Terms Flashcards

Question

What is risk transfer?

Answer 1

Risk transfer is a risk management and control strategy that involves the contractual shifting of a risk from one party to another

Answer 2

Policies and procedures that have been established and implemented

Answer 3

Bottom up risk assessment is a means of identifying operational risks from the bottom and working up Goes down from Business Unit, Business Line to Portfolio. Business units are individually analysed for their risks and this is aggregated upwards to build a risk profile

Answer 4

Risk architecture is a set of defined roles, responsibilities, communication and structure for risk management

Answer 5

1. IRM : The amount of risk that an organisation is willing to seek or accept in the pursuit of long term objectives 2. ISO Guide 73: the amount and type of risk that an organisation is willing to pursue or retain 3. Orange Book: the amount of risk that an organisation is prepared to accept tolerate or be exposed to at any point in time 4. CIIA: the level of risk that is acceptable to the board or management

Answer 6

Cyber risk is an operational risk Cyber risks include: 1. Hacking 2. DDOS 3. Viruses 4. Information theft 5. Identity theft 6. Industrial espionage 7. Email fraud 8. ATM fraud 9. Cyber money laundering 10. Theft

Answer 7

Conduct risk is the risk that through our behaviours, strategies, decisions and actions the business, or individuals within the business, do not do the right thing and/or do not behave in a manner which: * pays due regard to treating our customers and clients fairly * is consistent with our disclosures and setting of customer and client expectations * supports the integrity of financial markets

Answer 8

1. The organisation itself, the activities it undertakes, the range of skills and capabilities that exist internally, and how it is structured. 2. Internal stakeholders and their expectations are included 3. Includes the strengths and weaknesses of the organisation

Answer 9

A structure for the identification and classification of risks

Answer 10

Pillar 3 of Solvency II also sets out the reporting and disclosure requirements, including the reporting to the regulator through the Solvency and Financial Condition Report (SFCR) and the Report to Supervisors (RTS).

Answer 11

Expected shortfall is the average loss that could occur in excess of the loss calculated by VaR over the same time period and using the same confidence level. Also known as Conditional VAR (CVAR)

Answer 12

Target risk is the level of risk an organisation seeks to achieve, once controls are in place

Answer 13

The likelihood that an insured event will occur, requiring the insurer to pay a claim

Answer 14

The Solvency Capital Requirement Solvency II states that the Solvency Capital Requirement (SCR) must be equivalent to the Value at Risk of basic own funds of an insurance or reinsurance firm subject to a confidence level of 99.5% over a one-year period.

Answer 15

Key Control Indicators, also referred to as Control Effectiveness Indicators, are metrics that provide information on the extent to which a given control is meeting its intended objectives in terms of loss prevention, reduction

Answer 16

A measure of the potential loss in a portfolio over a given time horizon within a given confidence interval, assuming normal markets and no trading 1. Provides a qualified answer to the question: “how much could we lose in the next day” 2. VAR is not a worse case view, but is a view of confidence 3. Involves calculating the current position as well as possible return values, over a given period 4. VaR can be calculated using the historical method, the variance-covariance method and the Monte Carlo simulation.

Answer 17

The Riskiness index is a semi-quantatative approach that presents a snapshot of overall level of risk in the organisation, including strategy, projects and operations. Riskiness indexes can be used instead of a risk register (that is likely to be qualitative).

Answer 18

Top down risk assessment is a means of identifying operational risks down from the top. Goes down from Portfolio, Business Line to Business Unit It establishes a general assessment of risk and then refines down risks into individual components.

Answer 19

Short-term goals whose achievement brings an organization closer to its long-term goals

Answer 20

Control Environment is the set of standards, processes, and structures that provide the basis for carrying out internal control across the organisation. The board of directors and senior management establish the tone at the top regarding the importance of internal control including expected standards of conduct.

Answer 21

Core processes are fundamental to organisational success because they are the means of delivering products to customers and ensuring continuity of operations. A core process can be defined as ‘the collection of activities that deliver a specific stakeholder expectation’. In the FS context this might include underwriting an insurance policy or approving a loan.

