Foundations of Risk Management Flashcards
501.1. You are having lunch with a client who suddenly asks you, “I noticed that you studied risk. To me, risk is when bad stuff can happen. Can you tell me, what is your definition of risk?” As far as the financial risk manager (FRM) is concerned–at least among the following potential responses to your client’s question–which of the following definitions of risk is best?
A. Risk is the source or cause of a financial loss or cost
B. Risk is a condition that increases the probability of a loss
C. Risk is the size of a loss or cost: if a cost is greater, then its risk is greater
D. Risk is the variability of adverse outcomes that are unexpected
501.1. D. Risk is the variability (aka, volatility) of adverse outcomes (aka, losses) that are unexpected. The general form of the statement is: risk is the variability of unexpected, adverse outcomes; this incorporates non-financial risks (the client asked for a definition of “risk” not “financial risk”). The equivalent form that is specific to financial risk is: financial risk is the volatility (or variability) of unexpected losses. The two keywords are “variability” (or the narrower volatility) and “unexpected.” A key point in the reading is the distinction between expected losses (which are NOT risks) and unexpected losses (which are risks) and the variability about these unexpected losses. Note that firm-wide risk can be parsed into either business risk or financial risk (at least according to Jorion). Finally, the Crouhy reading does not seem to require that risk be quantifiable uncertainty. * In regard to incorrect (A), the cause of a loss is called a peril. *In regard to incorrect (B), a condition that increases the probability of a loss is called a hazard. * In regard to incorrect (C), “risk is not synonymous with the size of a cost or of a loss. After all, some of the costs we expect in daily life are very large indeed if we think in terms of our annual budgets: food, fixed mortgage payments, college fees, and so on. These costs are big, but they are not a threat to our ambitions because they are reasonably predictable and are already allowed for in our plans.” To summarize the above definitions: * a peril is the cause of a loss * a hazard is a condition that increases the probability (and/or frequency and/or severity) of a loss * a risk is the variability of an unexpected loss or adverse outcome (for our purposes)
501.2. According to Crouhy, Galia and Mark, which of the following is TRUE about the 2007 to 2009 global financial crisis (GFC) and its implication on risk management?
A. Soft factors–e.g., corporate governance structures and risk cultures–did NOT cause the GFC; instead, the GFC was effectively caused by hard factors and, in particular, technical deficiencies in risk measurement
B. Since the GFC, risk managers have–to at least some degree–shifted away from historical-statistical treatments of risk and toward scenario analysis and stress testing
C. Contrary to the popular mainstream narrative, financial engineering and derivatives helped mitigate losses during the GFC due to their innate ability to disperse risk; for example, “without credit derivatives, financial risk would have been far more concentrated and the consequences of the crisis would have almost certainly been worse.”
D. Although risk management was narrowly responsible for minor failures leading up to (and during) the GFC, these failures were small exceptions to the general rule that risk management has consistently and successfully prevented market disruptions and accounting scandals for over three decades
501.2. B. Since the GFC, risk managers have to some degree shifted away from historical-statistical treatments of risk and toward scenario analysis and stress testing In regard to (A), this is false: From the introduction (but consistent with Chapter 1 theme): “Risk management has many different components, but the essence of what went wrong in the run-up to the 2007– 2009 financial crisis had more to do with the lack of solid corporate governance structures for risk management than with the technical deficiencies of risk measurement and stress testing. In the boom period, risk management was marginalized in many financial institutions. The focus on deal flow, business volume, earnings, and compensation schemes drove firms increasingly to treat risk management as a source of information, not as an integral part of business decision making. Decisions were taken on risk positions without the debate that needed to happen. To some degree, this is a matter of risk culture, but it also has to do with governance structures inside organizations: The role of the board must be strengthened; Risk officers must be re-empowered.”
501.3. According to Crouhy et al, each of the following statements about the numerical measurement of risk is true EXCEPT which is false?
A. Merely judgmental rankings of risk (e.g., Risk Rating 3 versus Risk Rating 2) can help us make more rational in-class comparative decisions
B. If we can put an absolute cost or price on a risk, then we can make rational economic decisions about risks; at this point, risk management decisions become fungible with other management decisions
C. The best numerical measure of risk during abnormal markets, over longer periods, or for illiquid portfolios is value at risk (VaR)
D. All risk measures depend on a robust control environment; for example, in many rogue- trading case studies (debacles) traders found some way of circumventing trading controls and suppressing risk measures
501.3. C. False, “the VaR measure works well as a risk measure only for markets operating under normal conditions and only over a short period, such as one trading day. Potentially, it’s a very poor and misleading measure of risk in abnormal markets, over longer time periods, or for illiquid portfolios.” In regard to (A), (B), and (D), each is TRUE.
502.1. Crouhy writes that “understanding [the difference between expected loss and unexpected loss] is the key to understanding modern risk management concepts such as economic capital attribution and risk-adjusted pricing.” Which of the following statements is TRUE about unexpected loss (UL)?
