FRM (Financial Risk Manager) Foundations of Risk Management (Part I) Syllabus

What does it mean for an institution to be "too big to fail" (TBTF)?

An institution whose failure would cause such severe systemic disruption that governments feel compelled to bail it out, creating moral hazard by encouraging excessive risk-taking.

List the four core stages of the risk management process.

1) Risk identification, 2) Risk assessment/measurement, 3) Risk monitoring (and reporting), 4) Risk mitigation/management (control).

What happens in the risk identification stage?

The firm systematically discovers and catalogues all material risks it faces — internal and external — before they can be measured or managed.

What is involved in risk assessment/measurement?

Quantifying or qualitatively evaluating identified risks by estimating their probability of occurrence and potential impact/severity (e.g., using VaR, stress tests, scenario analysis).

What is the purpose of risk monitoring?

Continuously tracking risk exposures against limits and risk appetite, watching for changes, and reporting to management so that timely corrective action can be taken.

List the four primary risk mitigation/treatment strategies.

Risk avoidance, risk retention (acceptance), risk reduction/mitigation, and risk transfer.

Define risk avoidance.

Eliminating a risk entirely by not engaging in the activity that gives rise to it (e.g., declining to enter a market or offer a product).

Define risk retention (acceptance).

Consciously keeping a risk on the firm's own books — self-insuring — typically because the cost of transfer exceeds the benefit or the risk is core to the business.

Define risk transfer and give examples.

Shifting the financial consequences of a risk to a third party. Examples: buying insurance, hedging with derivatives, securitization, and using guarantees.

Distinguish hedging from diversification as risk-reduction methods.

Hedging offsets a specific exposure by taking an opposite position (e.g., derivatives). Diversification reduces risk by spreading exposures across imperfectly correlated assets so idiosyncratic risks partially cancel out.

List the main reasons firms manage risk.

To reduce the probability/cost of financial distress and bankruptcy, lower taxes, reduce costly external financing, retain capital, stabilize earnings, protect reputation, satisfy regulators, and improve decision-making.

Why can risk management increase firm value if markets are imperfect?

By reducing the costs of financial distress, lowering expected taxes (with convex tax schedules), avoiding underinvestment, and reducing reliance on costly external capital — frictions that the Modigliani-Miller world ignores.

According to Modigliani-Miller, why is hedging irrelevant in perfect markets?

In frictionless markets, shareholders can diversify and hedge on their own at the same cost, so corporate risk management adds no value; it only creates value through real-world frictions like taxes, distress costs, and agency problems.

List key limitations and causes of failure in risk management.

Reliance on flawed/historical models and assumptions, ignored tail/black-swan events, poor data, correlation breakdowns in crises, over-reliance on quantitative measures, weak governance, poor risk culture, and behavioral biases.

What is "model risk"?

The risk of loss resulting from using inaccurate, misspecified, or wrongly applied models — including incorrect assumptions, bad inputs, or implementation errors — leading to mismeasurement of risk or value.

Why can correlations during a crisis undermine risk models?

Asset correlations tend to rise toward 1 in market stress, so diversification benefits assumed in normal times disappear, and losses materialize simultaneously — exceeding model-predicted risk.

What is corporate governance in the context of risk management?

The system of structures, rules, and processes by which a firm is directed and controlled, defining the distribution of rights and responsibilities among the board, management, and stakeholders to ensure accountable oversight of risk.

What is the board of directors' primary risk-management responsibility?

The board has ultimate responsibility for setting the firm's risk appetite and tolerance, overseeing the risk management framework, and ensuring management implements effective controls — providing independent oversight.

What is the role of the board risk committee?

A board-level committee that oversees the firm's risk management framework, reviews and recommends the risk appetite, monitors major risk exposures, and ensures the risk function is adequately resourced and independent.

What is the role of the Chief Risk Officer (CRO)?

A senior executive responsible for the firm's enterprise-wide risk management function — developing risk policy, measuring and monitoring risks, ensuring independence of risk oversight, and reporting risk to the board/committee.

Name the three lines of defence in the three lines of defence model.

First line: business units/operational management that own and manage risk. Second line: risk management and compliance functions that oversee and challenge. Third line: internal audit providing independent assurance.

What is the first line of defence responsible for?

Operational management and business units that own risks and are responsible for identifying, assessing, and controlling risks in their day-to-day activities (the risk takers).

What is the second line of defence responsible for?

The risk management and compliance functions that set policy, provide oversight, monitor, and challenge the first line — ensuring risks are managed within appetite (but they do not own the risk).

What is the third line of defence responsible for?

Internal audit, which provides independent and objective assurance to the board and senior management on the effectiveness of governance, risk management, and the first two lines of defence.

Why must internal audit (third line) remain independent?

To provide objective, unbiased assurance, internal audit must be independent of the business units and the risk/compliance functions it evaluates, reporting directly to the board/audit committee.

Define risk appetite.

The aggregate level and types of risk a firm is willing to accept, in pursuit of its strategic objectives and business plan, before action is needed to reduce it.

Distinguish risk appetite from risk capacity and risk tolerance.

Risk capacity is the maximum risk a firm can absorb given its capital/resources. Risk appetite is the amount it chooses to take within that capacity. Risk tolerance is the acceptable variation/limits around specific objectives or risk types.

What is a risk appetite statement?

A formal board-approved document expressing, qualitatively and quantitatively, the types and amount of risk the firm is willing to take, used to set limits and guide decision-making across the organization.

Define risk culture.

The shared norms, attitudes, values, and behaviors within a firm that shape how risk is perceived, discussed, and managed day-to-day — determining whether risk awareness is embedded in everyone's actions.

What are the hallmarks of a strong risk culture?

Tone from the top, clear accountability, open communication and willingness to challenge, appropriate incentives aligned with prudent risk-taking, and risk awareness embedded throughout all levels of the organization.

How can poor incentives and compensation structures contribute to risk management failures?

Compensation that rewards short-term profits without accounting for risk encourages excessive risk-taking and concealment of losses, misaligning employee behavior with the firm's long-term risk appetite (a key cause of the 2007-09 crisis).