Risk, Regulation and Organizational Structure: formula sheet

Key formulas

Hierarchy of risk statements

Risk appetite (board, broad) → Risk tolerance (quantified boundaries) → Risk limits (operational)

Appetite is set by the board; limits are set and monitored by management and risk. Do not swap the levels.

Three lines of defense

1st: business units own risk | 2nd: risk management and compliance oversee | 3rd: internal audit assures

The first line owns the risk. The second line is independent of risk-taking. The third line is independent of both.

Board responsibilities

Board = approve strategy + approve risk appetite + oversee management + hold accountability

Committees advise and review, but accountability stays with the full board.

CRO independence test

Independence = separate from revenue + direct board access + board involvement in appointment and removal

If an option has the CRO reporting only to the CFO or paid on trading profit, it weakens governance.

Ordering of risk concepts

Risk profile ≤ Risk appetite ≤ Risk capacity

Appetite must sit inside capacity. Profile is what is actually being run and is managed to stay within appetite.

Capacity headroom

Headroom = Risk capacity − Risk appetite

Gives the buffer between chosen appetite and the point of regulatory or solvency breach.

Capital buffer against a minimum

Buffer = Actual ratio − Minimum ratio

For example, CET1 of 11.5% against an internal appetite floor of 10.0% leaves 1.5 percentage points.

Utilisation of a limit

Utilisation = Current exposure ÷ Limit

Used to compare against early-warning triggers, such as 80% of limit.

Four indicators of risk culture (FSB)

Tone from the top; Accountability; Effective challenge; Incentives

Use these as a checklist when a case asks you to diagnose culture.

Minimum capital ratios (Basel III)

CET1 ≥ 4.5% of RWA; Tier 1 ≥ 6% of RWA; Total capital ≥ 8% of RWA

Ratios are measured against risk-weighted assets (RWA), before buffers.

Capital conservation buffer

2.5% of RWA, met with CET1

Total CET1 requirement with buffer = 7%. Falling into the buffer restricts distributions.

Countercyclical buffer

0% to 2.5% of RWA, set by national authorities, met with CET1

Applied to credit exposures in the jurisdiction; weighted by where exposures are located.

Leverage ratio

Tier 1 capital ÷ Total exposure measure ≥ 3%

Exposure includes on-balance-sheet assets and off-balance-sheet items and derivatives. No risk weights.

Liquidity Coverage Ratio

LCR = Stock of HQLA ÷ Total net cash outflows over next 30 days ≥ 100%

Net outflows = outflows minus inflows, where inflows are capped at 75% of outflows.

Net Stable Funding Ratio

NSFR = Available stable funding (ASF) ÷ Required stable funding (RSF) ≥ 100%

One-year horizon. Capital and long-term liabilities have high ASF factors.

Basel 2.5 trading book additions

Stressed VaR + Incremental Risk Charge + Comprehensive Risk Measure

Stressed VaR uses a 12-month period of significant financial stress. Both VaR and stressed VaR are 10-day, 99%.

Capital ratio under stress

Stressed CET1 ratio = (Starting CET1 capital − cumulative losses + cumulative pre-provision net revenue − taxes − distributions) ÷ Stressed risk-weighted assets

Use the same definition of capital throughout. Check whether RWA changes under stress.

Pre-provision net revenue (PPNR)

PPNR = Net interest income + Non-interest income − Non-interest expense

Earnings before loan-loss provisions. It absorbs losses before capital is hit.

Capital shortfall

Shortfall = Required minimum (plus buffers) − Stressed capital ratio, applied to RWA

In rupee or dollar terms: shortfall = (required ratio − stressed ratio) × stressed RWA.

Capital impact of a ratio change

Change in ratio ≈ Change in capital ÷ RWA

Holding RWA fixed, each unit of loss reduces the ratio by loss ÷ RWA.

Reverse stress test logic

Choose outcome (e.g. CET1 ratio at minimum) → solve for shock size that produces it

Works backwards from failure to scenario.

Conflict test

Conflict = (my gain) ≠ (client or firm gain) + (ability to act on the difference)

Use this to spot a conflict in a case. Both parts must be present.

Principal-agent problem

Agent pay = share of upside, limited share of downside → risk taken > risk the principal wants

This is the core of the compensation and risk-taking link.

Pay alignment tools

Deferral + equity-based pay + malus (before payment) + clawback (after payment)

Malus cuts unvested pay. Clawback recovers pay already paid.

