CFA Level I · CFA Level I Exam

Introduction to Risk Management: formula sheet

Full chapter guide

Key formulas

Risk management process (cycle): Set governance and tolerance → Identify risks → Measure risks → Choose a response (avoid, mitigate, transfer, share, or accept) → Implement → Monitor, report and adjust; The process repeats continuously. Exact wording of steps varies, so learn the logic and order.
Risk tolerance: Risk tolerance = the amount of risk an organization is willing and able to take; Think of willingness (attitude) and ability (capacity). When the two conflict, the lower (more conservative) of the two generally governs.
Risk budgeting: Total risk budget = Σ risk allocated to each activity, portfolio or unit; Risk is allocated by expected reward and fit with objectives. Measures such as volatility or VaR are often used, but allocations do not always add up simply because of diversification.
Framework components: Governance, identification and measurement, infrastructure, policies and processes, mitigation and management, communication, strategic analysis and integration; Know these as the building blocks of a framework.
Risk tolerance: Risk tolerance = willingness to take risk + ability (capacity) to bear loss; Set by the board and management before strategy. The more restrictive of the two usually binds.
Risk budget: Total risk budget = Σ risk allocated to each unit or strategy; Allocations are in a common risk measure. Because of diversification, standalone risks usually do not add up to total risk.
Governance vs management: Governance = set direction and oversee; Management = identify, measure, treat and report; Use this split to answer who-does-what questions.
Market risk: Loss from adverse moves in equity prices, interest rates, FX rates or commodity prices; Source is the market itself, not a counterparty failure.
Credit risk: Loss from a counterparty failing to pay in full and on time; Also called default or counterparty risk.
Liquidity risk: Loss from being unable to trade quickly at a price near fair value; Signs: wide bid-ask spread, thin volume, price concessions.
Operational risk: Loss from failed people, systems, processes or external events; Covers fraud, errors, outages and cyberattacks.
Model risk: Loss from a flawed, misused or badly specified model; Wrong inputs or assumptions also count.
Settlement risk: Loss when one side delivers and the other side does not; Arises in the gap between the two legs of a trade.
Parametric VaR (return form): VaR = [−E(R) + z × σ] × portfolio value; For a loss-side cutoff, z is 1.645 at 5% and 2.33 at 1% (one-tailed, normal). Use E(R) and σ for the same period.
Scaling VaR over time: σ(T days) = σ(1 day) × √T; Valid when daily returns are independent. With the mean set to zero, VaR scales with √T.
Duration price estimate: %ΔP ≈ −ModDur × ΔYield; Good for small yield changes. Use effective duration for bonds with embedded options.
Duration plus convexity: %ΔP ≈ −ModDur × ΔY + ½ × Convexity × (ΔY)²; Convexity adds a positive amount for both rises and falls in yield for an option-free bond.
Delta approximation for options: ΔOption ≈ Delta × ΔUnderlying; Call delta is between 0 and 1. Put delta is between −1 and 0.
Delta-gamma approximation: ΔOption ≈ Delta × ΔS + ½ × Gamma × (ΔS)²; Gamma improves the estimate for larger moves in the underlying.
Beta: β = Cov(Ri, Rm) ÷ Var(Rm); Beta of 1 means the asset moves with the market on average.
Risk prevention and avoidance: Do not undertake the activity; Removes the risk and also the possible return.
Risk acceptance: Retain the risk; active (measured) or passive (unrecognised); self-insurance sets aside own funds; Fits risks that are small or too costly to remove.
Risk transfer: Move the risk to another party, e.g. insurance premium paid for loss cover; Another party bears the loss. Cost is the premium.
Risk shifting: Change the distribution of outcomes, e.g. with derivatives; Alters the shape of outcomes, such as cutting downside while keeping upside.
Likelihood versus severity (general practice): Controls lower the chance of loss; other actions lower the size of loss; A general risk-management distinction, not a separate curriculum category.
Choosing a method: Compare cost of the method with the risk's expected loss and the firm's risk tolerance; A risk should be retained only if it fits risk tolerance and offers adequate reward.

Quick revision

The risk management process sets tolerance, identifies and measures risks, chooses responses, and monitors and adjusts.
Risk governance is the top-level structure for setting risk policy, authority and oversight in an organisation.
Risk tolerance is how much risk an organisation is willing and able to take.
A risk budget allocates the total acceptable risk across activities or units.
Financial risks include market, credit and liquidity risk.
Non-financial risks include operational, model, settlement, regulatory, legal, tax, accounting and sovereign risk.
Operational risk arises from people, systems, processes and external events.
Risk drivers are the underlying exposures that cause risk; metrics are the measures used to quantify it.
VaR is the minimum loss that would be expected to be equalled or exceeded with a given probability over a specific period; it does not describe the worst case.
Avoid means not taking the risk at all; mitigate means reducing its likelihood or impact.
Transfer shifts the risk to another party, such as through insurance; share spreads it across parties.
Enterprise-wide, integrated risk management looks at all risks together, not in silos.

Common mistakes

Thinking the goal of risk management is to minimize or eliminate risk. Fix: Remember that the goal is to take risk deliberately, within tolerance, for adequate return.
Confusing risk tolerance with risk budgeting. Fix: Tolerance is the total risk the organization will bear. Budgeting divides that total among activities.
Treating risk governance and risk management as the same thing. Fix: Governance is oversight and structure. Management is the process of handling risks inside that structure.
Saying risk management should eliminate risk. Fix: The goal is to take the right amount of risk for the expected reward and within tolerance, not to remove all risk.
Calling a borrower's default a market risk because the bond price fell. Fix: Ask why the price fell. If the issuer failed to pay or its credit quality dropped, the root cause is credit risk.
Confusing credit risk with settlement risk. Fix: Settlement risk is the one-sided delivery gap in a trade. Credit risk is the broader chance of nonpayment on an obligation.
Treating VaR as the maximum possible loss. Fix: Say VaR is the loss expected to be equaled or exceeded with the stated probability. Losses can be much larger.
Forgetting to scale volatility to the VaR horizon. Fix: Divide the annual σ by √(periods per year), using the same basis the question gives, such as 250 days.
Calling insurance risk shifting. Fix: Insurance moves the loss to the insurer, so it is transfer. Shifting changes the distribution of outcomes.
Treating prevention and avoidance as two separate curriculum responses. Fix: In the curriculum, prevention and avoidance is one response: not undertaking the activity. The likelihood versus severity split is a general practitioner distinction.

Exam tips

Questions are standalone with three options, so first eliminate any option that says risk should be removed entirely.
Learn the process order cold: governance and tolerance, identify, measure, respond, monitor and adjust.
When you see limits being split across units, think risk budgeting. When you see one overall limit, think tolerance.
Remember that tolerance has two parts, willingness and ability, and that the lower one usually constrains.
There is no penalty for a wrong answer, so never leave a question blank.
Look for the actor in the stem. Board points to oversight and tolerance; CRO or management points to implementation.
Watch for the words firm-wide or integrated. They signal ERM.
Remember tolerance is a ceiling set first, and budgeting follows it.