1
Q
Definition: Risk Tolerances
A
A subjective / cultural decision about where the firm wants to be on the risk spectrum
2
Q
Definition: Operationalising Risk Appetite
A
Reflecting the setting of targets & limits across the org & the breakdown of high-level risk appetite statements into more detailed risk tolerances
3
Q
Definition: Risk Limits
A
A group of guidelines that set limits on acceptable actions that might be taken today
4
Q
Definition: Risk Capacity
A
The volume of risk an org can take as measured by some consistent measure, such as economic capital
5
Q
Definition: Utility Function
A
A measure of happiness / satisfaction expressed as a function of wealth, w
6
Q
List: Properties of Realistic Utility Functions (2)
A
- Monotonically Increasing - Investors are non-satiated i.e. U’(w)>0
- Concave: Exhibit diminishing marginal utility since investors value incremental increases in wealth less as wealth increases i.e. U’‘(w)<0
7
Q
Definition: Increasing Absolute Risk Aversion
A
Investors become more risk averse as wealth increases
8
Q
Definition: Increasing Relative Risk Aversion
A
Investors would invest a smaller proportion of their wealth in risky assets as wealth increases
9
Q
Definition: Prospect Theory (3)
A
Behavioural alternative to expected utility theory:
1. Loss Aversion - Losses are felt more strongly than equivalent gains (roughly 2x)
2. Reference Dependence - Outcomes evaluated relative to a reference point, not absolute wealth
3. Diminishing Sensitivity - The marginal impact of gains/losses decreases as they get larger (concave for gains, convex for losses)
10
Q
Definition: RM Policy
A
Sets out how an org will manage each category of risk to which it is exposed
11
Q
List: Board-approved RM Policy Inclusions (3)
A
- Objectives & definitions
- RM org structure
- RM processes & benchmarks
12
Q
List: Monitoring Requirements (4)
A
- Data & resources
- Documentation
- Information
- Communication
13
Q
List: Types of Communications (5)
A
- Internal (Management Info) - Info about what is happening inside the business
- External (Inwards) - Collecting relevant info about what is happening outside the company
- External (Outwards) - Distributing info about the company to interested parties
- Informal - By word-of-mouth or social media
- Formal - Through a corporate intranet or management info system
14
Q
List: KRI Design Considerations (5)
A
- Policies & regulations
- Strategies & objectives
- Past losses & incidents
- Stakeholder requirements
- Risk assessments
15
Q
List: Desirable KRI Features (11)
A
- Based on consistent methodology & standards
- Incorporates key risk drivers
- Tracked over time
- Tied to objectives
- Linked to accountable individuals
- Useful in decision making
- Able to be benchmarked externally
- Timely
- Cost effective
- Simple
- Quantifiable
16
Q
List: Desirable Risk Report Features (8)
A
- Clear, relevant, timely & reliable
- Role-based summary with the ability to drill down into more detail
- Link clearly to decision-making
- Single point of access
- Mixture of external / internal & qualitative / quantitative data (KRI’s)
- Tabular or graphic formats for understanding
- Traffic light system to highlight priority areas
- Provide opportunity for comments / analysis
17
Q
List: Balanced Scorecard Assessment Areas (4)
A
- Finance - Financial performance measures
- Stakeholders - Customer satisfaction & engagement
- Internal Processes - Efficiency of business operations
- Growth & Learning - Innovation, training & development
18
Q
Definition: Stakeholders
A
Someone who supports & participates in the survival & success of a company
19
Q
List: Role of Government (4)
A
- Setting regulations & legislation
- Intervene
- Lender of last resort
- Force nationalisation
20
Q
List: Key Risks Faced by Professional Advisers (3)
A
- Reputational risk
- Risk of litigation
- Conflict of interest
21
Q
List: Reasons to Separate Ownership from Management (3)
A
- Those with expertise in running a business to have decision-making responsibilities, without being required to invest capital
- Individuals or institutions to invest without getting involved in the day-to-day running
- Continuity of management despite frequent changes in ownership
22
Q
List: Key Responsibilities of the CRO (12)
A
- Providing overall leadership & direction for ERM
- Overseeing the dev / implementation / maintenance of an ERM framework
- Managing the RM function
- Ongoing risk policy dev & monitoring adherence
- Reporting on risk to internal decision-makers & external decision makers
- Challenging & overseeing areas of the business w.r.t. risk
- Managing / optimising the risk portfolio
- Appropriate allocation of capital to business activities
- Dev data systems & risk models to carry out high-quality analysis, monitoring & management of risk
- Safeguarding the company’s financial & reputational assets
- Maintaining expertise & advising on matters of RM
- Supporting an appropriate risk culture across the business
23
Q
List: Key CRO Skills (5)
A
- Leadership
- Evangelism
- Advising / Consulting
- Stewardship
- Technical Competence
24
Q
List: Selection Criteria for a RM Expert (6)
A
- Understanding of RM & governance
- Knowledge of relevant regulation & legislation
- Experience ID, assessing & managing risks
- Ability to lead, advise the Board & challenge management on risk strategies & plans