Volcker rule scope

Banking entity: no proprietary trading and no ownership or sponsorship of covered funds, except permitted activities

Permitted activities include market making, hedging and certain government securities trading. It is not a ban on all trading.

Control hierarchy

Avoid or separate → manage with barriers and limits → disclose → monitor and escalate

Disclosure alone is the weakest control for serious conflicts.

G-SIB indicator categories

Size, Interconnectedness, Substitutability, Complexity, Cross-jurisdictional activity

Five categories. Each carries equal weight in the score (20% each in the Basel methodology). Score decides the bucket and surcharge.

G-SIB total capital requirement

CET1 requirement = 4.5% minimum + 2.5% conservation buffer + G-SIB surcharge (+ countercyclical buffer if any)

Surcharge is met with CET1. Buckets run from 1.0% up to 3.5% in the Basel framework.

TLAC minimum

TLAC ≥ 18% of RWA and ≥ 6.75% of leverage ratio exposure

Both must be met, excluding buffers. The higher of the two binds.

Surcharge cost to the bank

Extra CET1 = surcharge % × RWA

Use RWA, not total assets, for risk-based requirements.

Quick revision

• The board holds ultimate responsibility for risk oversight and sets the risk appetite.
• The CRO should be independent of business lines and have direct access to the board.
• A risk appetite statement links strategy, limits and the capital the firm is willing to put at risk.
• Risk culture is shown by behavior and incentives, not by written policy alone.
• The three lines of defense are business management, independent risk and compliance, and internal audit.
• Compensation tied only to short-term profit can encourage excess risk-taking.
• Capital ratio = eligible capital ÷ risk-weighted assets; higher-quality capital absorbs losses first.
• Basel liquidity standards include the Liquidity Coverage Ratio for short-term stress and the Net Stable Funding Ratio for longer-term funding.
• Stress tests ask whether capital stays above requirements under severe but plausible scenarios.
• Scenario design, data quality and governance of the stress testing process matter as much as the results.
• Systemic risk is the risk that distress at one institution or market spreads and harms the wider financial system.
• Post-crisis reforms aim to raise capital, improve liquidity and reduce the damage from failure of large institutions.

Common mistakes

• Placing compliance or risk management in the first line because they sit close to the business. Fix: Judge by function. Independent monitoring and challenge is second line, whatever the seating plan.
• Saying internal audit manages or mitigates risk. Fix: Audit gives independent assurance and recommendations. Management owns the fixes.
• Treating risk appetite and risk limits as the same thing. Fix: Appetite is the aggregate, board-approved level of risk accepted for strategy. Limits are granular controls set by management to keep activity within appetite.
• Confusing risk appetite with risk capacity. Fix: Capacity is the maximum the firm can bear. Appetite is what the board chooses to accept and must be below capacity.
• Confusing LCR and NSFR horizons Fix: LCR is 30 days of stressed net outflows. NSFR is one year of stable funding against asset liquidity.
• Using risk-weighted assets in the leverage ratio Fix: The leverage ratio uses total exposure with no risk weights, so it is a backstop.
• Confusing ICAAP and ILAAP Fix: ICAAP is capital adequacy across material risks. ILAAP is liquidity and funding adequacy.
• Treating stress tests as forecasts Fix: A scenario is a hypothetical, severe but plausible event. It tests resilience, not expected outcomes.
• Saying the Volcker rule bans all trading by banks. Fix: Remember it targets proprietary trading and covered fund activity. Market making, hedging and some other activity are permitted.
• Treating disclosure as a full solution. Fix: Rank controls: avoid or separate first, manage second, disclose third. Disclosure leaves the incentive in place.

Exam tips

• Questions usually describe a scenario and ask which line or body should act. Label every person as first, second or third line before reading the options.
• Watch for independence traps: CRO paid on revenue, CRO reporting to the CEO only, or audit designing the controls it later tests.
• Use exact terms: appetite, tolerance and limit are tested as separate levels.
• Expect case-style stems on failures such as weak risk culture, where the right answer is usually stronger board challenge, clear accountability and escalation.
• If two options look right, prefer the one that keeps final accountability with the board and independence with the risk function.
• Expect definition-based items that separate appetite, capacity, profile and limits. Learn the ordering profile ≤ appetite ≤ capacity.
• When a case lists symptoms like waived breaches or revenue-only bonuses, name the culture indicator involved: tone, accountability, challenge or incentives.
• The best RAS answer is usually the one that is board-approved, linked to strategy, forward-looking, stress-tested and cascaded to limits.