A. Unexpected loss levels tend to be higher for a consumer credit card portfolio than a corporate loan portfolio
B. In a credit portfolio, higher default correlation implies lower portfolio unexpected losses
C. Unexpected loss (UL) it typically priced into the products or services offered to customers, while expected loss is the denominator of risk-adjusted return on capital (RAROC)
D. Market risk value at risk (MVaR) can be expressed as either relative MVaR or absolute MVaR but it is “relative MVaR” that matches (better captures) unexpected losses (UL)
502.1. D. Market risk value at risk (MVaR) can be expressed as either relative MVaR or absolute MVaR but it is “relative MVaR” that matches (better captures) unexpected losses (UL) • In regard to (A), this is false: Crouhy distinguishes the lower unexpected loss of a consumer credit card portfolio (due to lower default correlation, better diversification and higher granularity) from the higher unexpected loss of a corporate loan portfolio (due to a “lumpy” portfolio which is less diversified and exhibits higher correlation risk). • In regard to (B), this is false: portfolio unexpected loss (UL) increases with correlation. If correlation is less than a perfect 1.0, the portfolio UL is less than the sum of individual ULs; as correlation tends toward 1.0, the portfolio UL increases and approaches the sum of individual ULs. • In regard to (C), this is false: expected loss (EL) is typically priced into products as an ongoing “cost of doing business.” Unexpected loss (UL) tends to refer to the denominator of RAROC, which is economic capital.
502.2. Crouhy’s risk typology is consistent with Jorion’s. This typology includes the three major financial risks (market, credit and operational risk) and includes liquidity risk as a key financial risk. Non-financial risks are either business or non-business risks. Non-business risks include reputation and political risks; business risks include strategy and technological innovation. For FRM purposes, however, the domain is financial risks, primarily: market risk, liquidity risk, credit risk, and operational risk. According to this risk typology, each of the following is true but which statement is false?
A. Basis risk is a context-specific form of market risk
B. There are four major types of market risk: interest rate risk, equity price risk, foreign exchange risk, and commodity price risk; interest rate risk parses into trading risk and the special case of gap risk (gap risk relates to the risk that arises in the balance sheet of an institution as a result of the different sensitivities of assets and liabilities to changes of interest rates).
C. Credit risk can be decomposed into four main types: default risk, bankruptcy risk, downgrade (credit deterioration) risk, and settlement risk.
D. Because legal and regulatory risk are classified as business risks rather than financial risks, many of the large losses from derivatives trading case studies (debacles) over the last decade are technically business risk failures not financial risk failures
502.2. D. False. Legal and regulatory risks are classified as operational risks. Crouhy: “Operational risk refers to potential losses resulting from a range of operational weaknesses including inadequate systems, management failure, faulty controls, fraud, and human errors; in the banking industry, operational risk is also often taken to include the risk of natural and man-made catastrophes (e.g., earthquakes, terrorism) and other non-financial risks. As we discuss in Chapters 14 and 15, many of the large losses from derivative trading over the last decade are the direct consequence of operational failures. Derivative trading is more prone to operational risk than cash transactions because derivatives, by their nature, are leveraged transactions. The valuation process required for complex derivatives also creates considerable operational risk. Very tight controls are an absolute necessity if a firm is to avoid large losses. Human factor risk is a special form of operational risk. It relates to the losses that may result from human errors such as pushing the wrong button on a computer, inadvertently destroying a file, or entering the wrong value for the parameter input of a model. Operational risk also includes fraud— for example, when a trader or other employee intentionally falsifies and misrepresents the risks incurred in a transaction. Technology risk, principally computer systems risk, also falls into the operational risk category.” In regard to (A), (B), and (C), each is TRUE.
502.3. According to Crouhy, at least among the given choices, which of the following is probably the most important current and future challenge to the wider risk management profession as it seeks to improve the efficacy of the risk manager’s job?
A. In the extended wake of the financial crisis and ensuing confidence loss in many quantitative approaches, restore the reputation of financial engineering by building better mathematical measures of risk
B. Build a wider risk culture and promote risk literacy in which key staff members understand how they can affect the risk profile of the organization; i.e., “put down deeper risk management roots in each organization.”
C. Improve the ability of firms to predict the expected future value (i.e., the expected mean) of financial variables with better accuracy; e.g., “dispersions won’t matter if we can’t find a more accurate crystal ball for forecasting”
D. Promote the continual “upgrading” from naive, simple metrics (e.g., notional limits) toward more sophisticated methods which are almost universally more robust and automatically comparable
502.3. B. Build a wider risk culture and promote risk literacy in which key staff members understand how they can affect the risk profile of the organization; i.e., “put down deeper risk management roots in each organization.” At least in this first chapter, the going-forward importance of rooting risk management in a firm’s culture is stressed as both imperative and highly difficult. This includes a sub-theme of including non-mathematicians, which is arguably a call for communication and collaboration. Crouhy: “Perhaps the biggest task in risk management is no longer to build specialized mathematical measures of risk (although this endeavor certainly continues). Perhaps it is to put down deeper risk management roots in each organization. We need to build a wider risk culture and risk literacy, in which all the key staff members engaged in a risky enterprise understand how they can affect the risk profile of the organization— from the back office to the boardroom, and from the bottom to the top of the house. That’s really what this book is about. We hope it offers both non-mathematicians as well as mathematicians an understanding of the latest concepts in risk management so that they can see the strengths and question the weaknesses of a given decision.” • In regard to (A), better measures are not dismissed as unnecessary but “Perhaps the biggest task in risk management is no longer to build specialized mathematical measures of risk (although this endeavor certainly continues).” • In regard to (C), this is a bad choice: Risk is concerned with a good approximate future distribution and its second, third and fourth moments more than its mean. Valuation (aka, pricing) strives for accurate present-value point estimate. A key theme in P1.T1. FRM is the difference between valuation/pricing (where precise present-value point estimates are necessary) and risk measurement (where we are satisfied with approximate future-state distributions including tails). Crouhy: “First and foremost, a risk manager is not a prophet! The role of the risk manager is not to try to read a crystal ball, but to uncover the sources of risk and make them visible to key decision makers and stakeholders in terms of probability. For example, the risk manager’s role is not to produce a point estimate of the U.S. dollar/ euro exchange rate at the end of the year; but to produce a distribution estimate of the potential exchange rate at year-end and explain what this might mean for the firm (given its financial positions). These distribution estimates can then be used to help make risk management decisions, and also to produce risk-adjusted metrics such as risk-adjusted return on capital (RAROC).” • In regard to (D), this is not seen as a major widespread challenge, although it may be at some firms. Rather, Crouhy points out the danger posed by supposedly more sophisticated and their oft-observed lack of useful comparability. “But while assigning numbers to risk is incredibly useful for risk management and risk transfer, it’s also potentially dangerous. Only some kinds of numbers are truly comparable, but all kinds of numbers tempt us to make comparisons. For example, using the face value or “notional amount” of a bond to indicate the risk of a bond is a flawed approach. As we explain in Chapter 7 , a million-dollar position in a par value 10-year Treasury bond does not represent at all the same amount of risk as a million-dollar position in a 4-year par value Treasury bond. Introducing sophisticated models to describe risk is one way to defuse this problem, but this has its own dangers. Professionals in the financial markets invented the VaR framework as a way of measuring and comparing risk across many different markets. But as we discuss in Chapter 7 , the VaR measure works well as a risk measure only for markets operating under normal conditions and only over a short period, such as one trading day. Potentially, it’s a very poor and misleading measure of risk in abnormal markets, over longer time periods, or for illiquid portfolios.”
