Financial Risk Manager (FRM) Foundations of Risk Management Syllabus

Foundations of Risk Management syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Foundations of Risk Management in Financial Risk Manager (FRM), not a summary of it.

1. 1

   The Role and Building Blocks of Risk Management

   4 topics

   • What risk is and the risk management process
     • Distinguishing risk from uncertainty and from reward
     • The five-step process: identify, measure, monitor, manage, report
     • Expected loss, unexpected loss, and tail risk
   • Typology of financial risks
     • Market, credit, liquidity, and operational risk
     • Business, strategic, and reputational risk
     • Systemic risk and contagion channels
   • Value creation through risk management
     • Risk transfer, mitigation, and retention decisions
     • Costs of financial distress and the case for hedging
   • Risk-taking limits and risk appetite frameworks
2. 2

   Corporate Governance and the Risk Function

   4 topics

   • Enterprise Risk Management (ERM) design
     • Top-down integrated risk view versus risk silos
     • Benefits and implementation challenges of ERM
   • Risk governance and the board's responsibilities
   • The Chief Risk Officer mandate and three lines of defense
   • Risk culture, incentives, and the audit function
3. 3

   Modern Portfolio Theory and Risk-Adjusted Return

   4 topics

   • Mean-variance framework and the efficient frontier
     • Diversification and the role of correlation
     • Capital Market Line and the market portfolio
   • The Capital Asset Pricing Model (CAPM)
     • Systematic versus idiosyncratic risk and beta
     • Security Market Line and equilibrium pricing
   • Multifactor models: APT and the Fama-French factors
   • Performance measures: Sharpe, Treynor, Jensen's alpha, Sortino, and information ratio
4. 4

   Lessons from Financial Disasters and Crises

   4 topics

   • Market-risk and liquidity blowups
     • LTCM and the perils of leverage and convergence trades
     • Metallgesellschaft and stack-and-roll hedging
   • Rogue trading and operational failures
     • Barings, Société Générale, and control breakdowns
   • The 2007-2009 Global Financial Crisis
     • Subprime mortgages, securitization, and the shadow banking system
     • Funding versus market liquidity spirals
   • Case studies in model and reporting risk
5. 5

   Ethics and the GARP Code of Conduct

   4 topics

   • Principles: professional integrity and conflicts of interest
   • Duties to clients, employers, and the profession
   • Confidentiality and fundamental responsibilities
   • Enforcement, rules of procedure, and applicability

Foundations of Risk Management flashcards for Financial Risk Manager (FRM)

21 of 50 cards from the Foundations of Risk Management deck — real questions with worked answers.

1. Define "risk" in the context of financial risk management.

   Risk is the uncertainty (variability) of outcomes around an expected value, specifically the possibility that actual results will differ from expected results, leading to potential financial loss or gain. It combines the likelihood of an event with the magnitude of its consequences.

2. What are the main steps of the risk management process?

   (1) Identify risks, (2) Measure/quantify and estimate risk exposures, (3) Assess effects/evaluate against risk appetite, (4) Form a risk mitigation strategy (avoid, retain, mitigate, or transfer), and (5) Monitor, report, and control on an ongoing basis.

3. Distinguish between expected loss, unexpected loss, and tail risk.

   Expected loss is the anticipated average loss over a period (a cost of doing business, covered by reserves/pricing). Unexpected loss is the variability of losses around the expected value (covered by economic capital). Tail risk is the risk of extreme, low-probability, high-severity losses beyond normal expectations.

4. List the major categories in the typology of financial risks.

   Market risk, credit risk, liquidity risk, operational risk, and business/strategic risk (with legal, regulatory, and reputational risk often included as sub-types).

5. What are the four sub-types of market risk?

   Interest rate risk, equity price risk, foreign exchange (currency) risk, and commodity price risk.

6. Distinguish between funding liquidity risk and market (trading) liquidity risk.

   Funding liquidity risk is the inability to meet cash-flow obligations (raise cash) when due without incurring unacceptable losses. Market liquidity risk is the inability to sell or unwind a position quickly at a fair price due to inadequate market depth or disruption.

7. Define operational risk per the Basel framework.

   The risk of loss resulting from inadequate or failed internal processes, people, and systems, or from external events. It explicitly includes legal risk but excludes strategic and reputational risk.

