Financial Risk Manager (FRM) Foundations of Risk Management Syllabus

What is the role of the internal audit function in risk governance?

As the third line of defense, internal audit independently and objectively assesses the design and effectiveness of the firm's risk management, internal controls, and governance, reporting findings directly to the audit committee/board.

State the formula for the variance of a two-asset portfolio.

$$\sigma_p^{2} = w_1^{2}\sigma_1^{2} + w_2^{2}\sigma_2^{2} + 2 w_1 w_2 \rho_{12}\sigma_1\sigma_2$$ where $w_i$ are weights, $\sigma_i$ are standard deviations, and $\rho_{12}$ is the correlation coefficient.

What is the efficient frontier in the mean-variance framework?

The set of portfolios that offer the maximum expected return for each level of risk (standard deviation), or equivalently the minimum risk for each level of expected return. It is the upper boundary of the feasible (opportunity) set above the minimum-variance portfolio.

What is the capital market line (CML) and its equation?

The CML is the line from the risk-free asset tangent to the efficient frontier (through the market portfolio), describing efficient portfolios of the risk-free asset and market portfolio: $$E(R_p) = R_f + \frac{E(R_M)-R_f}{\sigma_M}\,\sigma_p$$

State the Capital Asset Pricing Model (CAPM) equation.

$$E(R_i) = R_f + \beta_i\,\bigl(E(R_M) - R_f\bigr)$$ where $\beta_i$ is the asset's systematic risk and $E(R_M)-R_f$ is the market risk premium.

How is beta defined and computed in the CAPM?

Beta measures an asset's systematic (non-diversifiable) risk relative to the market: $$\beta_i = \frac{\operatorname{Cov}(R_i, R_M)}{\sigma_M^{2}} = \rho_{i,M}\,\frac{\sigma_i}{\sigma_M}$$

What are the key assumptions of the CAPM?

Investors are rational, risk-averse, and mean-variance optimizers; markets are frictionless (no taxes/transaction costs); all investors have homogeneous expectations and a single holding period; unlimited borrowing/lending at the risk-free rate; and all assets are marketable and infinitely divisible.

Distinguish the Capital Market Line (CML) from the Security Market Line (SML).

The CML plots expected return against total risk ($\sigma$) and applies only to efficient portfolios. The SML plots expected return against systematic risk (beta) and applies to all assets and portfolios, efficient or not. The SML graphs the CAPM.

State the Arbitrage Pricing Theory (APT) model.

$$E(R_i) = R_f + \beta_{i,1}\lambda_1 + \beta_{i,2}\lambda_2 + \cdots + \beta_{i,k}\lambda_k$$ where each $\beta_{i,j}$ is the sensitivity to factor $j$ and $\lambda_j$ is the risk premium for that factor. APT requires no-arbitrage and a factor structure but not the CAPM's restrictive assumptions.

How does APT differ from the CAPM?

CAPM is a single-factor (market) equilibrium model with strong assumptions (mean-variance investors, market portfolio). APT is a multifactor model derived from no-arbitrage; it allows many systematic factors, does not require identifying the market portfolio, and makes fewer assumptions, but it does not specify the factors.

Name the three factors in the Fama-French three-factor model.

(1) Market risk premium ($R_M - R_f$), (2) SMB (Small Minus Big)—the size premium, and (3) HML (High Minus Low)—the value premium based on book-to-market ratio. Carhart later added a fourth factor: momentum (WML/UMD).

State the Fama-French three-factor model equation.

$$E(R_i) - R_f = \beta_{i,M}\,(R_M - R_f) + \beta_{i,\text{SMB}}\,\text{SMB} + \beta_{i,\text{HML}}\,\text{HML}$$

Define the Sharpe ratio and state what it measures.

$$S = \frac{E(R_p) - R_f}{\sigma_p}$$ It measures excess return per unit of total risk (standard deviation). Higher is better; it is appropriate for evaluating an investor's total portfolio.

Define the Treynor ratio.

$$T = \frac{E(R_p) - R_f}{\beta_p}$$ It measures excess return per unit of systematic risk (beta), appropriate for well-diversified portfolios where only systematic risk is relevant.

Define Jensen's alpha.

$$\alpha_p = R_p - \bigl[R_f + \beta_p\,(R_M - R_f)\bigr]$$ It is the portfolio's return in excess of that predicted by the CAPM—a measure of risk-adjusted abnormal performance (manager skill). Positive alpha indicates outperformance.