503.1. You are the Chief Risk Officer (CRO) at a non-financial company and the board of directors has asked you to make a recommendation with respect to hedging one of the firm’s key exposures. The board wants you to make a recommendation of either “in favor” or “against” the implementation of a hedge against the exposure. Your staff prepared the following arguments, three in favor and three against: Three Arguments AGAINST hedging an exposure at a non-financial firm
- Our investors own diversified portfolios such that in theory our firm’s specific risks are effectively costless to them
- If markets are perfect, hedging is a theoretically a zero-sum game
- Practical (non-theoretical) objections include that risk management requires specialized skills; and can incur high compliance costs
Arguments IN FAVOR of hedging an exposure at a non-financial firm
- Financial distress incurs a high fixed costs, which is a salient market imperfection
- Risk management gives management better economic control over the firm’s natural economic performance
- Hedging has the potential to reduce the firm’s cost of capital, reduce its cash flow volatility, and enhance its ability to grow
Which of these arguments is valid, or at least plausible?
A. None of the arguments are valid
B. Each set of arguments contains one mistake (or fallacy) and two valid arguments
C. Each set of arguments contains two mistakes (or fallacies) and one valid argument
D. All of the arguments are valid in both sets
503.1. D. All of the arguments are valid in both sets
503.2. Crouhy refers to the difference between hedging activities related to firm’s operations and hedging related to the balance sheet. When it comes to hedges, as risk-reducing positions, which of the following best summarizes his advice to managers?
A. If markets are perfect and the capital asset pricing model (CAPM) assumptions are true, then hedging and risk reduction are theoretically useless in all cases, including both operations and financial positions
B. Even if markets are imperfect and CAPM assumptions are false, hedging and risk reduction in theory cannot add value
C. Firms should risk-manage (e.g., hedge) their operations and, if markets are imperfect, maybe should hedge their assets and liabilities (so long as they disclose their hedging policy)
D. Firms should always hedge their balance sheets, even if markets are perfect, but they probably should not hedge their operations (and they should avoid disclosure in order to protect confidential information that might be revealed by, for example, forward transactions)
503.2. C. Firms should risk-manage (e.g., hedge) their operations and, if markets are imperfect, maybe should hedge their assets and liabilities (so long as they disclose their hedging policy) Crouhy stresses the importance of a distinction between hedging operational and financial hedges because (emphasis ours): “This all suggests a twofold conclusion to our discussion: • Firms should risk-manage their operations. • Firms may also hedge their assets and liabilities, so long as they disclose their hedging policy.” With respect to the advisability of hedging operations (please note this includes so- called natural hedges): “If a company chooses to hedge activities related to its operations, such as hedging the cost of raw materials (e.g., gold for a jewelry manufacturer), this clearly has implications for its ability to compete in the marketplace. The hedge has both a size and a price effect— i.e., it might affect both the price and the amount of products sold. Again, when an American manufacturing company buys components from a French company, it can choose whether to fix the price in euros or in U.S. dollars. If the French company insists on fixing the price in euros, the American company can opt to avoid the foreign currency risk by hedging the exposure. This is basically an operational consideration and, as we outlined above, lies outside the scope of the CAPM model, or the perfect capital markets assumption.” With respect to financial hedges: “The story is quite different when we turn to the problem of the balance sheet of the firm. Why should a firm try to hedge the interest rate risk on a bank loan? Why should it swap a fixed rate for a variable rate, for example? In this case, the theoretical arguments we outlined above, based on the assumption that capital markets are perfect, suggest that the firm should not hedge … If one argues that financial markets are not perfect, then the firm may gain some advantage from hedging its balance sheet. It may have a tax advantage, benefit from economies of scale, or have access to better information about a market than investors.” … this is consistent with Stulz (and the FRM’s) view on financial risk management: if the market is perfect, which is a set of several restrictive assumptions, then the ability of risk to add value is dubious. But the market is imperfect, which creates several distinct opportunities for risk to add value.
