Chartered Institute for Securities & Investment (CISI) Qualifications Risk Management in Financial Services Syllabus

What is Credit Valuation Adjustment (CVA)?

An adjustment to the value of a derivative reflecting the expected loss from counterparty default risk; it is the market price of counterparty credit risk over the life of the trade.

Distinguish funding liquidity risk from market liquidity risk.

Funding liquidity risk is the risk a firm cannot meet its cash-flow obligations as they fall due without incurring unacceptable cost; market liquidity risk is the risk that a position cannot be sold/unwound quickly without significantly moving its price.

What is a maturity (liquidity) mismatch?

A gap between the maturities of assets and liabilities (e.g. funding long-term illiquid loans with short-term deposits), exposing the firm to refinancing and liquidity risk.

What is a 'liquidity buffer'?

A stock of high-quality, unencumbered liquid assets a firm holds to survive a period of liquidity stress when normal funding sources are unavailable.

Define operational risk per Basel.

The risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. It includes legal risk but excludes strategic and reputational risk.

What are the seven Basel operational risk loss event-type categories?

Internal fraud; External fraud; Employment practices and workplace safety; Clients, products and business practices; Damage to physical assets; Business disruption and system failures; Execution, delivery and process management.

What is loss data (internal and external) used for in operational risk?

Internal loss data records a firm's own historical op-risk losses; external loss data captures industry losses. Both feed risk quantification, capital modelling, scenario analysis and benchmarking of exposures.

What is a 'near miss' in operational risk?

An event that had the potential to cause a loss but did not (often by chance or timely intervention); recording near misses provides valuable early-warning insight into control weaknesses.

Distinguish conduct risk from operational risk.

Conduct risk is the risk that a firm's behaviour results in poor outcomes or harm to customers, markets or competition; it is closely linked to but broader than pure operational risk and central to regulatory expectations (e.g. FCA).

Define legal risk and reputational risk.

Legal risk is the risk of loss from unenforceable contracts, lawsuits, regulatory sanctions or defective documentation. Reputational risk is the risk of damage to a firm's standing/brand that can reduce customer trust, revenue and market value.

Why is reputational risk difficult to manage and quantify?

It is often a consequence of other risks crystallising, is hard to measure in monetary terms, can escalate rapidly (especially via media/social media), and recovery can be slow and costly.

Define cyber risk in financial services.

The risk of financial loss, disruption or reputational damage from failure, breach or malicious attack on a firm's information technology systems, data and digital infrastructure.

What is operational resilience?

A firm's ability to prevent, adapt to, respond to, recover from and learn from operational disruptions so that it can continue to deliver its important business services within impact tolerances.

What is an 'impact tolerance' in the UK operational resilience framework?

The maximum tolerable level of disruption to an important business service, expressed by a metric such as the maximum length of time the service can be disrupted before causing intolerable harm to consumers or market integrity.

Name common types of cyber attack relevant to financial firms.

Phishing/social engineering, malware and ransomware, distributed denial-of-service (DDoS), data breaches/exfiltration, and supply-chain/third-party attacks.

Define climate-related financial risk and its two main categories.

The financial risks from climate change, split into physical risk (losses from climate/weather events and chronic environmental change) and transition risk (losses from the shift to a low-carbon economy, e.g. policy, technology and market changes).

What does ESG stand for, and how does it relate to financial risk?

Environmental, Social and Governance. ESG factors can be sources of financial risk (e.g. stranded assets, social/conduct issues, governance failures) and are increasingly integrated into risk management, disclosure and investment decisions.

What is 'greenwashing' and why is it a risk?

Making misleading or unsubstantiated claims about the environmental/sustainability credentials of a product or firm; it creates conduct, legal, regulatory and reputational risk.

What are the three pillars of the Basel framework?

Pillar 1: minimum capital requirements (credit, market, operational risk); Pillar 2: supervisory review process (ICAAP/SREP) and additional risks; Pillar 3: market discipline through disclosure.

State the Basel III total minimum capital requirement as a ratio of risk-weighted assets.

$$\frac{\text{Total Capital}}{\text{RWA}} \geq 8\%$$ comprising minimum CET1 of 4.5%, Tier 1 of 6%, and Total Capital of 8% of risk-weighted assets.

What is the Basel III minimum Common Equity Tier 1 (CET1) ratio?

$$\frac{\text{CET1 capital}}{\text{RWA}} \geq 4.5\%$$ CET1 is the highest-quality capital, consisting mainly of common shares and retained earnings.

What is the Capital Conservation Buffer under Basel III?

An additional buffer of 2.5% of RWA made up of CET1, on top of minimum requirements, bringing the effective CET1 requirement to 7%. Breaching it restricts distributions such as dividends and bonuses.

What is the countercyclical capital buffer (CCyB)?

A variable CET1 buffer (typically 0–2.5% of RWA) set by national authorities, raised in periods of excess credit growth to build resilience and released in downturns to support lending.

What is the Basel III leverage ratio and its purpose?

$$\text{Leverage Ratio} = \frac{\text{Tier 1 Capital}}{\text{Total Exposure Measure}} \geq 3\%$$ A non-risk-based backstop limiting excessive build-up of leverage independent of risk weightings.

Define the Liquidity Coverage Ratio (LCR) and its formula.

$$\text{LCR} = \frac{\text{High-Quality Liquid Assets (HQLA)}}{\text{Total net cash outflows over 30 days}} \geq 100\%$$ It ensures a firm holds enough HQLA to survive a 30-day stress scenario.

What are the categories of High-Quality Liquid Assets (HQLA) under the LCR?

Level 1 (highest quality, e.g. cash, central bank reserves, high-grade sovereign bonds — no haircut, unlimited); Level 2A and Level 2B (lower quality with haircuts and a cap, with Level 2 limited to 40% of total HQLA and 2B to 15%).

Define the Net Stable Funding Ratio (NSFR) and its formula.

$$\text{NSFR} = \frac{\text{Available Stable Funding (ASF)}}{\text{Required Stable Funding (RSF)}} \geq 100\%$$ It promotes resilient funding over a one-year horizon by matching long-term assets with stable funding.

Contrast the time horizons of the LCR and NSFR.

The LCR addresses short-term liquidity resilience over a 30-day stress period, while the NSFR addresses structural/longer-term funding stability over a one-year horizon.

What is the Investment Firms Prudential Regime (IFPR)?

The UK prudential framework (effective 1 January 2022, FCA-administered) for MiFID investment firms, replacing earlier CRR/BIPRU regimes with a more proportionate approach focused on the harm a firm can pose to clients and markets.

What are the 'K-factors' under the IFPR?

Quantitative own-funds requirements capturing the risk of harm an investment firm poses, grouped as Risk-to-Client (RtC), Risk-to-Market (RtM) and Risk-to-Firm (RtF); examples include K-AUM, K-CMH, K-ASA, K-COH, K-NPR, K-DTF, K-CON.

How does the IFPR classify investment firms, and what is the SNI category?

Firms are classified as Small and Non-Interconnected (SNI) or non-SNI. SNI firms meet size/activity thresholds (e.g. low AUM, no client money/assets held) and benefit from simpler, lighter-touch requirements; non-SNI firms face the fuller regime including K-factors.

Under the IFPR, how is an investment firm's own funds requirement determined?

It is the highest of the Permanent Minimum Requirement (PMR), the Fixed Overheads Requirement (FOR, = one quarter of annual fixed overheads), and the K-Factor Requirement (KFR, the sum of applicable K-factors).