Advanced Financial Management · Risk Management

Risk Management Framework and Types of Risk (CA Final AFM)

Updated 5 October 2026 · Fact-checked

Risk is the chance that actual outcomes differ from expected ones. Risk management is a cycle: identify risks, measure them, decide a response (avoid, reduce, transfer or accept), implement, then monitor and report. To solve questions, classify the risk (market, credit, liquidity, operational), name its source, and match a suitable tool.

Understand Risk Management Framework and Types of Risk

Risk means uncertainty about outcomes. In finance, it is the possibility that actual returns, cash flows or values differ from what you expected. This covers losses and also unexpected gains, though managers focus mostly on adverse deviations.

Risk management is a structured process, not a single tool. A firm first sets its risk appetite, the level of risk the board is willing to bear. Then it identifies risks, measures them, chooses a response, acts, and keeps monitoring. The cycle repeats because exposures change as markets and the business change.

Financial risks are usually grouped as follows. Market risk is loss from movements in market prices: interest rates, exchange rates, equity prices and commodity prices. Credit risk is loss because a counterparty fails to pay or its credit quality falls. Liquidity risk has two forms: funding liquidity risk (you cannot meet payments when due) and market liquidity risk (you cannot sell an asset quickly without a big price concession). Operational risk is loss from failed internal processes, people, systems or external events. Legal and reputational risks are often discussed alongside it.

For investments, total risk splits into two parts. Systematic risk (market risk, non-diversifiable) comes from economy-wide factors such as inflation, interest rates and policy changes. It affects all securities and cannot be removed by diversification. Unsystematic risk (specific or diversifiable risk) is unique to a firm or industry, such as a strike or a product failure. Diversification can reduce it. Do not confuse this 'market risk' with the 'market risk' of the financial-risk classification; the context decides the meaning.

The responses to a risk are four: avoid it, reduce it (controls, diversification, hedging), transfer it (insurance, derivatives, outsourcing) or accept it (when the cost of treating it exceeds the benefit, or it is within appetite).

Key rules to remember

Total risk: Total risk = Systematic risk + Unsystematic risk; In portfolio terms, variance splits into market-driven and specific parts. Diversification removes only the unsystematic part.
Risk management cycle: Identify → Measure → Respond → Implement → Monitor and report; Use this order as your answer skeleton for any process question.
Risk responses: Avoid | Reduce | Transfer | Accept; Hedging with derivatives is usually reduction or transfer, not avoidance.
Financial risk classes: Market (interest rate, FX, equity price, commodity) | Credit | Liquidity | Operational; Name the class first, then the sub-type.
Beta (systematic risk measure): β = Cov(Rs, Rm) ÷ Var(Rm); Beta measures only systematic risk. A security with β > 1 moves more than the market.

How to solve Risk Management Framework and Types of Risk questions

Use this method for theory questions, short notes and case-scenario MCQs on risk.

1Read the case and underline the event that creates uncertainty (price move, default, cash shortage, process failure).
2Classify the risk: market, credit, liquidity or operational. For market risk, name the sub-type such as interest rate, currency, equity or commodity.
3Decide if the risk is systematic or unsystematic when the question deals with securities or portfolios.
4Identify the exposure: what is at stake, how large, and over what period.
5Link to the process stage the question tests: identification, measurement, response, implementation or monitoring.
6Choose the response (avoid, reduce, transfer, accept) and a matching tool, for example forward for FX, swap for floating-rate debt, credit limits for receivables, back-up funding lines for liquidity.
7Write a short conclusion that states the risk, the tool and the residual risk left after treatment.

Quickest way: Cause-to-class shortcut

When to use it: Use for case-scenario MCQs where you have under two minutes per question.

Ask what went wrong: price changed (market), counterparty did not pay (credit), cash or exit not available (liquidity), system or people failed (operational).
If the question mentions diversification, check whether the risk is firm-specific (diversifiable) or economy-wide (not).
Match the tool: derivatives for market, limits and collateral for credit, buffers for liquidity, controls for operational.
Eliminate options that mix categories, such as calling a default a market risk.

