Bionic Turtle FRM Practice Questions

P2.T7. Operational & Integrated Risk Management

“Implementing Robust Risk Appetite Frameworks to

Strengthen Financial Institutions”
By David Harper, CFA FRM CIPM
www.bionicturtle.com
RISK APPETITE: EXECUTIVE SUMMARY – SECTION 4, PP. 10 – 40.................................... 3
P1.T1.507. RISK APPETITE FRAMEWORK (RAF)......................................................................... 3
P1.T1.508. IMPLEMENTATION OF A RISK APPETITE FRAMEWORK (RAF) ....................................... 5

2
Risk Appetite: Executive Summary – Section 4, pp. 10 – 40
P1.T1.507. Risk appetite framework (RAF)
P1.T1.508. Implementation of a risk appetite framework (RAF)

P1.T1.507. Risk appetite framework (RAF)

Learning Objectives: Relate the use of risk appetite frameworks (RAF) to the
management of risk in a firm. Define risk culture and assess the relationship between a
firm’s risk appetite and its risk culture. Describe and evaluate key challenges to the
implementation of RAFs.

507.1. Which is the best definition of a firm's risk appetite?

a) The existing levels of risk being run by a firm
b) The maximum amount of risk a firm is technically able to assume given its capital base
c) The amount and type of risk that a company is able and willing to accept in pursuit of its
business objectives
d) The norms and traditions of behavior of individuals and of groups within an organization
that determine the way in which they identify, understand, discuss, and act on the risks
the organization confronts and the risks it takes

507.2. Which of the following is true about the firm's risk appetite framework (RAF)?

a) A risk appetite framework (RAF), if supported by a strong risk culture, should be able to
substitute for systems, controls and limits
b) The risk appetite framework should be developed in a top-down style, at the board, and
should produce a discrete set of mechanisms
c) Aspirational statements relating to “zero tolerance” of certain types of risk are essential
as most risks can be completely avoided
d) The risk appetite framework is an iterative learn-by-doing process which requires
significant time and resources and yields a diversity of of approaches among firms

507.3. If we want to evaluate a firm in order to determine whether they have a robust risk
appetite framework (RAF) and whether the firm has a strong risk culture, according to the
Institute of International Finance, which of the following is LEAST indicative or LEAST relevant
to the evaluation?

a) Simple and uniform set of indicators which can be monitored on a single screen
(dashboard view)
b) Inextricable link to strategy development and business plans
c) Clarity of ownership and responsibility of risk
d) Regular dialog (communication) about risk appetite and evolving risk profiles

3
Answers:

507.1. C. True: Risk appetite is the amount and type of risk that a company is able and
willing to accept in pursuit of its business objectives.

 In regard to incorrect (A) and (B), "Risk appetite in this sense is linked to but
conceptually separate from 'risk capacity,' which is the maximum amount of risk a firm is
technically able to assume given its capital base, liquidity, borrowing capacity, and
regulatory constraints. It is also distinct from but related to the existing levels of risk
being run by a firm. It is obviously essential to ensure that a firm's risk appetite is defied
in such a way as to ensure that it does not exceed the firm's risk capacity."
 In regard to incorrect (D), "Risk culture can be defined as the norms and traditions of
behavior of individuals and of groups within an organization that determine the way in
which they identify, understand, discuss, and act on the risks the organization confronts
and the risks it takes.”

507.2. D. True: The risk appetite framework is an iterative learn-by-doing process which
requires significant time and resources and yields a diversity of approaches among firms

Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions, Institute of

international Finance: "Developing a risk appetite framework requires significant time and
intellectual resources. The firms that have made the most progress report a substantial element
of ‘learning by doing’ in an iterative manner over time, and that ongoing dialogue and
communication at all levels of the firm have been crucial in this process. Risk appetite cannot be
implemented through top-down decrees, but instead needs to be embraced and understood
throughout a firm. Business leaders need to be given time to define and embed the concepts of
risk appetite into their decision-making processes, and this engagement takes time to evolve
and mature. For this reason, the creation and evolution of a strong risk appetite framework is a
multiyear journey—results do not appear instantly."

