CAIIB Paper 2 Module B Quiz 1

Risk is the possibility that actual financial or operational outcomes differ from expectations. It may arise from borrowers, markets, processes, systems, liquidity, legal obligations or external events; it is not limited to fraud or credit losses.

A framework establishes governance, policies, responsibilities, measurement methods, limits, reporting and controls so risks remain consistent with the bank’s strategy and risk appetite. Risk cannot usually be eliminated completely.

The board has ultimate responsibility for risk governance, including approving risk appetite and ensuring effective systems. Board committees and senior management support oversight, while business units manage risks within delegated limits.

Business and operational management form the first line and own the risks created by their activities. Risk/compliance functions provide oversight as the second line, while internal audit independently assesses the framework as the third line.

An independent risk function develops or oversees risk methodologies, monitors exposures and limits, challenges business decisions, and escalates breaches. It should not replace business owners’ responsibility for managing risk.

Risk appetite articulates the level and types of risk a bank is prepared to accept while pursuing its strategy. It should be translated into measurable limits, indicators and escalation triggers.

A risk register documents material risks, likelihood/impact, existing controls, responsible owners, mitigation plans and status. It supports prioritisation and monitoring but cannot guarantee that losses will not occur.

A quantitative exposure cap is a measurable limit. Limits make risk appetite operational and allow monitoring, breach escalation and corrective action.

Useful reports are timely, accurate, sufficiently granular and forward-looking. They compare actual exposures with appetite and limits, highlight concentrations and emerging risks, and identify required actions.

A sound risk culture supports ethical conduct, accountability, challenge and prompt reporting of errors or near misses. Incentives should not encourage excessive risk-taking or suppress bad news.

Inherent risk is the exposure that exists before considering controls or mitigation. Residual risk is what remains after controls are considered.

Residual risk is the level of exposure left after the design and operation of controls are taken into account. It must be assessed against risk appetite to determine whether further action is needed.

A typical cycle identifies risks, analyses likelihood and impact, selects treatment, implements controls, and continuously monitors and reports changes. Feedback can lead to reassessment.

Avoidance means not undertaking or discontinuing the activity that creates the exposure. Mitigation reduces risk, transfer shares or shifts some financial consequences, and acceptance retains the risk knowingly.

Mitigation uses controls, diversification, collateral, process changes, limits or other measures to reduce the probability or severity of loss. Remaining residual risk still requires monitoring.

Insurance can transfer some financial consequences of defined events to an insurer, subject to exclusions and limits. It does not eliminate the underlying operational exposure or all reputational consequences.

Acceptance is a deliberate decision to retain a risk after assessing it, normally within delegated authority and appetite. It should be documented where material and monitored over time.

Products, markets, growth targets and funding choices change exposures and capital needs. Integrating risk into planning helps the bank evaluate risk-adjusted returns and sustainability.

An escalation process should define trigger thresholds, who must be informed, timeframes, decision rights and documentation. Prompt escalation prevents small issues from becoming material losses.

Validation challenges model design, assumptions, data quality, implementation and performance. Models are estimates with limitations, so outcomes should be supplemented by judgement and monitoring.