Corporate Risk Management Performance: formula sheet

Key formulas

Risk exposure (simple scoring)

Risk exposure = Likelihood × Impact

Use probability and rupee loss for an expected loss figure, or scores (for example 1 to 5) for a risk matrix. State which one you use.

Expected loss

Expected loss = Probability of event × Loss if it occurs

Works for a single event. It does not show worst-case exposure, so mention that when you comment.

Residual risk

Residual risk = Inherent risk − Effect of controls and responses

A conceptual relationship, not an exact arithmetic rule. Residual risk is compared with risk appetite.

Risk management process

Set objectives → Identify → Assess → Respond → Monitor and review → Communicate and report

Order your answer in this sequence. Communication and monitoring run through every stage.

Risk response options

Avoid, Reduce (mitigate), Transfer (share), Accept (retain)

Pick the option by comparing the cost of the response with the risk reduced.

Five components of COSO ERM (2017)

Governance and Culture → Strategy and Objective-Setting → Performance → Review and Revision → Information, Communication and Reporting

Learn the order. The last component runs through all the others, and review and revision feeds back into them.

Number of principles

20 principles across the five components

State that principles are grouped under components. Learn the main themes, not necessarily each wording word for word.

Principles under Governance and Culture

Board risk oversight; operating structures; desired culture; commitment to core values; attract, develop and retain capable individuals

Five principles.

Principles under Strategy and Objective-Setting

Business context; risk appetite; alternative strategies; business objectives

Four principles. Risk appetite is set here, before strategy is chosen.

Principles under Performance

Identify risk; assess severity; prioritise risks; implement risk responses; portfolio view

Five principles. The portfolio view looks at risk across the whole entity.

Principles under Review and Revision

Assess substantial change; review risk and performance; pursue improvement in ERM

Three principles.

Principles under Information, Communication and Reporting

Leverage information and technology; communicate risk information; report on risk, culture and performance

Three principles. 5 + 4 + 5 + 3 + 3 = 20.

Risk appetite versus risk capacity

Risk appetite = amount and type of risk the entity is willing to accept in pursuit of value; capacity = maximum risk it can bear

Appetite should sit within capacity.

Risk score

Risk score = Likelihood score × Impact score

Used in a risk matrix. Scales (for example 1-5) are set by the entity.

Expected value of scenarios

EV = Σ (probability × outcome)

Probabilities must add up to 1.

Sensitivity measure

% change in output ÷ % change in input

A larger ratio means the output is more sensitive to that input.

Parametric VaR

VaR = z × σ × Value of position

σ is the standard deviation of returns for the period. Assumes normally distributed returns.

Scaling VaR over time

VaR (T days) = VaR (1 day) × √T

Valid under the usual assumption of independent daily returns and zero mean.

Common z values

95% → 1.645; 99% → 2.33 (approx.)

One-tailed values for VaR.

Forward rate (interest rate parity)

Forward rate = Spot rate × (1 + i of quoted currency) ÷ (1 + i of base currency), for the same period

Quote is units of the quoted currency per unit of the base currency. Use the rates for the contract period, not annual rates, unless the period is one year.

Forward premium / discount (annualised)

(Forward − Spot) ÷ Spot × (12 ÷ months) × 100

A positive result is a premium on the base currency. A negative result is a discount.

Money market hedge, payable abroad

Deposit now = Foreign payable ÷ (1 + foreign deposit rate for the period); rupee cost today = deposit × spot

Borrow in rupees, convert at spot and deposit abroad so the deposit grows to the payable amount.

Option payoff for a call buyer

Payoff = max(Spot at expiry − Strike, 0) − Premium

Maximum loss is the premium. Use a put for protecting a receivable in foreign currency.

Net result of a hedge

Net outcome = Gain or loss on exposure + Gain or loss on hedge − Cost of hedge

Always include the hedge cost, such as the option premium.

Plain interest rate swap net payment

Net payment = (Fixed rate − Floating rate) × Notional × period fraction

Only the net amount changes hands. The notional principal is not exchanged.

