FRM Exam Part I · The Building Blocks of Risk Management

Types of Risk and the Risk Management Process

Updated 11 October 2026 · Fact-checked

Risk is the chance that actual outcomes differ from expected ones, usually with a loss. The risk management process identifies, measures, mitigates and monitors risk. To classify a risk, find its source: price moves are market risk, counterparty failure is credit risk, inability to trade or fund is liquidity risk, failed processes are operational risk.

Understand Risk Management Process and Risk Types

Risk is uncertainty about future outcomes that can hurt value or earnings. It is not the same as loss. A loss is a result. Risk is the possibility of results worse than you expect. GARP also separates risk from uncertainty: risk can be given probabilities, while pure uncertainty cannot.

The risk management process is a loop, not a one-off task. You identify the risks, measure them, decide how to treat them, and then monitor and report. Treatment means avoiding, reducing, transferring or accepting the risk. Monitoring feeds back into identification because exposures change as markets and positions change.

The main financial risks are defined by where the loss comes from. Market risk is loss from changes in prices or rates such as equity prices, interest rates, FX rates and commodity prices. Credit risk is loss because a borrower or counterparty fails to pay in full and on time. It includes default risk, downgrade risk and settlement risk. Liquidity risk has two forms. Market liquidity risk means you cannot sell an asset near its fair price. Funding liquidity risk means you cannot raise cash to meet obligations.

Non-financial risks include operational risk, which is loss from failed internal processes, people, systems or external events. The Basel definition includes legal risk but excludes strategic and reputational risk. Business risk is the risk that revenues or margins fall because of demand, competition or costs. Related ideas are strategic risk, which comes from poor strategic choices, and reputational risk, which is damage to trust.

Risks also interact. One event can trigger several types. A bank failure can start as a credit loss, become a funding squeeze, and end as reputational damage. Exam questions test whether you can find the primary source of loss and know that categories overlap.

Key formulas to remember

Risk management process: Identify → Measure → Treat (avoid, reduce, transfer, accept) → Monitor and report → repeat; A continuous loop. Monitoring feeds back into identification.
Market risk: Loss from changes in prices or rates (equity, interest rate, FX, commodity); Arises from positions you hold, even if no counterparty fails.
Credit risk: Loss from a counterparty failing to pay in full and on time; Includes default, downgrade and settlement risk.
Liquidity risk: Market liquidity: cannot sell near fair price. Funding liquidity: cannot raise cash to meet obligations; Two distinct forms. Name the one in the question.
Operational risk (Basel): Loss from inadequate or failed internal processes, people, systems, or external events; The Basel definition includes legal risk and excludes strategic and reputational risk.
Risk treatment options: Avoid, reduce (mitigate), transfer, accept (retain: deliberately bear the risk, for example with capital or reserves held against it); Hedging and insurance are transfer. Diversification is reduction.

How to solve Risk Management Process and Risk Types questions

Use this method for any question that asks you to classify a risk, name a stage of the process, or pick the best treatment.

1Read the scenario and find the event that causes the loss. Ignore the story around it.
2Ask what the loss depends on: a price move, a counterparty failing, an inability to trade or fund, a broken process, or falling demand.
3Match the source to a category: market, credit, liquidity (market or funding), operational, or business.
4Check for traps. A sold-off asset at a discount is market liquidity, not market risk. A trader's fraud is operational, not market.
5If the question is about the process, place the action in the stage: finding, measuring, treating or monitoring.
6If it asks for a treatment, match it: stop the activity is avoid, hedge or insure is transfer, diversify or limit is reduce, and accept or retain the risk (for example, deliberately bear it and hold capital or reserves against it) is accept.
7Eliminate options that describe a different source of loss, then confirm the remaining one fits the exact wording.

Quickest way: Source-of-loss test

When to use it: Use for any classification question when time is short.

Ask one question: what did the loss depend on?
Price or rate moved: market. Counterparty did not pay: credit.
Could not sell or could not borrow: liquidity (pick market or funding).
Process, person, system, fraud or external event: operational.
Revenue or margin fell from demand or competition: business.

