CMA Final · Risk Management in Banking and Insurance

Introduction to Risk Management: formula sheet

Full chapter guide

Key formulas

Risk vs uncertainty: Risk = outcomes known + probabilities measurable; Uncertainty = outcomes or probabilities not measurable; Use this one-line test whenever a question asks you to distinguish the two.
Credit risk: Credit risk = loss from borrower or counterparty default or downgrade; Trigger words: default, non-payment, NPA, rating downgrade, counterparty.
Market risk: Market risk = loss from changes in interest rates, exchange rates, equity and commodity prices; Trigger words: price fall, mark-to-market loss, rate rise, currency move.
Liquidity risk: Liquidity risk = inability to meet obligations as they fall due at reasonable cost; Two forms: funding liquidity and market liquidity.
Operational risk: Operational risk = loss from inadequate or failed processes, people, systems or external events; Trigger words: fraud, system failure, human error, cyber attack.
Business risk: Business risk = loss of earnings from strategy, competition, demand or environment; Trigger words: market share loss, falling margins, wrong strategy.
Risk management cycle: Identify → Measure → Monitor → Control → Report (then repeat); Learn the order. Questions often ask you to place an activity in the correct step.
Expected loss (credit risk measure): EL = PD × LGD × EAD; A common measurement example. PD is probability of default, LGD is loss given default, EAD is exposure at default.
Risk appetite and limits: Risk appetite (Board) → Risk limits (management) → Actual exposure (monitored); Actual exposure must stay within limits, and limits within appetite.
Three lines of defence: 1st line = business owns and manages risk; 2nd line = risk and compliance oversee and challenge; 3rd line = internal audit gives independent assurance; Learn the role of each line in one phrase: own, oversee, assure.
Risk capacity, appetite and limits: Risk limits ≤ Risk appetite ≤ Risk capacity; Capacity is the maximum the bank can bear. Appetite is what the board chooses to accept, below capacity. Limits are the operating controls that keep the bank within appetite.
Board and management split: Board: sets strategy, appetite and policy and oversees; Management: implements and reports; The board does not run daily risk decisions. It approves and oversees.
CRO independence: CRO reports independently of business lines, with access to the board or its risk committee; Independence is the key point examiners test.
Capital Adequacy Ratio (CRAR): CRAR = (Tier 1 capital + Tier 2 capital) ÷ Risk-weighted assets × 100; RBI's minimum is 9% for Indian scheduled commercial banks. The Basel minimum is 8%.
Risk-weighted assets (credit risk): RWA = Σ (Exposure × Risk weight); Add market-risk and operational-risk RWA to get total RWA. Off-balance sheet items are first converted using credit conversion factors.
Three pillars of Basel II: Pillar 1: Minimum capital | Pillar 2: Supervisory review | Pillar 3: Market discipline; Pillar 2 includes ICAAP; Pillar 3 is disclosure.
Basel III capital structure: Total capital = Tier 1 (Common Equity Tier 1 + Additional Tier 1) + Tier 2; Tier 1 is going-concern capital. Tier 2 is gone-concern capital.
Basel III minimum ratios under RBI: CET1 ≥ 5.5% | Tier 1 ≥ 7% | Total capital ≥ 9% | Capital conservation buffer = 2.5% of RWA (in CET1); With the buffer, effective CET1 is 8%, Tier 1 is 9.5% and total capital is 11.5%. Check the latest RBI circular if the question gives different figures.
Leverage ratio: Leverage ratio = Tier 1 capital ÷ Total exposure (not risk-weighted); A non-risk-based backstop. It limits build-up of leverage.
VaR for a normal return distribution: VaR = Z × σ × Portfolio value; Z is 1.645 for 95% and 2.33 for 99% (one-tailed). σ is the standard deviation of returns for the holding period.
Scaling VaR over time: N-day VaR = 1-day VaR × √N; Valid under the square-root-of-time assumption, which needs independent daily returns with constant volatility.
Gap: Gap = RSA − RSL; Calculated for each time bucket. Cumulative gap is the running total.
Change in NII from gap: ΔNII = Gap × Δi; Δi is the rate change for the period. Use the gap of the bucket and adjust for the fraction of the year if the bucket is shorter.
RAROC: RAROC = (Revenue − Costs − Expected loss) ÷ Economic capital; Some texts add the return on capital. Use the definition given in the question.
Risk-return decision rule: Accept if RAROC > hurdle rate; The hurdle rate is usually the cost of equity.

Quick revision

Risk is the possibility that actual outcomes differ from expected ones, which can mean loss.
Main banking risks: credit, market, liquidity and operational.
Credit risk arises when a borrower or counterparty fails to meet obligations.
Market risk comes from movements in interest rates, exchange rates and prices.
Liquidity risk is the inability to meet payments as they fall due.
Operational risk arises from failed processes, people, systems or external events.
The process runs: identify, measure, control or mitigate, monitor and report.
The board holds ultimate responsibility for risk oversight.
Risk culture is how people behave about risk when no one is watching.
Basel norms set international standards for bank capital and risk management.
Higher expected return usually comes with higher risk, so compare return against risk taken.
Every measurement tool has limits, so state the assumption behind any figure.

Common mistakes

Treating risk and uncertainty as the same thing. Fix: State the test: risk has measurable probabilities, uncertainty does not. Add one example for each.
Calling a loss from a fall in bond prices credit risk. Fix: If the issuer still pays but the price falls because rates rose, it is market risk. Credit risk needs default or downgrade.
Mixing up monitoring and control. Fix: Monitoring only tracks and flags a breach. Control is the action taken to bring risk back within limits.
Treating the process as a one-time line. Fix: State that it is a continuous cycle and show how reports feed back into identification and limits.
Placing internal audit in the second line. Fix: Compliance and risk are second line. Internal audit is third line because it gives independent assurance on the other two.
Saying the first line is only the front office or sales team. Fix: The first line is every unit that takes or originates risk and owns its controls, including operations and credit origination.
Dividing capital by total assets instead of risk-weighted assets. Fix: Always convert each asset to RWA using its risk weight. Only the leverage ratio uses unweighted exposure.
Mixing up Pillar 2 and Pillar 3. Fix: Pillar 2 is the supervisor reviewing the bank's capital process (supervisory review). Pillar 3 is the bank disclosing information to the market (market discipline).
Saying VaR is the maximum possible loss Fix: Say it is the loss not expected to be exceeded at the stated confidence level and period. Losses beyond it can occur.
Scaling VaR by N instead of √N Fix: Multiply 1-day VaR by √N, under the stated assumptions.

Exam tips

In MCQs, find the cause of loss first and ignore the amount; the amount rarely decides the risk class.
In case scenarios, one event may fit several risks. Pick the one that started the chain.
When asked to distinguish risk and uncertainty, write at least three points: measurability, probability, and manageability, with an example.
For descriptive answers, give a definition, a banking example and a control measure for each risk.
Keep one-line definitions ready for all five risks; they score quickly.
Always list the five steps in order, then explain each with a bank example. Marks follow the steps.
In case questions, tie each step to facts in the case rather than giving generic text.
For framework questions, include appetite, policy, limits, roles, independent review and culture.