Risk Management: formula sheet

Key formulas

Risk vs uncertainty test

Probabilities known or estimable → Risk; probabilities not estimable → Uncertainty

Use this as the first line of any question that asks you to distinguish the two.

Five-way classification

Business risk = Strategic + Financial + Operational + Compliance + External

This is a classification, not an arithmetic formula. Some books use different groupings (for example hazard, control, opportunity), so follow the grouping the question asks for.

Financial risk sub-types

Financial risk = Market risk + Credit risk + Liquidity risk (+ leverage risk)

Market risk covers interest rate, currency and commodity price risk.

Expected value of an outcome set (when probabilities are known)

Expected value = Σ (probability × outcome)

Probabilities must add up to 1. This is only possible under risk, not uncertainty.

Expected loss

Expected loss = Probability of the event × Impact (loss) if it occurs

Use it to rank risks numerically. It hides rare but severe events, so judge high-impact risks separately.

Residual risk

Residual risk = Inherent risk − Risk reduced by controls and other treatment

This is a concept, not an exact calculation. Compare residual risk with risk appetite to decide if more action is needed.

Process sequence

Identify → Assess → Prioritise → Treat → Monitor → Report (repeat)

Context setting comes before identification. Monitoring and reporting feed back into the next cycle.

Treatment options

Avoid | Transfer | Mitigate (reduce) | Accept (retain)

Name the option and justify it with cost, impact and risk appetite.

Cost-benefit test for treatment

Treat if reduction in expected loss > cost of the treatment

Also consider non-financial effects such as reputation, safety and legal compliance.

COSO ERM 2017 components

Governance and Culture → Strategy and Objective-Setting → Performance → Review and Revision → Information, Communication and Reporting

Five components, 20 principles. Remember the first three as the core cycle of setting up, choosing strategy and executing.

ISO 31000 structure

Principles + Framework + Process

The process runs: communication and consultation; scope, context, criteria; risk assessment (identify, analyse, evaluate); risk treatment; monitoring and review; recording and reporting.

Risk exposure (simple)

Expected loss = Probability × Impact

Used to rank risks in assessment. Probability is a fraction between 0 and 1; impact is in rupees.

Residual risk

Residual risk = Inherent risk − Effect of controls and responses

Conceptual relationship. Compare residual risk with risk appetite to decide if further treatment is needed.

Expected value

EV = Σ (p × x)

Probabilities must add up to 1. x is the outcome for each case.

Variance

σ² = Σ p × (x − EV)²

Use deviations from the EV, weighted by probability.

Standard deviation

σ = √σ²

Same unit as the outcome. Higher σ means higher absolute risk.

Coefficient of variation

CV = σ ÷ EV

Use to compare options with different EVs. Lower CV means less risk per unit of return.

Sensitivity (margin of safety in a variable)

% change tolerable = NPV ÷ PV of that variable's cash flows × 100

Shows how far the variable can fall before NPV becomes zero. Apply to one variable only.

Parametric VaR (normal distribution)

VaR = Z × σ × Value of position, scaled for time by √t

Z is about 1.65 at 95% and about 2.33 at 99% (one-tailed). Assumes normal returns.

Risk score in a matrix

Risk score = Likelihood rating × Impact rating

Use the rating scale given in the question. Higher score means higher priority.

Forward rate (covered interest parity)

Forward rate = Spot × (1 + i of quoted currency × n) ÷ (1 + i of base currency × n)

This is the simple-interest form, so the forward rate it gives is an approximation. Rates are for the same period n in years. The quoted currency is the one in which price is stated, for example ₹ in ₹/US$. Its interest rate goes in the numerator: for ₹/US$, the ₹ rate over the US$ rate. Use simple interest for periods up to a year unless told otherwise.

Forward premium or discount (annualised)

(Forward − Spot) ÷ Spot × (12 ÷ months) × 100

A positive result is a premium. A negative result is a discount.

Hedge outcome with a forward

Home currency amount = Foreign currency amount × Forward rate

For a receivable use the bank's buying rate. For a payable use the bank's selling rate. A single quoted forward rate in a question for an importer is the bank's selling rate.

