CFA Level I Exam · Introduction to Risk Management

Types of Financial and Non-Financial Risks for CFA Level I

Updated 7 October 2026 · Fact-checked

Risk types are categories of uncertainty that can hurt a firm or portfolio. Financial risks include market, credit and liquidity risk. Non-financial risks include operational, model, settlement, regulatory, legal, sovereign and similar risks. To answer a question, find the source of the loss in the stem, then match it to the category.

Understand Types of Financial and Non-Financial Risks

A risk is exposure to an uncertain outcome that can cause a loss. The CFA curriculum sorts risks by where the loss comes from. This lets a firm see what it faces and choose how to manage it.

Financial risks come from financial markets and counterparties. Market risk is the risk that prices or rates move against you: equity prices, interest rates, exchange rates and commodity prices. Credit risk (also called default risk or counterparty risk) is the risk that a borrower or counterparty fails to pay what it owes on time and in full. Liquidity risk is the risk of losing value because you cannot buy or sell an asset quickly at a price close to its fair value. It shows up as wide bid-ask spreads or large price concessions. A firm also faces funding liquidity risk if it cannot raise cash to meet obligations.

Non-financial risks come from people, processes, systems, rules and events. Operational risk is the risk of loss from failed or inadequate people, systems, internal processes or external events. Examples are a fraud by an employee, a data-entry error, a server outage or a cyberattack. Model risk is the risk of loss because a valuation or risk model is wrong, misused or built on bad assumptions or data. Settlement risk is the risk that one party delivers its side of a trade (cash or securities) but the other side does not. Regulatory risk is the risk that rules change or that the firm breaches them. Legal risk is the risk of loss from lawsuits or from contracts that cannot be enforced. Sovereign risk is the risk that a government will not repay its debt or will impose controls, such as limits on moving capital out of the country.

Other risks also appear. Tail risk is the chance of extreme outcomes far from the mean. Compliance risk is the risk of breaching laws, rules or internal policies. ESG-related and climate risks can hit asset values and a firm's reputation. Reputational risk is damage to the firm's name.

Risks interact. A market fall can cut asset prices, raise the chance of defaults (credit risk) and dry up trading (liquidity risk) all at once. A weak model can hide how big a market or credit exposure really is. An operational failure can trigger legal and regulatory consequences. So the exam often tests that risks are linked and that one event can show up under more than one label. In such cases choose the category that describes the root cause.

Key formulas to remember

Market risk: Loss from adverse moves in equity prices, interest rates, FX rates or commodity prices; Source is the market itself, not a counterparty failure.
Credit risk: Loss from a counterparty failing to pay in full and on time; Also called default or counterparty risk.
Liquidity risk: Loss from being unable to trade quickly at a price near fair value; Signs: wide bid-ask spread, thin volume, price concessions.
Operational risk: Loss from failed people, systems, processes or external events; Covers fraud, errors, outages and cyberattacks.
Model risk: Loss from a flawed, misused or badly specified model; Wrong inputs or assumptions also count.
Settlement risk: Loss when one side delivers and the other side does not; Arises in the gap between the two legs of a trade.

How to solve Types of Financial and Non-Financial Risks questions

Use this method for any question that asks you to name or distinguish a risk type.

1Read the stem and ask what actually went wrong: a price move, a failure to pay, an inability to trade, a broken process, a bad model, a missed delivery, a rule or a lawsuit.
2Find the trigger word. 'Default' or 'fails to pay' points to credit risk. 'Cannot sell without a big discount' points to liquidity risk. 'Price fell' points to market risk.
3Check who or what failed. A counterparty points to credit or settlement risk. An employee, system or process points to operational risk. A model or its inputs points to model risk.
4Separate credit risk from settlement risk: credit risk is about not paying over the life of an obligation, while settlement risk is about the delivery gap at the time of the trade.
5Separate financial from non-financial risk if the question asks for it: market, credit and liquidity are financial, while the rest are non-financial.
6If several risks are present, pick the root cause, not the later effect.
7Eliminate the two options that describe a different source of loss and choose the remaining one.

Quickest way: Source-of-loss shortcut

When to use it: Use this when you have about 90 seconds and the stem describes a single event.

Underline the cause of loss in one phrase.
Map it: price move = market, nonpayment = credit, cannot trade = liquidity, internal failure = operational, bad model = model, one-sided delivery = settlement, rule change = regulatory, contract or lawsuit = legal, government default or controls = sovereign.
Cross out the two options that name a different cause.
If two options still fit, pick the one closest to the root cause.

