FRM (Financial Risk Manager) Operational Risk, Liquidity and Investment Risk (Part II) Syllabus

What is an 'impact tolerance' in an operational resilience framework?

The maximum tolerable level of disruption to an important business service, expressed in terms such as maximum acceptable downtime, number of customers affected, or financial loss—setting the threshold beyond which harm becomes unacceptable.

What is concentration (or 'fourth-party') risk in third-party/outsourcing risk management?

The risk that many firms depend on the same critical service provider (e.g., a single cloud provider), so that the provider's failure causes systemic, correlated disruption; fourth-party risk extends this to the subcontractors of a firm's own vendors.

Name the typical lifecycle stages of third-party/vendor risk management.

(1) Planning/risk assessment, (2) Due diligence and vendor selection, (3) Contract negotiation, (4) Ongoing monitoring, and (5) Termination/exit (including exit-strategy and contingency planning).

How does the Federal Reserve's SR 11-7 define a 'model'?

A model is a quantitative method, system, or approach that applies statistical, economic, financial, or mathematical theories, techniques, and assumptions to process input data into quantitative estimates. It has three components: an information input, a processing component, and a reporting/output component.

According to SR 11-7, what are the two key reasons model risk arises?

(1) A model may have fundamental errors and produce inaccurate outputs relative to its design objective; and (2) a model may be used incorrectly or inappropriately (implementation/misuse risk), even if fundamentally sound.

What three core elements make up an effective model risk management framework under SR 11-7?

(1) Robust model development, implementation, and use; (2) sound model validation; and (3) governance, policies, and controls (including roles, model inventory, and documentation).

What are the three components of effective model validation under SR 11-7?

(1) Evaluation of conceptual soundness (including developmental evidence), (2) ongoing monitoring (including process verification and benchmarking), and (3) outcomes analysis (including back-testing).

What does the principle of 'effective challenge' mean in model validation?

Critical analysis of a model by objective, competent, and influential parties who are independent of model development, with the standing and incentive to identify limitations and assumptions and compel appropriate changes.

What is benchmarking in the context of model validation?

Comparing a model's inputs and outputs to those of alternative models, methods, or industry standards to assess reasonableness; significant unexplained differences should trigger investigation into whether the model or the benchmark is at fault.

Identify the main sources of model error in model risk.

(1) Incorrect or oversimplified assumptions/theory, (2) errors in the underlying mathematics or its discrete approximation, (3) inappropriate or insufficient/poor-quality data and calibration, (4) programming/implementation bugs, and (5) using a model outside its intended scope or in changed market conditions.

What is the distinction between model error and model misuse?

Model error is a flaw in the model itself (wrong assumptions, math, or code) producing inaccurate output; model misuse is applying a fundamentally sound model to inappropriate inputs, products, or conditions for which it was not designed.

Why are even validated models still subject to model risk according to SR 11-7?

Models are simplifications of reality based on assumptions that may not hold, especially under stressed or novel conditions; validation reduces but cannot eliminate the risk that a model fails when its assumptions break down. Conservatism and ongoing monitoring are needed as compensating controls.

What is enterprise-wide stress testing and how does it differ from sensitivity analysis?

Enterprise stress testing assesses the impact of a coherent, severe-but-plausible macroeconomic/financial scenario on a firm's whole balance sheet, earnings, and capital simultaneously. Sensitivity analysis shifts one risk factor at a time, whereas stress testing applies a full multi-factor scenario.

What does CCAR stand for and what is its primary purpose?

Comprehensive Capital Analysis and Review—the U.S. Federal Reserve's annual supervisory stress test assessing whether large bank holding companies have adequate capital to continue operations through stress and whether their capital planning processes are sound.

What capital adequacy metric is the binding constraint focus of the Fed's stress tests (DFAST/CCAR)?

The post-stress Common Equity Tier 1 (CET1) capital ratio must remain above the regulatory minimum throughout the projection horizon; the projected minimum CET1 ratio drives the Stress Capital Buffer (SCB).

What scenarios does the Federal Reserve provide for its supervisory stress tests?

Three: Baseline, Adverse, and Severely Adverse. The severely adverse scenario is the binding one and features a sharp recession (rising unemployment, falling GDP, declining asset prices).

What is the difference between supervisory stress tests and company-run (internal) stress tests?

Supervisory stress tests use scenarios and (often) models prescribed by the regulator applied uniformly across banks; company-run tests use a bank's own models and may add idiosyncratic scenarios tailored to its specific risk profile. CCAR/DFAST require both.