503.3. In order to put risk management into practice, Crouhy outlines high-level steps in the following order:
- Risk appetite: Determine the firm’s risk appetite which should include the firm’s risk and return objectives
- Mapping: After the objectives have been set, map the relevant risks and estimate their current and future magnitudes
- Instrument selection: After mapping the risks, identify instruments that can be used to risk-manage the exposures (Some of the instruments can be devised internally; i.e., natural hedges)
- Strategy: Construct and implement a strategy
- Evaluation: Periodically evaluate the performance of the risk management system
Each of the following is a true statement about some aspect of this process EXCEPT which is false?
A. When developing the firm’s risk appetite, it is rarely feasible to define an objective in terms of a single, simple formula; rather, the objective should be broken down into clear rules that can be implemented in line with major policy choices such as risk constituents (e.g., shareholders or debtors), time horizon, and accounting versus economic profits
B. When mapping the firm’s risks, it is important to differentiate between risks that can be insured against, risks that can be hedged, and risks that are noninsurable and nonhedgeable. This classification is important because the next step is to look for instruments that might help to minimize the risk exposure of the firm.
C. When implementing a strategy, because FAS 133 and IFRS 9 allow for hedge accounting for any derivative instrument regardless of the economic relationship between the derivative and the hedged item, firm’s should prefer mark-to-mark (MtM) derivatives over-the-counter (OTC) derivatives
D. When implementing a strategy, a key tactical decision is whether to employ static or dynamic hedges. A static strategy is relatively easy to implement and monitor. Dynamic strategies involve an ongoing series of trades that are used to calibrate the combined exposure and the derivative position; this dynamic strategy calls for much greater managerial effort in implementing and monitoring the positions, and may incur higher transaction costs.
503.3. C. False.
Neither does Crouhy express a general preference w.r.t. OTC derivatives nor is hedge accounting easily qualifying. Crouhy: “Accounting rules for derivatives are quite complex and are constantly being revised. Under the current rules, derivatives used for hedging must be perfectly matched to an underlying position (e.g., with regard to quantities and dates). They can then be reported together with the underlying risky positions, and no accounting profit or loss needs to be reported. If the positions are not perfectly matched, the marked-to-market profit or loss in the hedge must be recorded in the firm’s accounts, even though changes in the value of the underlying exposure are not. Accounting rules affect how derivatives are presented in quarterly or year-end financial reports and how they affect the profit-and-loss statement. The MGRM case highlights the discrepancy between economic and accounting hedging. While MGRM was about fully hedged in economic terms, it was fully exposed in accounting terms, and was also not prepared to absorb liquidity risk.” In regard to (A), (B) and (D), each is TRUE.
504.1. According to Crouhy, “Following a series of failures and near-failures of large financial institutions between 2007 and 2009, boards professed ignorance of the risks that had been assumed in the pursuit of profit–and sometimes senior management offered the same excuse. In particular, the risk management function at many firms failed to attract the attention of senior management, or the boards, to the risk accumulated in structured financial products. One reason may have been a process of marginalization of the role of risk management in financial institutions during the boom years in the run-up to the crisis.” Following the crisis, a debate therefore ensued about the role of corporate governance. About the key areas of debate, which of the following is the LEAST plausible; i.e., each is true except for which is not?
A. Because banks have a uniquely complicated set of stakeholders, the usual solution of empowering shareholders (equity owners) may not be the complete governance solution
B. As the boards at all of the large failures during the crises lacked both banking expertise and expert insiders, there is a an obvious and high correlation between board composition (i.e., independence, banking expertise) and bank failure
C. Regulators have pushed banks to set out a formal board-approved risk appetite. This risk appetite can be translated into an enterprise-wise set of risk limits, but definition and translation of “risk appetite” remains a work-in-progress
D. One of the key levers of the board in determining bank behavior on risk is control over compensation schemes. Some banks have begun to institute reforms such as making bonuses a smaller part of the compensation page, including bonus clawbacks and deferred payments to capture longer-term risks
504.1. B. False. “The crisis reignited a long-term debate about how to ensure that bank boards contain the right balance of independence, engagement and financial industry expertise. However, analysis of failed banks do not show any clear correlation between a predominance of ‘expert insiders’ or ‘independents’ and either failure or success. The first large failure of the crisis, the U.K.’s Northern Rock in 2007, had a number of banking experts on its board.” In regard to (A), (C) and (D), each is TRUE
504.2. Crouhy writes, “The board may be challenged by the complexity of the risk management process, but the principles at a strategic level are quite simple. There are only four basic choices in risk management.” Each of the following of one of his four basic choices EXCEPT which is not?
A. Avoid risk by choosing not to undertake some activities.
B. Transfer risk to third parties through insurance, hedging, and outsourcing.
C. Mitigate (reduce) risk; e.g., mitigate operational risk through preventive and detective control measures.
D. Reclassify (redefine) risk; e.g., exclude liquidity risk from the definition of financial risk,prioritize accounting performance
504.2. D. False. Reclassification and redefinition do not themselves alter risk! In regard to accounting performance, Crouhy says, “the board should ensure that business and risk management strategies are directed at economic rather than accounting performance, contrary to what happened at Enron and some of the other firms involved in highly publicized corporate governance scandals around the turn of the millennium.” In regard to (A), (B) and (C), each is TRUE. Crouhy: “The board may be challenged by the complexity of the risk management process, but the principles at a strategic level are quite simple. There are only four basic choices in risk management: • Avoid risk by choosing not to undertake some activities. • Transfer risk to third parties through insurance, hedging, and outsourcing. • Mitigate risk, such as operational risk, through preventive and detective control measures. • Accept risk, recognizing that undertaking certain risky activities should generate shareholder value. In particular, the board should ensure that business and risk management strategies are directed at economic rather than accounting performance, contrary to what happened at Enron and some of the other firms involved in highly publicized corporate governance scandals around the turn of the millennium.”