Define the Sortino ratio and how it differs from the Sharpe ratio.

$$\text{Sortino} = \frac{E(R_p) - R_T}{\sigma_D}$$ where $R_T$ is a target/minimum acceptable return and $\sigma_D$ is the downside deviation. Unlike the Sharpe ratio, it penalizes only downside (harmful) volatility rather than total volatility.

Define the information ratio.

$$IR = \frac{E(R_p) - E(R_b)}{\sigma_{(R_p - R_b)}} = \frac{\text{active return}}{\text{tracking error}}$$ It measures active return per unit of active risk (tracking error) relative to a benchmark.

What are the common characteristics of a market-risk and liquidity "blowup"?

Highly leveraged positions, concentrated or crowded trades, reliance on short-term funding, model assumptions of permanent liquidity, and a feedback loop where forced selling/margin calls depress prices further (a liquidity spiral), turning a market move into insolvency.

What lessons did the collapse of Long-Term Capital Management (LTCM, 1998) teach?

Dangers of extreme leverage, over-reliance on models calibrated to recent (calm) data, underestimation of liquidity risk and correlation breakdown in crises (flight to quality), and that diversification fails when correlations converge to 1 under stress.

Define rogue trading and name a classic example.

Rogue trading is unauthorized, often concealed, risk-taking by an employee, typically hidden through fictitious or off-book transactions and weak controls. A classic example is Nick Leeson's unauthorized derivatives trading that bankrupted Barings Bank in 1995.

What operational control failures typically enable rogue trading?

Inadequate segregation of duties (a trader controlling both front- and back-office functions), weak supervision, failure to enforce limits and reconciliations, lack of mandatory vacations, and a culture that prioritizes profits over controls.

What were the principal causes of the 2007-2009 Global Financial Crisis?

A US housing/credit bubble fueled by subprime lending, excessive leverage, securitization (MBS/CDOs) that obscured risk, flawed credit ratings, over-reliance on short-term wholesale funding, inadequate capital, and interconnected counterparties producing systemic contagion.

What role did securitization and the "originate-to-distribute" model play in the 2007-2009 crisis?

Originators (e.g., mortgage lenders) sold loans to be packaged into MBS/CDOs, weakening incentives to assess borrower quality (moral hazard). This spread credit risk opaquely across the system, and when subprime defaults rose, the value and liquidity of these securities collapsed.

Name key regulatory responses that followed the 2007-2009 crisis.

Basel III (higher and better-quality capital, leverage ratio, liquidity ratios LCR and NSFR, countercyclical buffers), the Dodd-Frank Act in the US (Volcker Rule, central clearing of OTC derivatives, stress testing/CCAR, resolution planning), and enhanced systemic-risk oversight.

What is model risk and how can it cause large losses?

Model risk is the risk of loss from using a model that is incorrect, misapplied, or fed poor inputs/assumptions. It causes losses through mispricing, flawed hedging, or understated risk measures—e.g., the JPMorgan "London Whale" (2012) VaR model errors that masked large CDS losses.

What lessons came from the JPMorgan "London Whale" loss (2012)?

Dangers of flawed/poorly controlled VaR models, weak oversight of a concentrated position, inadequate limit enforcement, and the importance of independent model validation and accurate risk reporting to senior management.

What is reporting risk, illustrated by the case studies?

Reporting risk is the risk that inaccurate, incomplete, or misleading financial/risk information leads to poor decisions or conceals losses. Examples include manipulated valuations, hidden positions, or mismarked books (e.g., Enron's off-balance-sheet vehicles) that distort the true risk picture.

Under the GARP Code of Conduct, what does the principle of professional integrity require?

Risk professionals must act with honesty, integrity, and due diligence; exercise independent and objective judgment; not knowingly misrepresent information; refrain from conduct that compromises the integrity of GARP or the profession; and comply with applicable laws and regulations.

How should conflicts of interest be handled under professional risk-management standards?

Members must make full and fair disclosure of all matters that could reasonably impair their objectivity or independence, avoid conflicts where possible, and ensure such disclosures are clear so that clients and employers can judge the potential impact.

What duties do risk professionals owe to clients, employers, and the profession?

To clients: act in their best interest with care, competence, and confidentiality. To employers: act diligently and loyally, follow lawful policies, and avoid actions that harm the employer. To the profession: uphold and promote the integrity and reputation of risk management and GARP, and not engage in conduct that reflects poorly on the field.