Answer 22

Risk probability can be expressed as a value between 0 and 1 (or 0 and 100)

Answer 23

Insurtech refers to the use of technology innovations designed to squeeze out savings and efficiency from the current insurance industry model.

Answer 24

Risk context is what drives the risk business, including: * The internal environment * The external environment * The risk management context

Answer 25

Basel III is a global, voluntary regulatory framework on bank capital adequacy, stress testing, and market liquidity risk. It has 3 pillars: * Quantatative requirements * Qualitative requirements and supervision * Disclosure requirements

Answer 26

Risk criteria are terms of reference and are used to evaluate the significance or importance of the organisation’s risks. They are used to determine whether a specified level of risk is acceptable or tolerable. Risk criteria should reflect the organisation’s values, policies, and objectives, should be based on its external and internal context, should consider the views of stakeholders, and should be derived from standards, laws, policies, and other requirements.

Answer 27

Third-party insurance typically covers damage to another person's property

Answer 28

Current risks are risks that are being controlled

Answer 29

Compliance risk is an organisation's potential exposure to legal penalties, financial forfeiture and material loss, resulting from its failure to act in accordance with industry laws and regulations, internal policies or prescribed best practices. Compliance risk is also known as integrity risk.

Answer 30

An internal model is used to calculate the capital requirement for banks and insurance companies. An organisation can use its own Internal Model to calculate its regulatory capital requirement if it gets agreement from the regulator

Answer 31

Pillar 3 of Solvency II also sets out the reporting and disclosure requirements, including the reporting to the regulator through the Solvency and Financial Condition Report (SFCR) and the Report to Supervisors (RTS). Many of the disclosures deal with the risk management practices within an organisation and are substantial and comprehensive. The SFCR is publicly available and must provide profit and loss and balance sheet detail in the prescribed Solvency II format, for example in terms of the lines of business written and the valuation of liabilities. It must also make significant disclosure about business and performance, risk appetite, risk policy and process, governance arrangements, remuneration policies, capital required, the basis of capital calculation (e.g. Internal Model or Standard Formula) and any regulatory loadings given.

Answer 32

Risk policy is the set of policies that the business uses to demonstrate the approach and procedures in place for the management of risk. Lower level policies must be aligned to the high level statement of the organisation's philosophy on risk, risk appetite and its risk strategy.

Answer 33

Liquidity risk is the risk that a bank may not be able to meet it’s own obligations to repay deposits or other funding, or to continue financing it’s assets

Answer 34

Key dependencies are the key things that the organisation needs to be successful; they might be internal or external things but in short, they are what the business depends upon for its future success. For a financial services company a dependency is retaining a licence to operate in a particular territory or maintaining a credit rating.

Answer 35

1. **A&D:** The likelihood an undesirable event may occur. The magnitude of loss from an unexpected event. The probability that ‘things won’t go well’ The effects of an adverse outcome 2. ISO: The effect of uncertainty on objectives 3. IRM: The combination of a probability of an undesirable event and it’s consequences (either positive or negative)

Answer 36

The Monte Carlo simulation is a method for calculating VAR and randomly generates trials based on a selected probability distribution, and acts as a black box generator

Answer 37

A risk matrix plots likelihood vs. impact It is used during risk assessment to define the level of risk by considering the category of probability or likelihood against the category of consequence severity. This is a simple mechanism to increase visibility of risks and assist management decision making

Answer 38

Risk evaluation is the decision whether to respond, not to respond to, or accept the risk.

Answer 39

* IRM Model * COSO ERM Cube * ISO 31000 Model

Answer 40

Risk perception is the subjective judgement that people make about the characteristics and severity of a risk

Answer 41

Risk control processes are a range of controls for the major risks faced by the business

Answer 42

Risk analysis is a process that is used to understand the nature, sources,and causes of the risks that you have identified and to estimate the level of risk. It is also used to study impacts and consequences and to examine the controls that currently exist.