Common mistakes in Types of Financial and Non-Financial Risks

Calling a borrower's default a market risk because the bond price fell.
The price drop is the visible effect, so students label the effect.
Fix: Ask why the price fell. If the issuer failed to pay or its credit quality dropped, the root cause is credit risk.
Confusing credit risk with settlement risk.
Both involve a counterparty not performing.
Fix: Settlement risk is the one-sided delivery gap in a trade. Credit risk is the broader chance of nonpayment on an obligation.
Treating liquidity risk as only a lack of cash.
The word 'liquidity' makes students think of the cash balance.
Fix: Remember both forms: market liquidity (cannot trade near fair value) and funding liquidity (cannot raise cash to meet obligations).
Calling a wrong valuation operational risk instead of model risk.
Both involve internal errors.
Fix: If the flaw lies in the model design, assumptions or inputs, it is model risk. If a person or process slipped, such as mistyping a trade, it is operational risk.
Assuming each event fits only one risk type.
Textbook definitions are shown one at a time.
Fix: Know that risks interact, such as a market fall raising credit and liquidity risk together. Then choose the type that best matches the root cause named in the question.
Mixing regulatory, legal and sovereign risk.
All three involve governments or authorities.
Fix: Regulatory is about rules and compliance, legal is about lawsuits and enforceability of contracts, sovereign is about a government's own default or capital controls.

Worked examples

Example 1

A fund holds a thinly traded corporate bond. When the manager tries to sell, the only available bid is 6% below the last quoted price. The issuer is paying all coupons on time. Which risk does this best illustrate?
A. Credit risk
B. Liquidity risk
C. Settlement risk

Show the solution

Identify the cause of loss: the manager cannot sell near the last price because buyers are scarce.
Check for nonpayment: the issuer pays all coupons, so there is no credit event. This eliminates A.
Check for a delivery gap: nothing says one side failed to deliver in a trade. This eliminates C.
The wide discount to sell a thinly traded asset is the sign of liquidity risk.

Answer: B. Liquidity risk

Example 2

A bank's valuation system uses a volatility input copied from the wrong data series, so its reported risk is much lower than the true risk. The system code and the calculation steps were correctly designed and run as intended. Which risk is most directly at issue?
A. Model risk
B. Settlement risk
C. Sovereign risk

Show the solution

Find the root cause: bad input data and assumptions fed to a risk model, causing a misleading output.
Settlement risk concerns a failed delivery in a trade. Nothing here involves a trade delivery, so eliminate B.
Sovereign risk concerns a government's default or controls. No government action is mentioned, so eliminate C.
A wrong valuation or risk figure caused by flawed inputs or assumptions is model risk.

Answer: A. Model risk

Exam tips

Match each description to its risk type by the source of loss. Most questions are definition-and-example matches.
Watch for linked events. When a stem describes one shock causing several effects, choose the root cause.
Remember that market, credit and liquidity risk are the financial group. The rest in this topic are non-financial.
Be ready to separate pairs the exam likes: credit vs settlement, model vs operational, regulatory vs legal.
Options never say 'all of the above', so one choice is clearly the best fit. Eliminate the two that name a different source.

Practice questions from Introduction to Risk Management

Types of Financial and Non-Financial Risks in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Types of Financial and Non-Financial Risks: frequently asked questions

What is the difference between credit risk and market risk?

Credit risk is the chance that a counterparty fails to pay what it owes. Market risk is the chance that prices or rates move against your position. A bond can lose value from either: a rate rise is market risk, an issuer default is credit risk.

What is model risk in CFA Level I?

Model risk is the risk of loss from a model that is wrong, misused or built on poor assumptions or data. A pricing model that understates volatility is an example. It differs from operational risk, where a person or process fails.

What is settlement risk?

Settlement risk is the risk that one party in a trade delivers cash or securities but the other party does not. It arises in the gap between the two sides of the transaction. It is a counterparty risk tied to the moment of delivery.

What are examples of operational risk?

Examples include employee fraud, data-entry mistakes, system outages, failed internal processes and cyberattacks. External events such as a fire at a data centre also count. The common thread is a failure of people, systems, processes or outside events.

Are liquidity risk and credit risk the same?

No. Liquidity risk is about being unable to trade quickly near fair value or to raise cash. Credit risk is about nonpayment by a borrower. An issuer can pay every coupon and still have an illiquid bond.