Integrated Risk Management: formula sheet

Key formulas

Risk appetite versus capacity

Risk appetite < Risk tolerance/limits ≤ Risk capacity

Appetite is the target level of risk, limits are the operating boundaries, capacity is the absolute maximum the firm can absorb. Wording of tolerance and limits varies by source; the ordering is the point.

Simple aggregation of risk capital

Total = Σ standalone capital (no diversification benefit)

This is the upper bound, which assumes perfect correlation across risk types.

Diversification benefit

Diversification benefit = Σ standalone capital − aggregated (diversified) capital

Positive when risks are less than perfectly correlated. Estimates depend on correlation and aggregation assumptions, which carry model risk.

Three lines of defense

1st: business units own risk | 2nd: risk management and compliance oversee | 3rd: internal audit assures

Know which line performs which role.

COSO ERM 2017 components

Governance and culture; Strategy and objective-setting; Performance; Review and revision; Information, communication and reporting

Five components; the 2017 version integrates risk with strategy and performance.

Hierarchy of risk boundaries

Limits < Risk tolerance < Risk appetite < Risk capacity

Each level is nested inside the next. Limits trigger early action; capacity is the hard ceiling.

Line of defense roles

1st line = owns and manages risk; 2nd line = oversees and challenges; 3rd line = independent assurance

Internal audit is third line and reports to the board, usually via the audit committee.

Risk appetite statement content

RAS = qualitative statements + quantitative metrics + limits and escalation process + roles

A good RAS links to strategy, capital and liquidity plans and is reviewed regularly.

Limit utilization

Utilization = Current exposure ÷ Limit

Above 100% is a breach. Many firms also set early warning triggers below 100%, such as 80%.

Additive aggregation

Total = C₁ + C₂ + ... + Cₙ

Equals the correlation-based result when all correlations are 1. Gives zero diversification benefit.

Correlation-based aggregation (two risks)

Total = √(C₁² + C₂² + 2ρC₁C₂)

C are stand-alone capital figures at the same horizon and confidence level. Exact for jointly normal losses.

General correlation-based aggregation

Total = √(Σᵢ Σⱼ ρᵢⱼ Cᵢ Cⱼ)

ρᵢᵢ = 1. Uses the full correlation matrix.

Diversification benefit

Benefit = ΣCᵢ − Total; Benefit % = Benefit ÷ ΣCᵢ

Falls as correlation rises. It is zero at ρ = 1.

Sklar's theorem

F(x₁,...,xₙ) = C(F₁(x₁),...,Fₙ(xₙ))

Any joint distribution equals a copula C applied to its marginals.

Economic capital

EC = Loss quantile at confidence level − Expected loss (UL at that level)

Horizon is usually one year. Capital covers unexpected loss, not expected loss.

RAROC

RAROC = (Revenue − Costs − Expected loss + Return on capital) ÷ Economic capital

Use the version the question gives. Some versions omit the return on capital.

Value-creation test

Create value if RAROC > hurdle rate

Hurdle rate is the shareholders' required return on equity.

Portfolio standard deviation of two units

σp = √(σ1² + σ2² + 2ρσ1σ2)

Used when capital is approximated by a multiple of loss standard deviation.

Component (covariance) contribution

Contribution of unit i = wi × Cov(Li, Lp) ÷ σp, scaled by the capital multiple

Contributions sum to total capital. Stand-alone figures do not.

Diversification benefit

Benefit = Σ stand-alone EC − Bank-level EC

Positive when correlation between units is below 1.

Economic profit (EVA-style)

Economic profit = Risk-adjusted return − (Hurdle rate × Economic capital)

Positive economic profit matches RAROC above the hurdle.

Post-stress capital ratio

Stressed CET1 ratio = (Starting CET1 capital − Stress losses + Stress pre-provision income) ÷ Stressed risk-weighted assets

Losses include credit, market and operational. Stressed RWA often rise because risk weights increase under stress.

Capital shortfall

Shortfall = Required ratio × Stressed RWA − Stressed CET1 capital (if positive)

A positive value means the firm falls below its required level and needs management action or capital.

Naive aggregation (no interaction)

Total loss = Market loss + Credit loss + Operational loss + Other

Simple addition assumes no diversification and no feedback. Interaction effects (for example liquidity spirals) can make the true loss higher.

Liquidity survival horizon

Survival horizon = Liquidity buffer ÷ Stressed net daily outflow (approx., if outflow is constant)

Used in liquidity stress tests. Real outflows are rarely constant, so treat it as an approximation.

Reverse stress test logic

Define failure outcome → find scenarios that produce it

Start from the breach point, such as CET1 below the minimum, not from a chosen shock.

Quick revision

• ERM looks at all risks together, with board oversight and a link to strategy.
• Risk appetite is the amount and type of risk a firm is willing to take; limits translate it into daily practice.
• The board sets appetite and oversees; management implements; independent risk functions challenge.
• Three lines of defence: business units, independent risk and compliance, internal audit.
• Simple addition of stand-alone risks ignores diversification and usually overstates total risk when correlations are below one.
• Correlations tend to rise in stress, so diversification benefits can shrink when you need them most.
• Economic capital is the buffer an institution estimates it needs to absorb unexpected losses at a chosen confidence level and horizon.
• Regulatory capital follows rules; economic capital is the firm's own internal estimate.
• Capital allocation to units should reflect their risk contribution, not only stand-alone risk.
• Stress tests should be forward-looking, link to the business model and combine risk types.
• Reverse stress testing starts from a failure outcome and works back to the scenarios that cause it.
• Weak risk culture, poor incentives and ignored warnings are recurring causes in risk failures.

Common mistakes

• Saying ERM eliminates risk. Fix: ERM aims to take the right risks within appetite and to improve decisions. It does not remove risk.
• Treating risk appetite and risk capacity as the same. Fix: Appetite is what the firm chooses to accept. Capacity is the maximum it could survive. Appetite should be lower.
• Treating risk appetite and risk limits as the same thing. Fix: Appetite is firm-wide and board-level. Limits are operational and set for units within tolerance.
• Placing risk management in the first line. Fix: Independent risk and compliance are second line. Only units that take risk and own it are first line.
• Adding capital figures and calling it the diversified total. Fix: Addition assumes ρ = 1. Use the correlation formula when correlations are given.
• Forgetting the square root in the correlation formula. Fix: Always take √ at the end. The total must be below the simple sum when ρ < 1.
• Treating economic capital as the full loss quantile Fix: Subtract expected loss from the quantile. Capital covers unexpected loss only.
• Forgetting to deduct expected loss in RAROC Fix: Always deduct expected loss in the numerator. It is the cost of credit and other losses.
• Treating reverse stress testing as a more severe forward test. Fix: Remember the direction: forward goes scenario to loss; reverse goes failure to scenario.
• Adding separate risk-type losses and calling it integrated. Fix: Integrated means a common scenario and modelling of interactions, not just a sum of silo results.

Exam tips

• Expect case-style stems where the answer is a missing ERM ingredient: governance, appetite, common language or aggregation.
• Memorize who does what in the three lines of defense. Questions often swap roles in distractors.
• Distinguish risk appetite, tolerance and capacity, and know the ordering.
• Reject absolute wording such as eliminates, guarantees or always.
• For numeric items, the usual task is simple sum minus diversified total. Check units and currency.
• Memorize the nesting: limits inside tolerance, tolerance inside appetite, appetite below capacity.
• In line-of-defense questions, ask who takes the risk and who challenges it. If the same group does both, it is a weakness.
• Look for hints of weak culture: pay tied only to revenue, ignored limit breaches, CRO without board access.