Answer 43

1. RIMS: a strategic business discipline that supports the achievement of an organisation’s objectives by addressing the full spectrum of it’s risks and managing the combined impact of those risks as an interrelated risk portfolio 2. COSO: a process, effected by a board, management and other personnel, applied in a strategy setting and across the enterprise, designed to identify potential risks that may effect the entity, manage risks to be within it’s risk appetite, and to provide reasonable assurance regarding the achievement of entity objectives 3. IIA: A rigorous and coordinated approach to assessing and responding to all risks that affect the achievement of an organisation’s strategic and financial objectives 4. HMT: all the processes involved in identifying, assessing and judging risks, assigning ownership, taking actions to mitigate, or anticipate, and monitoring and reviewing progress

Answer 44

A RMIS is a formal, structured IT system that stores, analyses and reports risk information to senior managers.

Answer 45

The FIRM scorecard is a risk classification system, incl. * Financial * Infrastructure * Reputational * Markeplace

Answer 46

Business continuity planning (BCP) is the process involved in creating a system of prevention and recovery from potential threats to a company

Answer 47

Senior managers must ‘set the tone from the top’ and not operate on ‘do as I say rather than do as I do’ basis

Answer 48

Business impact analysis (BIA) is an analysis stage in the BCP cycle that analyses the effect of an interruption on our key dependencies and core processes

Answer 49

Risk significance is the process of deciding the severity and significance of risks

Answer 50

Stakeholders are the parties who have an interest in a business, or are affected by what it does – such as investors, suppliers, customers, the wider society and government. FS stakeholders also include regulators and rating agencies.

Answer 51

Strategic objectives describe what the company will do to try to fulfill its mission.

Answer 52

Risk protocols are rules, procedures, standards, methodologies, tools and techniques for risk management Defined in the risk guidelines and describes the range of activities undertaken in the name of risk management

Answer 53

Regulatory capital is the minimum capital that regulators require a bank to hold against the risks it is running

Answer 54

A type of bank regulatory capital under Basel II * Can include subordinated term debt and reserves (eg debt issued by the bank that ranks lower on the repayment scale than depositor's in the event of a bank default) * reserves may include revaluation reserves (e.g. potential profit from revaluation)

Answer 55

Reverse stress testing is a stress test where firms start from the point at which the business plan becomes unviable. The process is intended to drive an understanding of what might bring a business down.

Answer 56

The IRM Risk Culture Report (IRM, 2012: 7) defines risk culture as ‘Risk culture is a term describing the values, beliefs, knowledge and understanding about risk shared by a group of people with a common purpose, in particular the employees of an organisation or of teams or groups within an organisation.’

Answer 57

An approach for the enforcement of corporate governance standards Comply or explain involves organisations complying with the requirements or explaining why it was not appropriate, necessary or feasible to comply

Answer 58

According to ISO 31000, a risk management framework is a set of components that support and sustain risk management throughout an organization. There are two types of components: foundations and arrangements. * Foundations include your risk management policy, objectives, mandate, and commitment. * And arrangements include the plans, relationships, accountabilities, resources, processes, and activities you use to manage your organization’s risk.

Answer 59

Risk assessment is the process of analysing risks for likelihood and impact, and using as a basis for determining how they should be managed

Answer 60

Upside risk is opportunities that can be seized with a desirable outcome. In FS organisations risk management is all about managing upside risk as the business model of banks and insurance companies is based on accepting and managing risk to generate revenue but in a controlled manner.

Answer 61

A black swan is an unpredictable event that is beyond what is normally expected of a situation and has potentially severe consequences. Black swan events are characterized by their extreme rarity, severe impact, and the widespread insistence they were obvious in hindsight.

Answer 62

The Minimum Capital Requirement Absolute minimum capital level before regulatory intervention (minimum capital requirement; MCR)

Answer 63

Risk Treatment is the process of selecting and implementing of measures to modify risk. Risk treatment measures can include avoiding, optimising, transferring or retaining risk.

Answer 64

The bow-tie method is a risk evaluation method that can be used to analyse and demonstrate causal relationships in high risk scenarios. The bow tie tools enables a firm to: * Take risk causes and consequences not just to one level but to two levels. * Plot several contributory causes for one risk and show one risk as having several consequences

Answer 65

Scenario analysis provides a forward looking view of operational risk that complements historical internal and external data. Such exercises allow better preparation to identify and manage the risk exposures through business decisions, risk mitigation efforts, and capital planning.

