Financial Risk Manager (FRM) Operational, Liquidity, and Integrated Risk Management Syllabus

Operational, Liquidity, and Integrated Risk Management syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Operational, Liquidity, and Integrated Risk Management in Financial Risk Manager (FRM), not a summary of it.

1. 1

   Operational and Resilience Risk

   4 topics

   • Operational risk taxonomy and loss event types
   • Measurement approaches
     • Loss distribution approach and frequency/severity modeling
     • The Basel standardized approach for operational risk
   • Risk and control self-assessment and key risk indicators
   • Cyber risk, third-party risk, and operational resilience
2. 2

   Liquidity Risk Management

   4 topics

   • Funding versus market liquidity risk
     • Liquidity spirals and fire-sale dynamics
   • Measuring liquidity-adjusted VaR
     • Bid-ask spread and endogenous liquidity costs
   • Cash flow modeling and liquidity stress testing
   • Regulatory ratios: LCR and NSFR
3. 3

   Model Risk and Stress Testing

   4 topics

   • Sources of model risk and model validation
     • Conceptual soundness, implementation, and use testing
   • Enterprise-wide stress testing programs
   • Supervisory stress tests: CCAR and DFAST
   • Reverse stress testing and scenario design
4. 4

   Risk Capital, Performance, and Allocation

   4 topics

   • Economic capital and capital allocation
   • Risk-adjusted return on capital (RAROC)
     • Hurdle rates and adjusted RAROC
   • Risk budgeting across business lines
   • Integrating market, credit, and operational capital
5. 5

   Basel Regulation and the Regulatory Landscape

   4 topics

   • Evolution from Basel I to Basel III and the endgame
     • Capital definitions: CET1, Tier 1, and Tier 2
     • Capital conservation and countercyclical buffers
   • Leverage ratio and the output floor
   • Systemically important banks and resolution regimes
   • Dodd-Frank and post-crisis US regulatory reform

Operational, Liquidity, and Integrated Risk Management flashcards for Financial Risk Manager (FRM)

22 of 51 cards from the Operational, Liquidity, and Integrated Risk Management deck — real questions with worked answers.

1. What are the four Basel-defined causes of operational risk in its standard definition?

   Operational risk is the risk of loss resulting from inadequate or failed (1) internal processes, (2) people, and (3) systems, or from (4) external events. The definition includes legal risk but excludes strategic and reputational risk.

2. List the seven Basel operational risk loss event type categories (Level 1).

   (1) Internal fraud, (2) External fraud, (3) Employment practices and workplace safety, (4) Clients, products, and business practices, (5) Damage to physical assets, (6) Business disruption and system failures, and (7) Execution, delivery, and process management.

3. How do operational losses typically differ from market and credit losses in terms of frequency and severity distribution shape?

   Operational losses are characterized by high-frequency/low-severity events (modeled with frequency distributions like Poisson) plus low-frequency/high-severity tail events. The aggregate loss distribution is highly skewed with fat tails, so the mean is dominated by body events while capital is driven by the extreme tail.

4. In the Loss Distribution Approach (LDA), how are frequency and severity combined to obtain the aggregate loss distribution?

   Frequency (e.g., Poisson with rate $\lambda$) and severity (e.g., lognormal) distributions are convolved—typically via Monte Carlo simulation—to produce the aggregate annual loss distribution. Operational VaR is then a high-percentile (e.g., 99.9%) quantile of that aggregate distribution.

5. Under Basel III's revised Standardized Approach for operational risk, what two components determine the capital requirement?

   Capital = Business Indicator Component (BIC) $\times$ Internal Loss Multiplier (ILM). The BIC is derived from the Business Indicator (a proxy for size based on interest, services, and financial components), and the ILM scales capital by a bank's own historical loss experience relative to the BIC.

6. What is the formula for the Internal Loss Multiplier (ILM) in the Basel III Standardized Approach for operational risk?

   $$\text{ILM} = \ln\!\left(e^{1} - 1 + \left(\frac{\text{LC}}{\text{BIC}}\right)^{0.8}\right)$$ where LC is the Loss Component (15 times average annual operational losses over 10 years). When LC equals BIC, ILM equals 1.

7. What is a Risk and Control Self-Assessment (RCSA)?

   A forward-looking, bottom-up process in which business units identify and assess their inherent operational risks, evaluate the design and effectiveness of associated controls, and determine residual risk. It is qualitative/judgment-based and complements quantitative loss data.

8. Distinguish inherent risk, residual risk, and control effectiveness in an RCSA.

   Inherent risk is the exposure before any controls. Control effectiveness measures how well mitigating controls reduce that exposure. Residual risk is the remaining exposure after controls are applied: residual risk = inherent risk reduced by control effectiveness.

9. What is a Key Risk Indicator (KRI), and how does it differ from a Key Performance Indicator (KPI)?

   A KRI is a metric that provides an early-warning, forward-looking signal of changing operational risk exposure (e.g., system downtime, staff turnover, failed trades). A KPI measures performance/achievement of objectives. KRIs are leading indicators of risk; KPIs are largely backward-looking measures of outcomes.