504.3. Among the choices, which question probably serves as the best gauge of whether a company takes its risk process seriously?
A. What is the quality and quantity of slogans published because communication is the key?
B. Does the board have a separate Audit committee and is the Audit chairperson a Certified FRM?
C. How is human capital employed; e.g., career paths for risk managers, reporting structure, compensation?
D. Does the board undertake risk Management on a day-to-day basis?
504.3 C. How human capital is deployed
505.1. A key but new (recent) mechanism for risk governance is the risk advisory director. Which of the following best summarizes the function of a risk advisor director?
A. To ensure the accuracy of the bank’s financial and regulatory reporting, and the bank’s compliance with minimum or best-practice standards in other key activities; e.g., regulatory, legal, compliance, and risk management activities
B To improve the overall efficiency and effectiveness of the senior risk committees and the audit committee, as well as the independence and quality of risk oversight by the main board
C. To be responsible for independently reviewing the identification, measurement, monitoring, and controlling of credit, market, and liquidity risks, including the adequacy of policy guidelines and systems
D. To design and implement the incentive pay and compensation schemes for executives and staff
505.1. B. To improve the overall efficiency and effectiveness of the senior risk committees and the audit committee, as well as the independence and quality of risk oversight by the main board Crouhy: “Not all board members will have the skills to determine the financial condition of a complex risk-taking corporation such as a bank (or an insurance company, or an energy company). This is especially likely if the selection of non-executives on the board is designed to include non-executives who come from outside the firm’s industry and are truly independent of the corporation. This is a problem because many of the recent corporate governance scandals have shown that it is easy for executives to bamboozle non-executives who lack the skills to ask probing questions, or to understand the answers to these questions in a rigorous manner … One approach is for the board to gain the support of a specialist risk advisory director–that is, a member of the board (not necessarily a voting member) who specializes in risk matters. An advisory director works to improve the overall efficiency and effectiveness of the senior risk committees and the audit committee, as well as the independence and quality of risk oversight by the main board.”
505.2. Each of the following is true about the re-empowered role of the Chief Risk Officer (CRO) EXCEPT which is false? A. The CRO should report to line business management, but should be independent of both the CEO and the board’s risk committee B. The CRO must evaluate all new financial products to verify that the expected return is consistent with the risks undertaken C. CROs should not just be after-the-fact risk managers but also risk strategists D. The CRO they should play a significant role in determining the risks that the bank assumes as well as helping to manage those risks.
505.2. A. False. To ensure there is a strategic focus on risk management at a high level, the CRO in a bank or other financial institution should report to the chief executive officer (CEO) and have a seat on the risk management committee of the board. Crouhy: “The financial crisis highlighted the need to re-empower risk officers in financial institutions, particularly at a senior level. The key lessons are: • CROs should not just be after-the-fact risk managers but also risk strategists; that is, they should play a significant role in determining the risks that the bank assumes as well as helping to manage those risks. To ensure there is a strategic focus on risk management at a high level, the CRO in a bank or other financial institution should report to the chief executive officer (CEO) and have a seat on the risk management committee of the board. • The CRO should engage directly, on a regular basis, with the risk committee of the board. The CRO should also report regularly to the full board to review risk issues and exposures. A strong independent voice will mean that the CRO will have a mandate to bring to the attention of both line and senior management, or the board, any situation that could materially violate risk appetite guidelines. • The CRO should be independent of line business management and have a strong enough voice to make a meaningful impact on decisions. • The CRO must evaluate all new financial products to verify that the expected return is consistent with the risks undertaken, and that the risks are consistent with the business strategy of the institution.”
505.3. Crouhy writes, “To achieve best-practice corporate governance, a corporation must be able to tie its board-approved risk appetite and risk tolerances to particular business strategies. This means, in turn, that an appropriate set of limits and authorities must be developed for each portfolio of business and for each type of risk (within each portfolio of business), as well as for the entire portfolio.” According to Crouhy, which of the following statements is true about limits and limit standard policies?