Common mistakes in Risk Management Framework and Types of Risk

Treating 'market risk' in portfolio theory and in the financial-risk classification as the same thing.
The same words are used in two chapters.
Fix: In portfolio questions, market risk means systematic risk. In the risk classification, it means price-movement risk. Read the context before answering.
Saying diversification removes all risk.
Students remember that diversification reduces risk and stop there.
Fix: State that it removes only unsystematic risk. Systematic risk remains.
Confusing credit risk with liquidity risk.
Both show up as cash not being received or available.
Fix: If the counterparty fails or is downgraded, it is credit risk. If the firm itself cannot raise cash or sell an asset quickly, it is liquidity risk.
Writing the risk process steps in the wrong order or skipping monitoring.
Students learn the steps as a list without the logic.
Fix: Remember that you cannot treat what you have not measured, and you must keep monitoring because exposures change.
Classifying a rogue trader or system failure as market risk because the loss came in the market.
Students look at where the loss appeared, not what caused it.
Fix: Classify by cause. Failed controls, fraud or system breakdown is operational risk.
Recommending hedging for every risk.
Hedging is the most familiar tool from derivatives chapters.
Fix: Offer the four responses. Some risks are best accepted or avoided, and operational risk needs controls and insurance rather than derivatives.

Worked examples

Example 1

A listed manufacturer has a ₹50 crore floating-rate term loan linked to a benchmark rate. It also sells goods on 90-day credit to a distributor who contributes a large share of its sales. Last month the distributor's bank account was frozen and it delayed payment. The CFO says the company faces 'one general risk'. Identify and classify the risks and suggest responses.

Show the solution

Floating-rate loan: a rise in the benchmark rate raises interest cost. This is market risk, specifically interest rate risk.
Delayed payment by the distributor: the counterparty may fail to pay on time or at all. This is credit risk (counterparty risk).
The delay can also strain the firm's cash for its own payments. This is a knock-on liquidity (funding) risk, but its root cause is credit risk.
Responses for interest rate risk: reduce or transfer it with an interest rate swap to fix the rate, or accept it if the firm's appetite allows.
Responses for credit risk: set a credit limit for the distributor, take collateral or a bank guarantee, use credit insurance, and monitor ageing of receivables.
Responses for liquidity risk: keep an undrawn working capital line and a cash buffer.

Answer: The firm faces three linked risks, not one: interest rate risk (market), credit risk from the distributor, and liquidity risk as a consequence. Use a swap for the loan, limits and guarantees for the distributor, and standby funding for liquidity.

Example 2

An investor holds a portfolio of 40 stocks across sectors. One company in the portfolio loses a major lawsuit and its price falls sharply. Separately, the central bank raises the policy rate unexpectedly and the whole market falls. Explain which event is systematic and which is unsystematic, and what diversification can do about each.

Show the solution

The lawsuit affects only one company. It is firm-specific, so it is unsystematic risk.
With 40 stocks across sectors, one stock forms a small share of the portfolio, so its fall is offset by other holdings. Diversification reduces this risk.
The policy rate rise affects the whole economy and all securities. It is systematic (market) risk.
Holding more stocks will not remove this loss because all stocks fall together.
To manage systematic risk, the investor can change asset allocation, hold lower-beta stocks, or hedge using index derivatives.

Answer: The lawsuit is unsystematic risk, which diversification reduces. The rate hike is systematic risk, which diversification cannot remove; it needs asset allocation, lower beta or index hedging.

Exam tips

In case-scenario MCQs, classify by the cause of the loss, not by where it appears.
For descriptive answers, use the cycle (identify, measure, respond, implement, monitor) as headings, then add one example from the case.
Always add the response and the tool after classification. Marks are often split between classifying and treating.
In portfolio questions, state clearly that beta measures only systematic risk.
Write one line on residual risk after hedging. It shows judgment and is often missed.

Practice questions from Risk Management

Risk Management Framework and Types of Risk in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Risk Management Framework and Types of Risk: frequently asked questions

What are the main types of financial risk for CA Final AFM?

The main types are market risk (interest rate, currency, equity price, commodity), credit risk, liquidity risk and operational risk. Learn one example and one tool for each. Legal and reputational risks are sometimes added.

What is the difference between systematic and unsystematic risk?

Systematic risk comes from economy-wide factors and affects all securities, so diversification cannot remove it. Unsystematic risk is specific to a firm or industry and can be reduced by diversification. Beta measures systematic risk.

What are the steps in the risk management process?

The usual steps are to identify risks, measure them, choose a response, implement it, and monitor and report. The cycle repeats as exposures change. Set the risk appetite first.

Is liquidity risk the same as credit risk?

No. Credit risk is a counterparty's failure to pay or a fall in its credit quality. Liquidity risk is the firm's own inability to meet payments or to sell an asset quickly at a fair price. One can cause the other, as in a customer default that strains your cash.