RAROC

RAROC = (Revenue − Costs − Expected loss) ÷ Economic capital

Some questions add return on the capital (or tax) in the numerator; follow the data given in the question. Compare with the hurdle rate.

Risk-adjusted profit

Risk-adjusted profit = Net income before risk charge − Expected loss

Expected loss = Probability of default × Exposure × Loss given default, when those inputs are given.

Economic profit (risk-adjusted)

Economic profit = Risk-adjusted profit − (Economic capital × Hurdle rate)

Positive means value is created after charging for capital. It agrees with RAROC > hurdle rate.

Sharpe ratio

Sharpe ratio = (Portfolio return − Risk-free return) ÷ Standard deviation of portfolio return

Higher is better when comparing options with different risk. Uses total risk.

KRI status rule

Green: within threshold; Amber: approaching the limit; Red: limit breached

Thresholds come from the risk appetite. Define them before measuring.

Quick revision

• Risk is uncertainty that can affect objectives, with both downside and upside effects.
• Risk appetite is the amount of risk the firm is willing to accept in pursuit of its objectives.
• COSO ERM links risk management with strategy setting and performance, not only with compliance.
• Identify first, then assess likelihood and impact, then rank and respond.
• Four basic responses: avoid, reduce, share or transfer, and accept.
• Hedging reduces exposure to price risks such as currency, interest rate or commodity movements.
• The board oversees risk; management owns and runs the risk process.
• A risk officer coordinates and reports on risk but does not replace the risk owners in business units.
• Good risk measures are linked to objectives and compared with appetite and tolerance.
• Risk adjustments in valuation can enter through cash flows or the discount rate; avoid doing both for the same risk.
• End every case answer with a clear recommendation and a reason.

Common mistakes

• Treating risk only as a loss or threat. Fix: Define risk as variation from expected outcomes, with both downside and upside. Mention that risk-taking is needed to create value.
• Classifying a risk by its effect instead of its cause. Fix: Ask what failed. A machine breakdown is operational even though it causes a cost. A wrong market entry is strategic.
• Listing the 2004 eight components (such as internal environment and objective setting) as the current framework. Fix: Write the 2017 five components. Mention 2004 only if the question asks about the change.
• Treating ERM and COSO Internal Control as the same framework. Fix: Say ERM is wider: it covers strategy, risk appetite and opportunities. Internal control gives reasonable assurance on operations, reporting and compliance objectives.
• Treating sensitivity and scenario analysis as the same Fix: Sensitivity moves one variable at a time. Scenario moves several linked variables together.
• Reading 95% VaR as the maximum possible loss Fix: Say the loss should not exceed VaR with 95% confidence. In the other 5% of cases, loss can be larger.
• Using 'transfer' and 'share' as if they were identical. Fix: Say transfer when the loss mostly moves to the other party (insurance). Say share when both parties keep part of the risk (joint venture). State this in one line.
• Saying insurance removes all the risk. Fix: Mention residual risk: deductibles, exclusions, reputational damage and counterparty failure remain.
• Ignoring expected loss in the numerator of RAROC. Fix: Always deduct expected loss. Expected loss covers normal losses; economic capital covers unexpected ones.
• Dividing by total assets or book equity instead of economic capital. Fix: Use the economic capital figure given in the question. It reflects the risk of the unit.

Exam tips

• In case questions, tie every risk to a fact in the case. Generic lists score less than applied answers.
• When numbers are given, show the expected loss working, then add a sentence on impact, since expected loss hides severe events.
• Learn the five categories and the four responses cold. Many MCQs test only classification or matching a risk with its response.
• Distinguish clearly between risk appetite, risk tolerance, inherent risk and residual risk. These terms appear in objective questions.
• Finish with a recommendation and a link to strategy or performance. Section A has no negative marking, so attempt every MCQ.
• Learn the five components in order and attach the principle themes to each. This answers most MCQs.
• In case questions, name the component explicitly and quote the fact that proves it.
• Be ready for a comparison with COSO Internal Control and with ISO 31000, using fixed heads.