10. Define operational resilience as used by financial regulators.

    Operational resilience is a firm's ability to prevent, adapt to, respond to, recover from, and learn from operational disruptions so that it can continue to deliver critical business services within predefined impact tolerances, even during severe-but-plausible scenarios.

11. What is an 'impact tolerance' in the context of operational resilience?

    Impact tolerance is the maximum level of disruption to an important business service that a firm can tolerate—expressed as a metric such as maximum allowable downtime, number of customers affected, or financial loss—before causing intolerable harm to consumers or market integrity.

12. Name the common categories used to classify cyber risk threats.

    Typical categories include: confidentiality breaches (data theft), integrity attacks (data tampering), and availability attacks (denial of service/ransomware). Threat sources include external attackers, insider threats, hacktivists, nation-states, and accidental/human error.

13. What is third-party (vendor) risk, and why is concentration a concern?

    Third-party risk is the risk arising from a firm's reliance on outsourced providers (e.g., cloud, data, payment processors) for failures in service, security, or compliance. Concentration is a concern because many firms depend on a few critical providers, so a single vendor failure can create systemic, correlated disruption across the industry.

14. Distinguish funding liquidity risk from market (trading/asset) liquidity risk.

    Funding liquidity risk is the risk that a firm cannot meet its cash-flow obligations (raise cash) as they come due without incurring unacceptable losses. Market liquidity risk is the risk that an asset cannot be sold quickly near its fair value because the market lacks depth/breadth (wide bid-ask spreads, price impact).

15. What are the three dimensions commonly used to characterize market liquidity?

    (1) Tightness—the bid-ask spread (cost of immediacy); (2) Depth—the volume that can be traded without moving the price; and (3) Resiliency—the speed with which prices recover after a liquidity-demanding trade. (Immediacy/time is sometimes added as a fourth.)

16. How is the exogenous-spread liquidity-adjusted VaR (LVaR) computed?

    $$\text{LVaR} = \text{VaR} + \frac{1}{2}\,P\,\text{(spread)}$$ where the liquidity cost is half the bid-ask spread applied to the position value $P$. Using the spread mean and volatility: $$\text{LC} = \frac{1}{2}P\,(\mu_{s} + z\,\sigma_{s})$$ added to the standard VaR.

17. In the Constant Spread / exogenous liquidity approach, write the liquidity cost (LC) added to VaR using the average spread.

    $$\text{LC} = \frac{1}{2} \times P \times s$$ where $P$ is the position (mid) value and $s = \frac{\text{ask} - \text{bid}}{\text{mid}}$ is the proportional bid-ask spread. The half reflects the cost of crossing from mid to one side.

18. How does the endogenous-liquidity (elasticity) approach adjust VaR, and when does it matter most?

    It accounts for the price impact of the trader's own selling—larger positions move the price adversely. The adjustment depends on the position size relative to market depth and price elasticity. It matters most for large positions in illiquid markets or during fire-sale/stressed conditions, where liquidating moves prices.

19. What is the liquidity-horizon scaling adjustment to VaR, and how is a single-day VaR scaled to an h-day liquidation horizon?

    VaR is scaled to the time needed to liquidate a position. Under the square-root-of-time rule: $$\text{VaR}_{h} = \text{VaR}_{1}\,\sqrt{h}$$ Less liquid positions require longer $h$, increasing measured risk. Basel FRTB assigns asset-class-specific liquidity horizons (10 to 120 days).

20. What is the purpose of a liquidity (cash flow) gap analysis?

    It projects contractual and behavioral cash inflows and outflows across future time buckets to identify net funding gaps (mismatches). Cumulative gaps reveal periods where outflows exceed inflows, indicating funding needs and requiring contingency funding plans.

21. What is liquidity stress testing and what types of scenarios should it cover?

    Liquidity stress testing projects a firm's liquidity position under adverse scenarios to assess survival horizon. It should cover idiosyncratic (firm-specific, e.g., rating downgrade/deposit run), market-wide (systemic), and combined scenarios, modeling deposit outflows, drawdowns on credit lines, collateral calls, and reduced asset liquidity.

22. Define the Basel III Liquidity Coverage Ratio (LCR), including its formula and minimum standard.

    $$\text{LCR} = \frac{\text{High-Quality Liquid Assets (HQLA)}}{\text{Total Net Cash Outflows over 30 days}} \geq 100\%$$ It ensures a bank holds enough unencumbered HQLA to survive a 30-day severe liquidity stress scenario.

See more Operational, Liquidity, and Integrated Risk Management flashcards →

Planning Operational, Liquidity, and Integrated Risk Management for Financial Risk Manager (FRM)

Operational, Liquidity, and Integrated Risk Management (Financial Risk Manager (FRM)) FAQ