FRM Exam Part II · Stress Testing Banks

Stress Testing Liquidity and Operational Risk in Banks

Updated 11 October 2026 · Fact-checked

Liquidity stress testing projects cash inflows, outflows and available buffers under severe but plausible scenarios to find the survival horizon. Operational stress testing applies scenario analysis to loss events such as cyber attacks or fraud. Both feed resilience actions and the contingency funding plan.

Understand Stress Testing Liquidity and Operational Risk

A stress test asks one question: if conditions turn severe but plausible, can the bank still cope? For credit and market risk, the answer is mostly about losses and capital. For liquidity and operational risk, the answer is about cash, continuity and survival.

Liquidity stress testing projects cash flows over set horizons, such as overnight, 30 days and 90 days, under stress. You start with the contractual cash flows. You then replace normal behaviour with stressed behaviour: deposits run off faster, wholesale funding is not rolled over, credit lines are drawn, collateral calls rise, and asset sales happen at discounts (haircuts). Next you compare the stressed net outflows with the liquidity buffer, or counterbalancing capacity. The result is often a survival horizon: the number of days the bank can meet its obligations before the buffer runs out.

Scenarios come in three types. An idiosyncratic scenario hits only the bank, such as a rating downgrade or a scandal. A market-wide scenario hits all institutions, such as a funding market freeze. A combined scenario does both and is the most severe. Banks also use reverse stress testing: you start from the failure outcome, such as the buffer being exhausted, and work back to find which events would cause it.

Operational risk stress testing works differently because history gives little data on rare, large losses. Banks use scenario analysis. Experts design a severe event, for example a prolonged cloud outage, a major cyber breach or a rogue trader. They estimate how often it could happen (frequency) and how large the loss could be (severity). They count direct losses, fines, remediation and customer compensation. They also check control failures and dependence on third parties. Scenarios are often stressed further by assuming several controls fail together.

Results must lead to action. For liquidity, the output sets buffer size, limits, and the triggers and actions in the contingency funding plan (CFP). The CFP lists early warning indicators, escalation roles, and funding sources to use in a crisis. For operational risk, the output drives control upgrades, business continuity plans, recovery time targets and insurance or risk transfer decisions. Management and the board must review results and challenge the assumptions.

Key formulas to remember

Stressed net cash outflow: Net outflow = Stressed outflows − Stressed inflows; Apply run-off rates to liabilities and drawdown rates to commitments. Apply haircuts and delays to inflows.
Liquidity surplus or shortfall: Surplus = Liquidity buffer (after haircuts) − Cumulative stressed net outflow; A negative value is a shortfall and should trigger CFP action.
Survival horizon: Survival horizon ≈ Liquidity buffer ÷ Average daily stressed net outflow; A simple approximation. In practice, use the day on which the cumulative net outflow first exceeds the buffer.
Buffer value after haircut: Stressed value = Market value × (1 − haircut); Use stressed haircuts, not normal ones.
Liquidity coverage ratio: LCR = Stock of HQLA ÷ Total net cash outflows over 30 days ≥ 100%; The Basel regulatory 30-day stress standard. Internal stress tests should be at least as demanding in design.
Scenario loss estimate: Scenario loss = Frequency × Severity (annualised) or total loss = direct loss + fines + remediation + other costs; Expected annual loss from a scenario uses frequency times severity. A single stressed event uses the total of its cost components.

How to solve Stress Testing Liquidity and Operational Risk questions

Use this order for any question on liquidity or operational stress testing.

1Identify the risk type: funding and liquidity, or operational loss events.
2Identify the scenario type: idiosyncratic, market-wide, combined, or reverse.
3List the stressed assumptions given: run-off rates, drawdown rates, haircuts, frequency and severity.
4Calculate stressed outflows and inflows, then the net outflow over the horizon.
5Compare with the buffer after haircuts, and compute the surplus, shortfall or survival horizon. For operational risk, sum the loss components.
6Interpret the result against limits, risk appetite and regulatory minimums.
7Link to action: CFP triggers, buffer size, control upgrades, continuity plans.
8Check that the answer uses the right Basel or regulatory term.

Quickest way: Outflow, buffer, gap

When to use it: Use for numerical MCQs on liquidity stress testing when time is short.

Multiply each liability by its run-off rate and add them to get total outflows.
Apply the haircut to each buffer asset and add them to get the usable buffer.
Subtract inflows from outflows to get net outflow. Do not count inflows from sources the question says are unavailable.
Gap = buffer − net outflow. If the question asks for survival horizon, divide the buffer by daily net outflow.
Eliminate options that use unhaircut values or forget inflows.