Who administers the EU-wide banking stress test and what is its main difference in approach from the Fed's CCAR?

The European Banking Authority (EBA), in cooperation with the ECB/SSM and national authorities. The EBA test is primarily a 'constrained bottom-up' exercise using banks' own models under a static balance-sheet assumption, whereas the Fed (CCAR) relies heavily on its own supervisory models and a dynamic/standardized approach.

What balance-sheet assumption does the EBA stress test traditionally use, and what does it mean?

A static (constant) balance-sheet assumption: assets and liabilities that mature are replaced with similar instruments, so the balance sheet composition is held constant over the horizon. This isolates the scenario's impact from management actions/growth.

What is reverse stress testing and how does it differ from traditional stress testing?

Reverse stress testing starts from a defined adverse outcome—typically the point of business failure or non-viability—and works backwards to identify the scenarios and risk-factor combinations that could cause it. Traditional stress testing starts with a scenario and computes the impact; reverse stress testing starts with the impact and finds the scenarios.

Why is reverse stress testing valuable despite its difficulty?

It overcomes 'disaster myopia' and the tendency to test only familiar scenarios by forcing identification of vulnerabilities and breaking points (including correlated and feedback effects) that conventional, severity-bounded scenarios may miss—revealing hidden concentrations and tail dependencies.

In severity modeling, what is the role of a threshold $u$ when applying the Generalized Pareto Distribution (GPD)?

In the Peaks-Over-Threshold (POT) / Extreme Value Theory approach, exceedances over a high threshold $u$ (i.e., $X - u \mid X > u$) converge to a GPD. The body of the severity distribution is modeled separately (e.g., lognormal) and the GPD models only the tail above $u$, improving extreme-loss estimation.

What is the CDF of the Generalized Pareto Distribution used in operational risk tail modeling?

For shape $\xi \neq 0$ and scale $\beta>0$: $$G_{\xi,\beta}(x) = 1 - \left(1 + \frac{\xi x}{\beta}\right)^{-1/\xi}.$$ When $\xi=0$ it reduces to the exponential $1-e^{-x/\beta}$. The shape $\xi$ controls tail heaviness ($\xi>0$ gives a heavy, fat tail).

What is the key challenge in using external loss data for operational risk modeling, and one technique to address it?

Reporting/scaling bias: external databases (e.g., consortium or public) only capture losses above a reporting threshold and from differently sized firms, biasing frequency and severity upward. It is addressed by scaling losses to the firm's size (e.g., by revenue/assets) and correcting for truncation/data-capture bias.

Distinguish between 'top-down' and 'bottom-up' approaches to operational risk capital modeling.

Top-down approaches allocate capital based on aggregate firm-level metrics (e.g., income/expense-based, like the SMA) without modeling individual risks. Bottom-up approaches build capital from granular, unit/event-level loss data and processes (e.g., LDA), giving more risk sensitivity but requiring richer data.

In the LDA, what assumption is usually made about the dependence between frequency and severity, and why does it matter?

Frequency and severity are typically assumed independent, which simplifies the convolution to a standard compound distribution. It matters because if they were dependent (e.g., severity rising with the number of events), the aggregate tail and capital estimate would change materially.

How does Basel treat the issue of correlation/diversification when aggregating operational risk capital across business lines and event types?

Capital for individual units can be summed (assuming perfect positive correlation, the conservative default) or aggregated with a correlation/copula structure to recognize diversification. Basel allows recognition of diversification benefits only if the bank can robustly justify its correlation assumptions; otherwise full additivity is assumed.

What is 'process verification' as a component of ongoing model monitoring?

Confirming that all model components are functioning as intended in production—checking that inputs are accurate and complete, code is correctly implemented, the model is used within scope, and outputs flow correctly to downstream systems.

What governance feature does SR 11-7 require regarding a firm's collection of models?

A comprehensive model inventory: a firm must maintain a complete record of all models in use, recently retired, or in development, including each model's purpose, owner, validation status, and limitations—so model risk can be managed at the aggregate (enterprise) level.

What is a back-test exception, and how is it used in outcomes analysis for model validation?

A back-test exception occurs when the realized outcome falls outside the model's predicted range (e.g., an actual loss exceeds the VaR estimate). The frequency and clustering of exceptions are compared against statistical expectations (e.g., Kupiec test) to judge whether the model is mis-calibrated and needs recalibration or rejection.