A. Limits are effective for market risk but they cannot be applied to credit risk
B. Limits should be calibrated such that in the normal markets exposures average about 100% of the limit
C. Two different types of limits–e.g., Type A (Tier 1) and Type B (Tier 2)–should be avoided because this encourages “cherry picking” the more accommodating limit
D. Limits should be expressed in normal markets (e.g., VaR) but they should also be expressed in worst-case scenarios, probably by scenario analysis and/or stress testing
505.3. D. Limits should be expressed in normal markets (e.g., VaR) but they should also be expressed in worst-case scenarios, probably by scenario analysis and/or stress testing Crouhy: “Limits and Limit Standards Policies: To achieve best-practice corporate governance, a corporation must be able to tie its board-approved risk appetite and risk tolerances to particular business strategies. This means, in turn, that an appropriate set of limits and authorities must be developed for each portfolio of business and for each type of risk (within each portfolio of business), as well as for the entire portfolio. [In regard to false A:] Market risk limits serve to control the risk that arises from changes in the absolute price (or rate) of an asset. Credit risk limits serve to control and limit the number of defaults as well as limit a downward migration in the quality of the credit portfolio (e.g., the loan book). The bank will also want to set tight policies regarding exposure to both asset/ liability management risk and market liquidity risk, especially in the case of illiquid products … [In regard to true D:] As we discuss further in Chapter 7 , risk-sensitive measures such as VaR are useful for expressing risk in normal market conditions and for most kinds of portfolios, but less good in extreme circumstances or for specialized portfolios (e.g., certain kinds of option portfolios). So limits should also be related to scenario and stress testing measures to make sure the bank can survive worst-case scenarios— e.g., extreme volatility in the markets. [In regard to false C:] Most institutions employ two types of limits— let’s call them limit type A and limit type B. • Type A (often referred to as tier 1) limits might include a single overall limit for each asset class (e.g., a single limit for interest rate products), as well as a single overall stress test limit and a cumulative loss from peak limit. • Type B (often referred to as tier 2) limits are more general and cover authorized business and concentration limits (e.g., by credit class, industry, maturity, region, and so on) … [In regard to false B:] It’s not realistic on practical grounds to set limits so that they are likely to be fully utilized in the normal course of events— that would be bound to lead to limit transgressions. Instead, limit setting needs to take into account an assessment of the business unit’s historical usage of limits. • For example, type A limits for market risk might be set at a level such that the business, in the normal course of its activities and in normal markets, has exposures of about 40 percent to 60 percent of its limit. Peak usage of limits, in normal markets, should generate exposures of perhaps 85 percent of the limit.”
506.1. James Lam considers different, valid definitions for enterprise risk management (ERM) by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and the International Organization of Standardization (ISO) but settles on his own definition: “Risk is a variable that can cause deviation from an expected outcome. ERM is a comprehensive and integrated framework for managing key risks in order to achieve business objectives, minimize unexpected earnings volatility, and maximize firm value.” He claims that ERM offer the potential to confer three major benefits: increased organizational effectiveness, better risk reporting, and improved business performance. However, to achieve successful ERM is not easy. According to Lam, there are requirements, or prerequisites, to the achievement of successful ERM. Each of the following is a prerequisite to successful ERM EXCEPT which is not? a) The integration of internal and external communications (including investor and public relations) that support a successful ERM launch date; the timing of the switch to ERM should be coordinated on a specific date as this avoids a long project with overruns and encourages accountability b) The integration of risk transfer strategies which takes a portfolio view of all types of risk within a company and rationalizes the use of derivatives, insurance, and alternative risk transfer products to hedge only the residual risk deemed undesirable by management. c) An integrated risk organization which probably implies a centralized risk management unit (RMU) reporting to the Chief Executive Officer (CEO) and a Chief Risk Officer (CRO) who is responsible for overseeing all aspects of risk within the organization d) The integration of risk management into the business processes of a company which enables a shift from defensive or control-oriented approaches to managing downside risk (or earnings volatility) in favor of risk as “an offensive weapon for management”
506.1. A. False, ERM is not evinced by a switch on a specific date: “All this integration is not easy. For most companies, the implementation of ERM implies a multi-year initiative that requires ongoing senior management sponsorship and sustained investments in human and technological resources. Ironically, the amount of time and resources dedicated to risk management is not necessarily very different for leading and lagging organizations.” In regard to (B), (C) and (D), each are TRUE. Lam (emphasis ours): “ERM is all about integration, in three ways. 1. First, enterprise risk management requires an integrated risk organization. This most often means a centralized risk management unit reporting to the CEO and the Board in support of their corporate- and board-level risk oversight responsibilities. A growing number of companies now have a Chief Risk Officer (CRO) who is responsible for overseeing all aspects of risk within the organization— we’ll consider this development later. 2. Second, enterprise risk management requires the integration of risk transfer strategies. Under the silo approach, risk transfer strategies were executed at a transactional or individual risk level. For example, financial derivatives were used to hedge market risk and insurance to transfer out operational risk. However, this approach doesn’t incorporate diversification within or across the risk types in a portfolio, and thus tends to result in over-hedging and excessive insurance cover. An ERM approach, by contrast, takes a portfolio view of all types of risk within a company and rationalizes the use of derivatives, insurance, and alternative risk transfer products to hedge only the residual risk deemed undesirable by management. 3. Third, enterprise risk management requires the integration of risk management into the business processes of a company. Rather than the defensive or control- oriented approaches used to manage downside risk and earnings volatility, enterprise risk management optimizes business performance by supporting and influencing pricing, resource allocation, and other business decisions. It is during this stage that risk management becomes an offensive weapon for management.”
506.2. The role of Chief Risk Officer (CRO) is clearly gaining in prominence. According to James Lam, the CRO is responsible for: • Providing the overall leadership, vision, and direction for enterprise risk management; • Establishing an integrated risk management framework for all aspects of risks across the organization; • Developing risk management policies, including the quantification of the firm’s risk appetite through specific risk limits; • Implementing a set of risk indicators and reports, including losses and incidents, key risk exposures, and early warning indicators; • Allocating economic capital to business activities based on risk, and optimizing the company’s risk portfolio through business activities and risk transfer strategies; • Communicating the company’s risk profile to key stakeholders such as the board of directors, regulators, stock analysts, rating agencies, and business partners; and • Developing the analytical, systems, and data management Given these responsibilities, Lam says an ideal CRO would have superb skills in five areas (“While it is unlikely that any single individual would possess all of these skills, it is important that these competencies exist either in the CRO or elsewhere within his or her organization.”). Those five skills are: • Leadership skills to hire and retain talented risk professionals and establish the overall vision for ERM • Evangelical skills to convert skeptics into believers, particularly when it comes to overcoming natural resistance from the business units. • Stewardship to safeguard the company’s financial and reputational assets • Technical skills in big data analytics which requires some background in programming code preferably with R and/or python • Consulting skills in educating the board and senior management, as well as helping business units implement risk management at the enterprise level However, which of the above skills is inaccurately specified (defined)? a) Leadership b) Evangelical c) Stewardship d) Technical
506.2. D. Should be “Technical skills in strategic, business, credit, market, and operational risks.” Otherwise, the five skills are correctly specified.