Common mistakes in Risk Management Process and Risk Types

Calling any loss from a falling price market risk, even when the cause is a default.
A default also lowers the bond's price, so it looks like a price move.
Fix: Look for the root cause. If a counterparty failed to pay or was downgraded, it is credit risk.
Mixing up market liquidity risk and funding liquidity risk.
Both are called liquidity risk and both appear in crises.
Fix: Market liquidity is about selling an asset. Funding liquidity is about raising cash. Check which side of the balance sheet the problem sits on.
Treating rogue trading as market risk because it involves trading.
The loss shows up as market losses.
Fix: If the cause is unauthorised or failed controls, it is operational risk.
Including strategic and reputational risk in the Basel operational risk definition.
Students think operational risk covers everything non-financial.
Fix: Remember the Basel definition includes legal risk and excludes strategic and reputational risk.
Confusing risk with uncertainty, or with loss itself.
Everyday language uses the words loosely.
Fix: Risk is a measurable possibility of adverse outcomes. Loss is an outcome. Uncertainty cannot be assigned probabilities.
Treating the risk management process as a straight line that ends at reporting.
Lists of steps look sequential.
Fix: Remember it is a loop. Monitoring feeds new information back into identification.

Worked examples

Example 1

A bank holds a corporate bond. The issuer is downgraded from A to BBB and the bond price falls. Which risk is the primary source of the loss? (A) Market risk (B) Credit risk (C) Funding liquidity risk (D) Operational risk

Show the solution

Find the cause of the loss: the issuer's creditworthiness fell.
Price moved only because the market reassessed the issuer's ability to pay.
A downgrade is a form of credit risk, even without a default.
Funding liquidity and operational risk are not involved: no cash shortfall or process failure is described.

Answer: (B) Credit risk

Example 2

A fund holds a thinly traded bond and, when it tries to sell, can only do so at a steep discount because few buyers exist. Which risk is most directly described? (A) Credit risk (B) Funding liquidity risk (C) Market liquidity risk (D) Business risk

Show the solution

Find what failed: the fund cannot sell the bond near fair value.
No counterparty default or downgrade is described, so (A) is out.
Funding liquidity risk is the inability to raise cash to meet obligations. No cash need or obligation is described, so (B) is not the best fit.
Business risk concerns falling revenues or margins, so (D) is out.
The root problem is thin buyers and poor market depth for the asset, which is market liquidity risk.

Answer: (C) Market liquidity risk

Exam tips

Questions give a short scenario and ask for the primary risk. Find the root cause before reading the options.
Watch for options that are real risks but not the main one. Several may be true; choose the best fit.
Learn the Basel operational risk definition, including that it includes legal risk and excludes strategic and reputational risk.
Know the four treatment options and match hedging, insurance and diversification to them correctly.
Expect interaction cases, such as a credit event causing a liquidity squeeze. Pick the risk that started the chain.

Practice questions from The Building Blocks of Risk Management

Risk Management Process and Risk Types in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Risk Management Process and Risk Types: frequently asked questions

What are the main types of risk in FRM Part I?

The core financial risks are market, credit and liquidity risk. Non-financial risks include operational, business, strategic and reputational risk. You must be able to define each and classify scenarios.

What is the difference between market risk and credit risk?

Market risk is loss from changes in prices or rates, such as equity, interest rate or FX moves. Credit risk is loss because a counterparty fails to pay in full and on time. A downgrade or default is credit risk even though it also moves prices.

What are the steps of the risk management process?

You identify risks, measure them, treat them by avoiding, reducing, transferring or accepting, then monitor and report. The process repeats because exposures change over time.

How do I tell market liquidity risk from funding liquidity risk?

Market liquidity risk is the inability to sell an asset near its fair price. Funding liquidity risk is the inability to raise cash to meet obligations. Ask whether the problem is selling an asset or raising money.