- Experience in RM tools & applications
- Understanding of usefulness & limitations of RM strategies
25
Definition: 1st Line of Defence
Line management staff in the business units - Accountable for measuring & managing risk in the individual business units daily
26
Definition: 2nd Line of Defence (1-3)
The CRO, RM Function & Compliance Team:
1. Accountable for establishing risk & compliance programs & policies
2. Supporting & monitoring the line management
3. Reporting to the board
27
Definition: 3rd Line of Defence
The Board & Audit Function - Accountable for effective governance of the RM process, setting RM strategy, approving policies & ensuring ERM is effective
28
List: Role of the CRF (7)
1. Giving advice to the Board on risk
2. Assessing the overall risks being run by the business
3. Making comparisons of the overall risks being run with its appetite
4. Acting as a central focus point for staff to report new & enhanced risks
5. Giving guidance to line managers about the ID & management of risks, making suggestions for risk responses
6. Monitoring progress on RM
7. Pulling the whole picture together
29
Definition: Offence vs Defence
First 2 lines set up to oppose each other - Business units focus on maximising income & RM focuses on minimising losses
30
Definition: Policy & Policing
Business units operate within rules, set by the RM function & policed by the RM, Audit & Compliance Functions
31
List: Problems with the Policy & Policing Model (4)
1. Policies quickly go out-of-date as RM function not in touch with day-to-day operations
2. Audit & compliance reviews do not occur continuously, so may fail to ID issues
3. Friction between line managers & RM
4. Line management have little incentive to report problems, policy violations & issues where it is uncertain whether it has occurred
32
Definition: Partnership Model
RM staff are integrated in a client-consultant type relationship to manage risk
33
List: Skills Required with a Risk Function (5)
1. Project management
2. Change management
3. Relationship management
4. Technical expertise
5. Implementation skills
34
List: Considerations for RM Plans (4)
1. Business strategy
2. New product / business dev
3. Pricing
4. Risk & Incentive compensation
35
List: Responsibilities of the Audit Function (5)
1. Monitoring compliance with laws & regs
2. Checking for system errors
3. Looking for non-observance of internal governance codes
4. Examination of key spreadsheets to ensure that they do not contain errors which might emerge occasionally but with devastating effect
5. Examination of procedures for paying insurance premiums on time, & observing insurance conditions
36
List: Process to Produce & Maintain a Comprehensive ID & Assessment of Risks
| (6 - BIAL PR)
1. Business analysis
2. ID the risks the company faces in a structured way
3. Obtain agreement on risks faced, the relationship between them & ID individuals who will be responsible for each risk & its management
4. Evaluate the risks i.t.o. their likelihood & impacts
5. Produce a risk register to record the results
6. Review the register regularly
37
List: Key Components of a Business Plan (8)
1. Statement of business objectives
2. Description of business, products & services
3. Description of economic environment
4. ID of perceived key risks including upside risks
5. Description of strategy
6. Description of org structure
7. Forecast of expected financial outcomes
8. Statements of key assumptions & sensitivity of expected outcomes
38
List: Lam's 4-Stage Risk ID & Assessment Process (4)
| FIRE
1. Foundation setting
2. Risk ID, assessment & prioritisation
3. Deep dives, risk quantification & management
4. Business & ERM integration
39
List: Tools Used During Risk ID Process (6)
1. SWOT analysis
2. Risk checklist
3. Risk prompt list
4. Risk taxonomy
5. Case studies
6. Process analysis
40
List: Qualitative Techniques Used During Risk ID Process (7)
1. Brainstorming
2. Independent group analysis
3. Surveys
4. Gap analysis
5. Delphi technique
6. Interviews
7. Working groups
41
List: Key Elements of a Risk Register (7-4)
1. Risks easily ID'd
2. Risk categories
3. Clear risk descriptions
4. Initial assessments of:
a. Likelihood of occurence
b. Impact
c. Timeframe
d. Relationship with other risks
5. Risk response action & its cost, expected residual
6. Individuals involved in monitoring & managing the risk
7. Document control info
42
Definition: Emerging Risks
Developing or already known risks which are subject to uncertainty & ambiguity & are therefore difficult to quantify using traditional risk assessment techniques
43
List: Characteristics of Emerging Risks (6)
1. Greater uncertainty
2. Uncertain time horizon
3. Difficult to quantify
4. Generally external to an org
5. Often significant in size & scale
6. Often arise because of global trends
44
Definition: Cyber Risk
Any risk of financial loss, disruption or damage to the reputation of an org from some sort of failure of its IT systems
45
List: Cyber Risk Controls (4)
1. Strong IT security
2. Clear policies & governance for users
3. Incident management processes
4. Regular review
46
Definition: Climate Change Risk
Risks arising from adverse changes in the physical environment & secondary impacts in the economy at a regional or global scale
F106 V2
flashcards
Decks in class (6)
# Cards
