Enterprise Risk Management and Future Trends: formula sheet

Key formulas

ERM in one line

ERM = integrated, firm-wide risk identification, measurement, aggregation, response and reporting, linked to strategy and risk appetite

Use this to separate ERM from silo risk management. Words like integrated, firm-wide and strategy are the signals.

COSO ERM components (2017 version)

Governance and Culture | Strategy and Objective-Setting | Performance | Review and Revision | Information, Communication and Reporting

Five components. The earlier 2004 version listed eight, including internal environment, objective setting, event identification, risk assessment, risk response, control activities, information and communication, and monitoring. Know that the framework has been updated.

Risk response options

Avoid | Reduce (mitigate) | Share or transfer | Accept (retain)

Choice depends on whether the risk fits the firm's risk appetite and on the cost versus benefit of the response.

Aggregation and diversification

Firm-wide risk ≤ Σ stand-alone risks, when risks are not perfectly correlated and the measure is subadditive

This is the logic behind aggregation. Value at Risk is not always subadditive, so state the condition.

Cascade of risk control

Risk appetite (board) → Risk tolerance → Risk limits (management) → Desk and trader limits

Each lower level must be consistent with and no looser than the level above it.

Three lines of defense

1st line: business units own risk | 2nd line: risk management and compliance oversee | 3rd line: internal audit gives independent assurance

Audit must stay independent of both the business and the risk function.

Limit utilization

Utilization = Current exposure ÷ Limit × 100%

Over 100% is a breach. Early-warning triggers usually sit below 100%.

Capital buffer headroom

Headroom = Actual capital ratio − Board-set minimum ratio

Appetite statements often set a target above the regulatory minimum.

Economic capital (loss quantile approach)

EC = unexpected loss = VaR (at chosen confidence) − expected loss

Expected loss is covered by pricing and provisions, not by capital. Some firms define EC simply as the quantile; read the question.

Two-unit aggregation with correlation

EC_total = √(EC₁² + EC₂² + 2ρ·EC₁·EC₂)

Valid for the variance-covariance approach. ρ = 1 gives EC₁ + EC₂. ρ = 0 gives √(EC₁² + EC₂²).

Diversification benefit

Benefit = (EC₁ + EC₂) − EC_total

Can also be shown as a percentage of the sum of stand-alone capital.

RAROC

RAROC = (revenue − costs − expected loss) ÷ economic capital

Some versions add the return earned on the capital. Use the definition given in the question.

Value-added test

Create value if RAROC > hurdle rate

Hurdle rate is usually the cost of equity. Economic value added = risk-adjusted profit − hurdle × EC.

Sharpe ratio

Sharpe = (Rp − Rf) ÷ σp

Excess return per unit of total risk. Use for standalone or whole portfolios.

Treynor ratio

Treynor = (Rp − Rf) ÷ βp

Excess return per unit of systematic risk. Use when the portfolio is one part of a diversified whole.

RAROC

RAROC = (Revenue − Costs − Expected loss) ÷ Economic capital

Compare with a hurdle rate. Accept if RAROC exceeds the hurdle.

Net benefit of a risk response

Net benefit = Reduction in expected loss − Cost of response

Add any risk-reduction value beyond expected loss, such as lower distress costs, if given.

Quick revision

• ERM manages risks across the whole firm in light of strategy, not in separate silos.
• The board sets risk appetite and oversees risk; management carries it out.
• A risk appetite statement should be clear, measurable and turned into limits at business level.
• The chief risk officer needs independence from the units that take risk.
• Economic capital is the buffer an institution estimates it needs to absorb unexpected losses at a chosen confidence level.
• Diversification lowers combined risk when correlation is below 1; at ρ = 1 risks simply add.
• Simple addition of standalone capital overstates the total when correlations are below 1.
• Risk-adjusted return measures compare return to the capital or risk used.
• Strategic risk comes from business decisions and a changing environment, not from day-to-day operations.
• Higher expected return usually requires accepting more risk, so compare return per unit of risk.
• Emerging risks such as climate and cyber cut across market, credit and operational risk.
• Always match a scenario to the framework element it tests before choosing an answer.

Common mistakes

• Saying ERM eliminates risk. Fix: ERM aims to take the right risks within appetite. It optimizes risk and return and does not aim for zero risk.
• Treating ERM as the sum of separate risk reports. Fix: True ERM aggregates risks, considers their interactions and correlations, and links the result to strategy and capital.
• Treating risk appetite and risk tolerance as identical. Fix: Appetite is the overall type and amount of risk sought. Tolerance is the acceptable deviation or boundary. Limits are the operating controls.
• Thinking the board sets individual trading limits. Fix: The board sets appetite and approves the framework. Management sets and monitors limits within it.
• Adding stand-alone capital figures and calling it firm-wide capital. Fix: Addition assumes perfect correlation. Apply the correlation formula unless the question says to sum.
• Forgetting to subtract expected loss when computing economic capital or RAROC. Fix: Expected loss is a cost already priced in. Deduct it from revenue for RAROC and from the loss quantile for EC.
• Calling insurance or a hedge 'avoidance'. Fix: Avoidance means not undertaking the activity. Insurance is transfer. Hedging is usually mitigation, though some texts treat it as transfer of price risk.
• Picking the activity with the highest return. Fix: Always divide by risk or capital before comparing.
• Mixing up physical and transition climate risk. Fix: Physical means damage from weather or climate events. Transition means losses from policy, technology or market change toward low carbon.
• Treating emerging risks as separate from credit, market and operational risk. Fix: Always ask which classic risk the emerging one drives, and through what channel.

Exam tips

• Questions are mostly conceptual. Learn the contrast between silo and integrated risk management and the benefits and challenges cold.
• Know who does what: the board sets appetite and oversight, the CRO runs the framework independently, business units own risk.
• Learn the five 2017 COSO ERM components in order and know that earlier versions listed more.
• Watch for absolute wording such as eliminates, always or only. These options are usually wrong.
• Link ERM to nearby topics: risk appetite, three lines of defense and governance failures. Cases often combine them.
• Learn the cascade of appetite, tolerance and limits and match each to its owner.
• Expect questions on the board risk committee: it reviews and challenges, but management stays responsible for running risk.
• Watch for independence traps involving the CRO and internal audit.