designed to reduce or eliminate the potential to incur loss. Risk taking refers to the active acceptance of incremental risk in the pursuit of incremental gains.

The risk management process is a formal series of actions designed to determine if the perceived reward justifies the expected risks.

There are several core building blocks in the risk management process, which are listed as follows:

1. Identify risks.
2. Measure and manage risks.
3. Distinguish between expected and unexpected risks.
4. Address the relationship between risks.
5. Develop a risk mitigation strategy.
6. Monitor the risk mitigation strategy and adjust as needed.

LO 1.b

Value at risk (VaR) and economic capital are two ways that risk managers can attempt to quantify risk. Some of the qualitative methods include scenario analysis and stress testing. Risk managers need to be careful to not think that enterprise-level risk can be reduced to a single number. Risk is a complex concept that requires a dynamic process to identify, measure, mitigate, and monitor relevant risks.

LO 1.c

Expected losses are the average loss expected over a given time horizon. They are a function of (1) the probability of a risk occurring; (2) the dollar exposure to the risk event; and (3) the expected severity of the loss if the risk event does occur. Unexpected losses are losses that exceed the average result expected. When unexpected losses are clustered (i.e., correlation risk) they can become a little easier to model.

LO 1.d

There is an observed trade-off between risk and reward; opportunities with lower risk also have lower risk potential. Risk managers need to consider not only the potential impact of a given risk but also the granular loss drivers that underpin a given risk.

Sometimes corporate insider goals conflict with those of shareholders. This reality could drive risk taking that promotes an ulterior benefit that may later cause a big problem when an extreme unexpected loss (i.e., tail risk) materializes. Multiple layers of supervision along with periodic and independent internal audits can help to offset these conflicts of interest.

LO 1.e

The general term “risk” can be subcategorized as market risks, credit risks, liquidity risks, operational risks, legal and regulatory risks, business and strategic risks, and reputation risks.

 Market risk refer to potential losses resulting from changes in financial market levels or volatility.

  Credit risk is essentially the risk of default on a loan.

  Liquidity risk relates to not having access to enough money to meet business needs.

This could also flow from an inability to quickly exchange a financial asset for a reasonable amount of cash.

 Operational risk is a very broad category that involves potential losses flowing from inadequate (or failed) internal processes, human error, or an external event.

 Legal and regulatory risks come from either the threat of litigation or the threat of unfavorable government actions.

 Business risk refers to variability in either revenue or input cost that influence the viability of the business.

  Strategic risk involves uncertainty surrounding long-term business strategy.

 Reputation risk is a loss of sales due to a decline in public perception about the company’s products or general level of fairness.

LO 1.f

Some risks are correlated, which can lead to a domino effect where one risk leads directly to another risk. This can amplify risk exposures. Risk aggregation is the process of considering risk at the enterprise level. Higher complexity of the underlying risks will lead to less reliability of risk assumptions.

VaR and the associated economic capital measurement are both useful metrics that provide risk managers information. A risk-adjusted return on capital (RAROC) can be calculated for comparison purposes, but VaR should not be considered as a stand-alone risk metric because it makes certain assumptions, can be adjusted by input parameters, and there are different types of VaR measurements. However, VaR, economic capital, and RAROC can be useful for helping risk managers better understand the aggregate risk exposure of a firm.

 ANSWER KEY FOR MODULE QUIZZES                                            

Module Quiz 1.1

1. A Risk management is more concerned with the variability of losses, especially ones that could rise to unexpectedly high levels or ones that suddenly occur that were not anticipated (i.e., unexpected losses). Risk is not necessarily related to the size of the potential loss. For example, many potential losses are large but are quite predictable and can be accounted for using risk management techniques. The final step of the risk management process involves assessing performance and amending the risk mitigation strategy as needed. The risk management process only involves risk transferring by one party and risk assumption by another counterparty. It is a zero-sum game, so it does not result in overall risk elimination. (LO 1.a)

• C Risk managers should identify relevant risks, measure them, determine how to manage the risks, distinguish between expected and unexpected risks, consider the relationship between risks, develop a risk mitigation strategy, and monitor the process. They do not need to avoid all risks, which is impossible, because carrying manageable risks is one path to potential reward. (LO 1.a)
• C Examining the impact of a dramatic increase in interest rates is an example of stress testing. Enterprise risk management makes use of measures such as stress testing. (LO 1.b)
• A Loan defaults are increasing simultaneously while recovery rates are decreasing is an example of correlation risk. Correlation risk could drive up the potential

losses to unexpected levels. In contrast, if lending losses are covered with a

spread, given that there is sufficient information to compute such a spread, then the losses would likely be considered expected losses. (LO 1.c)

• B The risk/reward trade-off is easier to navigate for assets that are less complex. Individual stocks are considerably less complex than the thinly traded securities or illiquid assets that private equity investors embrace. Risk management conflicts are best mitigated through supervision (e.g., periodic independent internal audits). These conflicts generally are increased by the inclusion of stock- based compensation because risk managers might ignore certain risks to pursue the potential of personal financial gain in the short-term. Risk managers should always consider granular loss drivers to better understand what could impact the risk/reward trade-off. (LO 1.d)

Module Quiz 1.2

1. C Weak internal controls and lack of segregation of duties would represent a nonfinancial risk and be best described as an operational risk. Business risk focuses on the income statement (i.e., revenues too low and expenses too high). Legal and regulatory risk focuses on the risk of an entity being sued or the risk of unfavorable changes in the rules and laws that the entity must follow. Strategic risk focuses on significant new business investments or significant changes in an entity’s business strategy. (LO 1.e)
2. A The fact that the loan is secured by land and the building is now worth less than the amount of the loan outstanding subjects LBI to increased bankruptcy risk in the sense that the liquidation value of the collateral is insufficient to recover the loss if the loan defaults. The financial loss and the cash flow difficulties suggest that there is increased default risk for LBI as well. Downgrade risk does not apply here because WMIA’s loan is not publicly traded and is unlikely to be rated by a recognized rating agency. Settlement risk does not apply here either, because there is no exchange of cash flows at the end of the transaction that would be required to incur such risk. In this case, the loan is settled when WMIA fully repays the principal balance owed. (LO 1.e)
3. B By itself, VaR has flaws as a single risk score for a firm. It uses various assumptions and it can be managed by adjusting the confidence level. While VaR

tells analysts the loss threshold, expected shortfall communicates the magnitude of losses beyond the VaR threshold. The use of derivatives can make risk aggregation more challenging because option Greeks (e.g., delta, gamma, theta, and vega) cannot be aggregated and some derivatives exposures cancel each other out, which means that notional value is not a good measure of the true risk exposure. (LO 1.f)

1 The term Herstatt risk refers to the counterparty risk associated with the failure of Herstatt Bank in Germany. The bank was closed by regulators in 1974 in the wake of a foreign exchange issue, and the bank’s closure led to settlement risk with every counterparty of the bank.

2 https://www.bis.org/publ/bcbs195.pdf, page 3, footnote 5.

3 Crouhy, M., Galai, D., and Mark, R. The Essentials of Risk Management, 2nd Edition (Chapter 17). McGraw Hill, 2014.

The following is a review of the Foundations of Risk Management principles designed to address the learning objectives set forth by GARP®. Cross-reference to GARP FRM Part I Foundations of Risk Management, Chapter 2.