Part A: Foundations
Overview of risk management
Key takeaways
- Risk is the possibility that an actual outcome will differ from what was expected in a way that could cause loss or harm, judged on two dimensions: likelihood and impact.
- A business faces strategic, operational, financial, compliance or legal, and reputational risk; credit risk is a financial risk, and the subject of the rest of this guide.
- The risk management process runs in five steps: identify, assess, treat, monitor and review.
- Treating a risk means deciding how to respond to it: avoid, reduce, transfer or accept it.
- Monitoring tracks key risk indicators against thresholds, checks that controls work, reports to management and keeps the risk register up to date.
Credit risk, the subject of every later chapter, is one risk among several a business faces. This opening chapter sets out risk management in general, the discipline credit risk management is a specific application of.
What risk is
Risk is the possibility that an actual outcome will differ from what was expected, in a way that could cause loss or harm. In a business context, risk combines two dimensions: the likelihood of an adverse event occurring, and the size of its impact if it does.
Risks a business faces
- Strategic risk, the risk that an organisation's chosen direction turns out to be wrong
- Operational risk, the risk of loss from failed processes, people, or systems
- Financial risk, including credit risk, liquidity risk and market risk (currency, interest rate)
- Compliance/legal risk, the risk of loss from failing to meet legal or regulatory obligations
- Reputational risk, the risk of damage to an organisation's standing with customers, investors or the public
- Credit risk specifically, the risk a borrower or counterparty fails to meet its obligations, the subject of the rest of this guide
Risk management process
Steps in the risk management process
1. Identify: recognise what risks the organisation actually faces
2. Assess/analyse: estimate the likelihood and impact of each risk identified
3. Treat/mitigate: decide how to respond, avoid, reduce, transfer, or accept the risk
4. Monitor: track how identified risks, and the controls addressing them, are performing
5. Review: periodically reassess the whole process as circumstances change
Monitoring and evaluating risks
- Track key risk indicators against set thresholds on an ongoing basis
- Review whether existing controls and mitigations are actually working as intended
- Reassess risks periodically, since likelihood and impact both change over time
- Report findings to the appropriate level of management or governance for action
- Update the risk register or risk profile to reflect what monitoring reveals
Exam tip
The five-step risk management process is the backbone of this entire paper: every later chapter (assessment, measurement, mitigation) is really elaborating on one step of this same cycle applied specifically to credit risk.
Self-check
(a) State the five steps of the risk management process in order. (5 marks)
(b) Distinguish strategic risk from operational risk. (3 marks)
(c) State two activities involved in monitoring and evaluating risk on an ongoing basis. (2 marks)
Show worked answer
(a) Identify; assess/analyse; treat/mitigate; monitor; review (5 marks).
(b) Strategic risk is the risk that an organisation's chosen direction turns out to be wrong; operational risk is the risk of loss from failed internal processes, people or systems, strategic risk concerns whether the organisation is doing the right thing, operational risk concerns whether it is doing things right (3 marks).
(c) Any two of: track key risk indicators against set thresholds; review whether existing controls are working; reassess risks periodically; report findings to management or governance; update the risk register (2 marks).