Answer 66

Control risks are unknown or unexpected events, difficult to quantify, approach is based on managing uncertainty of events. Cause doubt about the ability to achieve the organisation’s mission. Most difficult to describe. Usually dependant on the successful management of people and thee effective implementation of processes, to be managed

Answer 67

Hazard risks only have negative outcomes, linked to insurance, can only inhibit the mission, can be mitigated

Answer 68

Opportunity risks; relate to risk vs. return, approach based on investment. Usually deliberately sourced or embraced. Most important risk for future success.

Answer 69

A key risk indicator is a measure used in management to indicate how risky an activity is. Key risk indicators are metrics used by organisations to provide an early signal of increasing risk exposures in various areas of the enterprise

Answer 70

Risk frequency is expressed as a frequency measurement

Answer 71

The Standardised Approach (banks) or Standard Formula (insurance) prescribes a set of stress tests and calculations

Answer 72

Operational risk is the risk of loss resulting from inadequate or failed internal controls, people, processes, systems, or legal risk It is the least understood risk and the most challenging to measure, monitor and manage

Answer 73

A type of bank regulatory capital under Basel II * Considered a core measure of a banks financial strength * The primary element of tier one capital is shareholders equity (eg the amount of capital left over after subtracting the banks liabilities from its assets) * Can also include innovative capital such as complex financial instruments that have both equity and debt features – subject to strict rules by supervisors

Answer 74

1. The environment within which the organisation exists 2. Includes the business sector and external stakeholders (incl. customers) 3. The external financial environment 4. Opportunities and threats facing the organisation 5. Plus: * Public perception * CSR * Governance standards, and level of regulation * Quality of products or services * The marketplace

Answer 75

Banks or insurers use a variety of tools and techniques to quantify risks both at local and group-wide levels. In many cases models, such as those that generate credit grades, application scores or Value at Risk numbers are used but care is needed with such outputs due as they are vulnerable to model risk.

Answer 76

An ORSA is an internal process undertaken by an insurer or insurance group to assess the adequacy of its risk management and current and prospective solvency positions under normal and severe stress scenarios. An ORSA will require insurers to analyse all reasonably foreseeable and relevant material risks (i.e., underwriting, credit, market, operational, liquidity risks, etc.) that could have an impact on an insurer's ability to meet its policyholder obligations.

Answer 77

Emerging risks’ is the term given to new threats or opportunities for an organisation, which are either currently unknown or are known but unquantifiable or not regarded as currently relevant. They include: * Security risks such as recent hacking attacks against financial services firms. * Health risks such as the Ebola outbreak * Weather and climate risks such as tidal floods * Natural catastrophes such as earthquakes * Political instability – for instance the Middle East * Risks of terrorism

Answer 78

A business articulates how much risk it is willing to accept . For organisations that are groups, there may be a group statement and divisional statements. May be part of the risk management strategy

Answer 79

External stakeholders include: * Customers (actual and potential) * Suppliers * Governments * Regulators * Analysts * Credit Rating Agencies * NGOs * The Press / Social Media * Clearing Houses / Exchanges

Answer 80

Whereas regulatory capital is the capital a bank or insurer needs to meet the minimum requirements of its risk-based operations, economic capital is the capital a bank or insurer needs to run its business safely on a day-to-day basis Economic capital calculations take greater account of the extreme losses that a bank or insurer might face but can result in a value which is higher or lower than regulatory capital. Boards tend to hold capital levels which comfortably exceed the higher of economic and regulatory capital where possible

Answer 81

Risk tolerance is what you can allow the organisation to deal with

Answer 82

The variance-covariance method is a method of calculating VAR. It uses a simple bell curve to distribute historical results.

Answer 83

Outsourcing is the business practice of hiring a party outside a company to perform services and create goods that traditionally were performed in-house by the company Outsourcing is a form of risk transfer

Answer 84

Internal stakeholders include: * Shareholders * Directors * Owners * Employees * Parent or Group companies

Terms Flashcards

(108 cards)