506.3. According to James Lam, a successful enterprise risk management (ERM) program can be broken down into seven key components: 1. Corporate Governance 2. Line Management 3. Portfolio Management 4. Risk Transfer 5. Risk Analytics 6. Data and Technology Resources 7. Stakeholders Management To which component does this key activity–i.e., pricing of risk at its inception– primarily refer? a) Corporate Governance b) Line Management c) Portfolio Management d) Risk Transfer
506.3. B. Line Management Lam: “Line Management: Perhaps the most important phase in the assessment and pricing of risk is at its inception. Line management must align business strategy with corporate risk policy when pursuing new business and growth opportunities. The risks of business transactions should be fully assessed and incorporated into pricing and profitability targets in the execution of business strategy. Specifically, expected losses and the cost of risk capital should be included in the pricing of a product or the required return of an investment project. In business development, risk acceptance criteria should be established to ensure that risk management issues are considered in new product and market opportunities. Transaction and business review processes should be developed to ensure the appropriate due diligence. Efficient and transparent review processes will allow line managers to develop a better understanding of those risks that they can accept independently and those that require corporate approval or management.”
507.1. Which is the best definition of a firm’s risk appetite? a) The existing levels of risk being run by a firm b) The maximum amount of risk a firm is technically able to assume given its capital base c) The amount and type of risk that a company is able and willing to accept in pursuit of its business objectives d) The norms and traditions of behavior of individuals and of groups within an organization that determine the way in which they identify, understand, discuss, and act on the risks the organization confronts and the risks it takes
507.1. C. True: Risk appetite is the amount and type of risk that a company is able and willing to accept in pursuit of its business objectives. • In regard to incorrect (A) and (B), “Risk appetite in this sense is linked to but conceptually separate from ‘risk capacity,’ which is the maximum amount of risk a firm is technically able to assume given its capital base, liquidity, borrowing capacity, and regulatory constraints. It is also distinct from but related to the existing levels of risk being run by a firm. It is obviously essential to ensure that a firm’s risk appetite is defied in such a way as to ensure that it does not exceed the firm’s risk capacity.” • In regard to incorrect (D), “Risk culture can be defined as the norms and traditions of behavior of individuals and of groups within an organization that determine the way in which they identify, understand, discuss, and act on the risks the organization confronts and the risks it takes.”
507.2. Which of the following is true about the firm’s risk appetite framework (RAF)? a) A risk appetite framework (RAF), if supported by a strong risk culture, should be able to substitute for systems, controls and limits b) The risk appetite framework should be developed in a top-down style, at the board, and should produce a discrete set of mechanisms c) Aspirational statements relating to “zero tolerance” of certain types of risk are essential as most risks can be completely avoided d) The risk appetite framework is an iterative learn-by-doing process which requires significant time and resources and yields a diversity of of approaches among firms
507.2. D. True: The risk appetite framework is an iterative learn-by-doing process which requires significant time and resources and yields a diversity of approaches among firms Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions, Institute of international Finance: “Developing a risk appetite framework requires significant time and intellectual resources. The firms that have made the most progress report a substantial element of ‘learning by doing’ in an iterative manner over time, and that ongoing dialogue and communication at all levels of the firm have been crucial in this process. Risk appetite cannot be implemented through top-down decrees, but instead needs to be embraced and understood throughout a firm. Business leaders need to be given time to define and embed the concepts of risk appetite into their decision-making processes, and this engagement takes time to evolve and mature. For this reason, the creation and evolution of a strong risk appetite framework is a multiyear journey—results do not appear instantly.” • In regard to (A), (B) and (C), these are each false.
507.3. If we want to evaluate a firm in order to determine whether they have a robust risk appetite framework (RAF) and whether the firm has a strong risk culture, according to the Institute of International Finance, which of the following is LEAST indicative or LEAST relevant to the evaluation? a) Simple and uniform set of indicators which can be monitored on a single screen (dashboard view) b) Inextricable link to strategy development and business plans c) Clarity of ownership and responsibility of risk d) Regular dialog (communication) about risk appetite and evolving risk profiles
507.3. A. False: It is not possible to look at a simple and uniform set of indicators. IIF: “Supervisors are encouraged to take a broad perspective when forming views regarding firms’ commitment to, and progress in, the implementation of RAFs. The process is complex and time consuming, and it touches fundamentally on culture and behaviors in organizations. Assessments of commitment and success need to reflect this complexity. Successful outcomes are not reflected in the creation of ever more granular limit structures, and no single set of indicators or checklists can capture individual firm’s progress in this area.” • In regard to (B), (C) and (D), each is true and highly relevant to an evaluation.
Three categories of financial disasters
• Due to misleading reporting (incorrect market information): cases where the “striking feature” is that a firm, or its investors and lenders, have been misled with deliberate intent about the size and nature of its position(s) • Due to large market moves: positions were known, but market moves were not anticipated • Due to conduct of customer business: did not involve direct financial loss to the firm, but were a matter of reputational risk due to the conduct of customer business.