Common mistakes in Stress Testing Liquidity and Operational Risk

Using market value of buffer assets without haircuts.
Candidates focus on the outflows and treat the buffer as given.
Fix: Always apply the stressed haircut to each asset before comparing with outflows.
Treating contractual cash flows as the stressed ones.
Contract terms look precise, so they feel safe.
Fix: Use behavioural assumptions: faster deposit run-off, drawn commitments, no rollover of wholesale funding.
Confusing idiosyncratic and market-wide scenarios.
Both words describe stress, and the labels sound alike.
Fix: Idiosyncratic means bank-specific. Market-wide hits the whole system and limits asset sales. Combined is the harshest.
Estimating operational stress losses from average past losses only.
Candidates carry over the logic from historical VaR.
Fix: Stress scenarios target rare, severe events. Use expert judgement, external data and control failure assumptions, not just averages.
Treating the stress test as the end product.
Candidates focus on the calculation.
Fix: Results must feed the CFP, buffer sizing, limits, risk appetite and control or continuity improvements.
Assuming reverse stress testing starts from a scenario.
It is mixed up with standard stress testing.
Fix: Reverse stress testing starts from a defined failure outcome and finds the events that would cause it.

Worked examples

Example 1

A bank has stressed 30-day assumptions: retail deposits of USD 400 million run off at 10%; wholesale funding of USD 200 million of maturing debt is not rolled over at all (100% outflow); undrawn commitments of USD 100 million are drawn at 20%. Stressed inflows are USD 30 million. The buffer holds USD 50 million cash and USD 150 million government bonds with a 5% stressed haircut. What is the 30-day surplus or shortfall?

Show the solution

Retail outflow = 400 × 10% = USD 40 million.
Wholesale outflow = 200 × 100% = USD 200 million.
Commitment drawdown = 100 × 20% = USD 20 million.
Total outflows = 40 + 200 + 20 = USD 260 million.
Net outflow = 260 − 30 = USD 230 million.
Bond value after haircut = 150 × (1 − 0.05) = USD 142.5 million.
Buffer = 50 + 142.5 = USD 192.5 million.
Surplus = 192.5 − 230 = −USD 37.5 million.

Answer: A shortfall of USD 37.5 million. The bank would need CFP actions such as secured borrowing or asset sales, and should review buffer size and wholesale rollover concentration.

Example 2

An operational risk scenario for a cyber breach assumes: direct fraud losses USD 12 million, system remediation USD 8 million, regulatory fine USD 15 million, and customer compensation USD 5 million. The scenario team estimates a 2% annual probability of the event. What is the total loss in the scenario and the expected annual loss from it?

Show the solution

Total scenario loss = 12 + 8 + 15 + 5 = USD 40 million.
Expected annual loss = frequency × severity = 0.02 × 40 = USD 0.8 million.
Interpretation: the expected figure is small, but the severe single-event loss of USD 40 million is what matters for stress and resilience planning.

Answer: Total loss is USD 40 million. Expected annual loss is USD 0.8 million. The stress result drives control upgrades, continuity planning and capital or insurance decisions.

Exam tips

Read which scenario the question uses. Combined scenarios usually imply tougher run-off and haircut assumptions.
Check units and horizon carefully. Overnight, 30-day and 90-day figures are not interchangeable.
Remember that outflow assumptions apply to liabilities and commitments, while haircuts apply to buffer assets.
For operational risk, expect conceptual questions about scenario analysis, control failure and using results for resilience.
When an option links results to the CFP, risk appetite or buffer sizing, it is usually stronger than one that only reports a number.

Practice questions from Stress Testing Banks

Stress Testing Liquidity and Operational Risk in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Stress Testing Liquidity and Operational Risk: frequently asked questions

What is the purpose of liquidity stress testing in banks?

It shows whether the bank can meet obligations under severe but plausible conditions. It helps size the liquidity buffer, set limits and design the contingency funding plan. It also supports supervisory reviews.

How do you stress test operational risk losses?

You build severe scenarios such as cyber breaches, fraud or outages. You estimate frequency and severity, include direct and indirect costs, and assume some controls fail. The results guide controls, continuity plans and capital or insurance decisions.

How is a stress test linked to a contingency funding plan?

Stress results show when and how large funding gaps could be. The CFP then sets early warning indicators, escalation steps and the funding sources to use. Stress tests also help check that the planned actions are large enough.

What is reverse stress testing?

You start with a failure outcome, such as the liquidity buffer running out or a capital breach. You then identify the scenarios that would produce it. It exposes vulnerabilities that standard scenarios may miss.