Option payoff

Call buyer profit = max(Spot at expiry − Strike, 0) − Premium; Put buyer profit = max(Strike − Spot at expiry, 0) − Premium

The buyer's loss is limited to the premium.

Swap saving

Net cost = Interest paid on own debt + Swap payment − Swap receipt

Compare with the cost of the unhedged position.

Response options

Avoid | Reduce | Transfer | Accept

Name the option first, then the tool.

Risk rating (scoring)

Risk score = Likelihood score × Impact score

Commonly a 1-5 scale for each, giving 1-25. Use the scale given in the question. Score before controls is inherent risk; after controls is residual risk.

Appetite versus tolerance

Appetite = broad willingness to take risk; Tolerance = measurable limit around an objective

Capacity is the ceiling above both. Appetite and tolerance should sit within capacity.

Expected loss

Expected loss = Probability of event × Loss if it occurs

Useful for ranking risks in a register when probabilities and rupee impacts are given.

Three lines model

1st line: business owns risk; 2nd line: risk and compliance oversee; 3rd line: internal audit assures

Use it to describe who does what in governance.

Standard risk register columns

ID | Risk | Cause/Consequence | Likelihood | Impact | Score | Controls | Action | Owner | Due date | Status

Include owner and action in any register you draw. Marks are lost when they are missing.

Quick revision

• Business risk is the possibility that events will affect the achievement of objectives.
• Main types: strategic, operational, financial, compliance and reputational.
• Process order: establish context, identify, analyse, evaluate, treat, monitor and review, with communication throughout.
• Risk assessment looks at both likelihood and impact.
• Responses: avoid, reduce, transfer or accept. Choose based on size of risk and appetite.
• Risk appetite is the amount of risk the business is willing to take; tolerance is the acceptable variation around it.
• COSO ERM links risk to strategy and performance; ISO 31000 gives principles, a framework and a process.
• ISO 31000 is a guideline, not a certification standard.
• Hedging reduces exposure to price, currency or interest rate movements but may limit gains.
• Insurance transfers risk; it does not remove it.
• The board oversees risk; management owns and runs it day to day.
• Risk culture and regular reporting make the system work in practice.

Common mistakes

• Treating risk and uncertainty as synonyms. Fix: Anchor on measurability: risk has estimable probabilities, uncertainty does not. Write this in the first line of the answer.
• Classifying a risk by its effect instead of its cause. Fix: Ask what started it. A factory fire is operational even though it causes a financial loss.
• Listing the steps as theory without linking them to the case. Fix: Name the actual risk from the case under each step and say what the company should do.
• Confusing transfer with avoid. Fix: Avoid means you stop the activity. Transfer means you keep the activity but pass the financial effect to another party, such as an insurer.
• Mixing the 2004 eight-component COSO model with the 2017 five-component model. Fix: Write the 2017 five components as your default. Mention 2004 only if the question asks about it.
• Saying ISO 31000 is a certifiable standard. Fix: Say ISO 31000 provides guidelines. It is not meant for certification, unlike some other ISO standards.
• Using σ to compare projects with different expected values. Fix: Calculate CV = σ ÷ EV and compare that. Use σ alone only when EVs are equal.
• Taking deviations from a simple average instead of the EV. Fix: Always weight by p and measure deviation from the probability-weighted EV.
• Using the wrong side of the bank's quote for a forward. Fix: The bank buys foreign currency from an exporter at the lower rate and sells it to an importer at the higher rate.
• Saying diversification removes all risk. Fix: Say it reduces unsystematic risk only. Market-wide risk remains.

Exam tips

• In Section A, read the cause in the case scenario first. Options often differ only by category label, and the cause decides it.
• For a 'distinguish risk and uncertainty' question, give a clear definition of each, the measurability test and one business example for each. Two to three differences are usually enough.
• When asked to classify, give a one-line reason with each label. A bare label earns less than a label with its cause.
• In a descriptive answer, link each category to a response (avoid, reduce, transfer, accept). This shows application, not recall.
• There is no negative marking, so attempt every MCQ. Eliminate options that confuse cause with effect and then choose.
• In case questions, tie every step to a fact in the case. Generic theory earns fewer marks.
• Use the four treatment names exactly and justify each choice with cost, impact and appetite.
• For MCQs, watch the difference between inherent and residual risk and between avoid and transfer.