50.1 Steven Allen classifies the Drysdale bankruptcy as which type of financial disaster? a) Case in which firm/investors were misled (misleading reporting) b) Losses from unexpectedly large market moves (disasters due to large market moves) c) Fiduciary or reputational exposure to customer positions (due to conduct of customer business) d) None of the above
50.1 A. (Misleading reporting) “There is not much question as to how Drysdale managed to obtain the unsecured funds. They took systematic advantage of a computational shortcut in determining the value of borrowed securities.”
- 2 The key lesson learned from the Drysdale bankruptcy concerned what practice?
a) Need to investigate stream of large profits
b) Need to separate front and back offices
c) Correlations spike to almost one in a crisis
d) Collateral value determination
50.2. D. (collateral value determination) “The securities industry as a whole learned that it needed to make its methods for computing collateral value on bond borrowings more precise. Chase, and other firms who may have had similar control deficiencies, learned the need for a process that forced areas contemplating new product offerings to receive prior approval from representatives of the principal risk control functions within the firm.
50.3 Of which bond feature did Drysdale take systematic advantage? a) Embedded call option b) Short-term yield volatility c) Accrued coupon interest d) Long-maturity bond duration
50.3 C. (Accrued coupon interest) “To save time and effort, borrowed securities were routinely valued as collateral without accounting for accrued coupon interest. By seeking to borrow large amounts of ecurities with high coupons and a short time left until the next coupon date, Drysdale could take advantage of the difference in the amount of cash the borrowed security could be sold for (which INCLUDED accrued interest) and the amount of cash collateral that need to be posted against the borrowed security (which did NOT include accrued interest).
51.1. What happened at Kidder Peabody? a) Kidder Peabody lost ~$350 million in cash due to market risk b) Kidder Peabody lost ~$350 million in cash due to operational risk c) Previously reported booked gains of ~$350 were found to be artificial d) Collateral calls of about $350 million triggered a bankruptcy
51.1 C. (artificial gains) “Joseph Jett entered into a series of trades that were incorrectly reported in the firm’s accounting system, artificially inflating reported profits. When this was ultimately corrected in April 1994, $350 million in previously reported gains had to be reversed … Jett’s trades had not resulted in any actual loss of cash for Kidder.” … Although it is estimated that he additionally hid about $85 million in actual losses
51.2 Which enabled the failure at Kidder Peabody? a) Jett exceeded position limits in regard Treasury STRIPS b) Jett took positions in forward recons, which were prohibited instruments c) Accounting loophole in regard to collateral valuation d) Accounting loophole in regard to forward contracts
51.2. D. (Accounting loophole in regard to forward “recon” contracts) In regard to (A) and (B), these are false as “The IS specialists discovered that none of Jett’s trade deals were ever consummated. This meant that while no securities had ever changed hands, the profits associated with these allegedly fictitious trades had been accounted for as income on Kidder’s books.” Rather, Jett exploited the fact that the IS/accounting system allowed him to book the profit on a forward (recon) transaction.
51.3 Which is the lesson(s) learned from the failure at Kidder Peabody? a) Make sure you understand the source of a large, unexpected profits b) Periodically review models and systems c) Both (A) and (B) d) Neither (A) nor (B)
51.3. C. Both (A) and (B) “Two lessons can be drawn from this: Always investigate a stream of large unexpected profits thoroughly and make sure you completely understand the source. Periodically review models and systems to see if changes in the way they are being used require changes in simplifying assumptions.”
52.1 Each of the following is true about Nick Leeson and Barings except which is false? a) Leeson was supposed to be running a low-risk, limited return arbitrage business for Barings in Singapore b) Contrary to an arbitrage strategy, Leeson assumed high volatility and directional exposure to the Nikkei 225 by writing straddles and taking long futures positions c) By booking losses to fictitious, nonexistent customer accounts, Leeson was able to manufacture fairly substantial reported profits for his own accounts, enabling him to earn a $720,000 bonus in 1994. d) Neither fraud nor management incompetence (operational risks) are elements of the Barings case study, which instead is primarily about systematic and event risk
52.1 D. False. Fraud and management incompetence are the primary elements in the Barings case Miller: “A certain amount of credit must be given to Leeson’s industriousness in perpetrating a deliberate fraud. He worked hard at creating false accounts and was able to exploit his knowledge of weaknesses in the firm’s controls. However, anyone reading an account of the incident will have to give primary credit to the stupendous incompetence on the part of Barings’ management, which ignored every known control rule and failed to act on myriad obvious indications of something being wrong. What is particularly amazing is that all those trades were carried out in exchange-traded markets that require immediate cash settlement of all positions, thereby severely limiting the ability to hide positions (although Leeson did even manage to get some false reporting past the futures exchange to reduce the amount of cash required).” In regard to (A), (B), and (C), each is TRUE
52.2 Based on the assigned reading, what was arguably the largest single failure by the management of Barings? a) They did not implement position limits for all possible instruments b) They allowed Leeson to be both chief trader and head of settlements c) Positions should have required daily cash settlement (margin would have exposed the losses) d) They did not hire a consultant to implement training to build risk awareness and promote a risk culture
52.2 B. They allowed Leeson to be both chief trader and head of settlements. The most egregious violation was that Leeson was allowed to simultaneously, effectively manage both the front and back offices. Allen: “the most blatant of management failures was an attempt to save money by allowing Leeson to function as head of trading and the back office at an isolated branch.” In other words, he was able to facilitate the fraud because there was no independent back office.