8. How can risk management create value for a firm? Name several channels.

   By reducing the probability and costs of financial distress/bankruptcy, lowering expected taxes (convex tax schedules), reducing costly external financing needs (avoiding underinvestment), improving capital allocation and decision-making, and stabilizing cash flows so the firm can pursue positive-NPV projects.

9. Under the Modigliani-Miller assumptions, why would hedging be irrelevant, and why does it matter in practice?

   In perfect markets (no taxes, no distress costs, symmetric information), hedging adds no value because investors can diversify/hedge on their own. In practice, market imperfections such as taxes, bankruptcy costs, agency costs, and information asymmetries make firm-level risk management value-creating.

10. Differentiate risk appetite, risk tolerance, and risk capacity.

    Risk capacity is the maximum risk a firm can absorb given its capital and resources. Risk appetite is the amount and type of risk a firm is willing to accept to pursue its objectives. Risk tolerance is the acceptable variation around specific objectives/limits, typically more granular and quantitative.

11. What is a risk appetite framework (RAF)?

    The overall approach—policies, processes, controls, and systems—through which risk appetite is established, communicated, and monitored. It includes a risk appetite statement, risk limits, and the roles/responsibilities for overseeing implementation.

12. Why are risk-taking limits used, and give examples of limit types.

    Limits operationalize risk appetite by constraining exposures at desk, business-unit, and firm levels. Examples: notional/position limits, Value-at-Risk (VaR) limits, stop-loss limits, concentration limits, stress-loss limits, and liquidity limits.

13. Define Enterprise Risk Management (ERM).

    ERM is a comprehensive, integrated, firm-wide approach to managing all of an organization's key risks across business units in a coordinated way, aligning risk management with strategy and capital, rather than treating risks in isolated silos.

14. What are key benefits and challenges of implementing ERM?

    Benefits: integrated view of risk, recognition of risk interdependencies/diversification, better capital allocation, and alignment with strategy. Challenges: aggregating disparate risks, data and modeling complexity, organizational/cultural resistance, and the cost of governance infrastructure.

15. What is the board of directors' primary responsibility regarding risk governance?

    The board sets the firm's risk appetite and overall risk strategy, ensures an effective risk management framework exists, oversees senior management's execution, and holds ultimate accountability for the firm's risk-taking—while delegating day-to-day management to executives.

16. What is the role of a board risk committee?

    It assists the board in overseeing the risk management framework: reviewing and recommending risk appetite, monitoring the firm's risk profile against limits, evaluating major risk exposures, and ensuring independence and adequate resourcing of the risk function.

17. Describe the mandate of the Chief Risk Officer (CRO).

    The CRO leads the enterprise risk management function: developing risk policies and appetite, measuring and monitoring firm-wide risk, ensuring compliance with limits, communicating risk to the board and CEO, and maintaining independence from revenue-generating (front office) units.

18. Explain the "three lines of defense" model.

    First line: business units that own and manage risk day-to-day. Second line: independent risk management and compliance functions that set policy and oversee/challenge the first line. Third line: internal audit, which independently assures the board that the first two lines operate effectively.

19. What is risk culture and why does it matter?

    Risk culture is the shared norms, attitudes, and behaviors that shape how an organization identifies, discusses, and takes risk. A strong risk culture promotes transparency, accountability, and constructive challenge, helping prevent excessive risk-taking and conduct failures.

20. How can incentive structures contribute to excessive risk-taking?

    Compensation tied to short-term profits or revenue (e.g., bonuses, options) can encourage employees to take excessive or hidden risk because gains are rewarded while losses are borne by the firm/shareholders—an asymmetric payoff and moral-hazard problem. Deferred pay and clawbacks help mitigate this.

21. What is the role of the internal audit function in risk governance?

    As the third line of defense, internal audit independently and objectively assesses the design and effectiveness of the firm's risk management, internal controls, and governance, reporting findings directly to the audit committee/board.

See more Foundations of Risk Management flashcards →

Planning Foundations of Risk Management for Financial Risk Manager (FRM)

Foundations of Risk Management (Financial Risk Manager (FRM)) FAQ