Risk Identification for FRM Part II: Chapter Guide

What this chapter covers

Risk Identification: topics in the order to study them

1. 1Operational Risk Framework and TaxonomyStart here because every other tool uses its definitions, categories and common language.
2. 2Risk and Control Self-Assessment (RCSA)It is the core internal tool for identifying risks and judging controls, so it comes straight after the taxonomy it relies on.
3. 3Key Risk Indicators and Loss Event DataStudy the data-based tools next to see how RCSA judgements are checked against metrics and actual losses.
4. 4Scenario Analysis and Stress TestingScenarios extend past experience and fill gaps in loss data, so they make most sense once you know the data limits.
5. 5Process Mapping, Change and Emerging Risk IdentificationFinish with the forward-looking and process-level methods, which pull the earlier tools together in case-style questions.

How to prepare Risk Identification

1. Read the taxonomy topic first and write a one-line definition for each main risk category and event type you meet.
2. For each tool, note four things: purpose, inputs, output and main limitation.
3. Build a one-page comparison of RCSA, scenarios, KRIs, loss data and process mapping, marking each as backward or forward looking.
4. Practise short case questions. Read the situation, name the best tool, then say why the others fit less well.
5. Learn the typical weaknesses: subjectivity and bias in RCSA, thin data for tail events, poor thresholds for KRIs, and gaps in scenario design.
6. Link each emerging risk, such as AI, cyber, third-party dependence and change programmes, to the tool most likely used to spot it.
7. In the last week, redo missed questions and reread your comparison sheet until you can recite it without notes.

Common mistakes in Risk Identification

• Treating RCSA, KRIs and scenario analysis as interchangeable.

  Fix: Remember the core idea: RCSA is judgement on risks and controls, KRIs are monitored metrics with thresholds, scenarios are structured what-if events.

• Assuming loss event data gives a full view of risk.

  Fix: State that it is backward looking and sparse for severe, rare events, so it needs scenarios and external data alongside it.

• Picking a KRI answer that is a lagging outcome rather than a leading signal.

  Fix: Ask whether the metric would move before a loss occurs. If it only reports losses after the fact, it is not a good KRI.

• Ignoring bias and subjectivity in self-assessments.

  Fix: Link RCSA to challenge, review by the risk function and comparison with data to reduce bias.

• Skipping emerging and change risks as soft content.

  Fix: Study them with cases. Link new technology, third parties and change programmes to the tools used to detect them.

• Memorising lists without being able to apply them.

  Fix: Practise short cases and always name the tool, the reason it fits and its limitation.

Last-day revision: Risk Identification

• ✓Risk identification comes before measurement: you cannot assess a risk you have not found.
• ✓A common taxonomy gives consistent language so risks can be compared and aggregated across the firm.
• ✓RCSA relies on staff judgement about risks and controls, so it is exposed to bias and optimism.
• ✓RCSA looks at inherent risk, control effectiveness and residual risk.
• ✓Scenario analysis explores severe but plausible events, including ones that have not happened to the firm.
• ✓Stress testing applies extreme conditions to see the effect on the firm.
• ✓KRIs are forward-looking metrics with thresholds that trigger escalation when breached.
• ✓A good KRI is measurable, predictive and tied to a specific risk or control.
• ✓Loss event data is backward looking and has few observations for rare, severe events.
• ✓External loss data helps cover events the firm has not yet experienced.
• ✓Process mapping shows where steps, handoffs and dependencies create risk or control gaps.
• ✓Change and new products bring new risks, so review them before launch and after.

Risk Identification practice questions

• Which of the following is the best example of a risk that falls within the commonly used definition of operational risk, which covers losses…
• A bank runs a stress test for operational risk that assumes a severe economic downturn. Which feature distinguishes this stress test from a …
• A bank sets a KRI for failed trade settlements with a green threshold below 20 fails per week, amber from 20 to 39, and red at 40 or more. W…
• A bank sets a KRI for failed trade settlements with a green threshold below 20 per month, an amber trigger at 20 to 39, and a red limit at 4…
• A bank's RCSA scores likelihood and impact each on a 1-5 scale, and the risk score is likelihood times impact. Controls reduce the score by …
• A bank's operational risk team is preparing to run scenario analysis workshops to identify severe but plausible loss events. Which of the fo…
• During a scenario workshop at a regional bank, business managers estimate the loss from a major payment system outage. The facilitator notic…
• A risk manager is deciding how to structure an operational risk framework around cause, event and effect. A hacker exploits an unpatched ser…

Risk Identification in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

• FRM Part IStress Testing
• CS ExecutiveConcept of Indirect Taxes at a Glance
• CMA FinalOperational Risk and Off-Balance Sheet Risk
• CFA Level IFinancial Statement Forecasting in Equity Valuation