 In regard to (A), (B) and (C), these are each false.

507.3. A. False: It is not possible to look at a simple and uniform set of indicators.
IIF: "Supervisors are encouraged to take a broad perspective when forming views regarding
firms’ commitment to, and progress in, the implementation of RAFs. The process is complex
and time consuming, and it touches fundamentally on culture and behaviors in organizations.
Assessments of commitment and success need to reflect this complexity. Successful outcomes
are not reflected in the creation of ever more granular limit structures, and no single set of
indicators or checklists can capture individual firm's progress in this area."

 In regard to (B), (C) and (D), each is true and highly relevant to an evaluation.

Discuss here in forum: https://www.bionicturtle.com/forum/threads/p1-t1-507-risk-appetite-

framework-raf.8243/

4
P1.T1.508. Implementation of a risk appetite framework (RAF)
Learning Objectives: Describe current best practices for the implementation and
communication of RAFs. Explain the relationship between the RAF and the strategic and
capital planning processes. Assess the role of stress testing within an RAF as well as
challenges in firm-wide risk aggregation.

508.1. What is a risk posture?

a) A set of measurable indicators of compliance with risk management norms that can form
a robust basis for promotion and remuneration
b) An public statement for external stakeholders (e.g., shareholders) that translates the risk
appetite framework into non-technical language
c) A qualitative expression of whether the business unit intends to take more, less, or
approximately the same amount of risk over the next planning period
d) The consensus orientation the firm takes with respect to its regulatory supervisor; for
example, will the firm be highly cooperative or will it only meet legal requirements

508.2. The Institute of International Finance says about firm-wide risk aggregation, "One of the
significant challenges that firms will eventually face as they proceed along the risk appetite
journey is the issue of risk appetite aggregation—that being, once individual businesses have
set their own risk appetite boundaries, how does an organization decide whether, in aggregate,
these boundaries fit within the firm’s overall risk appetite? or, conversely, if key quantitative
aspects of the group’s overall risk appetite have been determined, how can the risk appetite of
individual businesses be set in such a way as to ensure alignment with the overall risk appetite
in aggregate?" Which of the following statements is true about firm-wide risk aggregation?

a) Aggregation is a mature art and science with converging practices and relatively uniform
regulatory role models
b) Aggregation of risk appetite should be done on both a “normal course” and stressed
basis
c) Only quantifiable risks should be included in the aggregation process in order to ensure
an objective outcome
d) The advantages of economic capital measures for aggregation include: easily linked to
specific macroeconomic scenarios; naturally captures the liquidity dimension of risk; and
is highly intuitive such that senior managers immediately engage with it

5
508.3. According to the Institute of international Finance, each of the following is a responsibility
of either senior management or risk management EXCEPT which is inaccurate?

a) Senior management must set the tone and lead the discussion regarding risk appetite
b) Risk management staff must take ownership, and drive the development, of line-of-
business risk appetites and profiles because these are primarily a means of setting limits
and constraining business
c) Risk management must provide clarity of concept and definition and support in
understanding the implications of the risk appetite statements and metrics as they
develop
d) Risk management must provide the appropriate infrastructure and controls to support
the ongoing maintenance of the RAF

6
Answers:

508.1. C. A "risk posture" is a qualitative expression of whether the business unit intends
to take more, less, or approximately the same amount of risk over the next planning
period

IIF: "Use of the concept of “risk posture”—a qualitative expression of whether the business unit
intends to take more, less, or approximately the same amount of risk over the next planning
period—at both the divisional and group levels is an effective approach in moving the discussion
forward and supplements the use of quantitative metrics. Risk posture is an intuitive, accessible,
and widely understood concept that avoids technical language and enables extensive
participation by a wide group of participants in the dialog and discussion about risk appetite. the
iterative process described above needs to include an explicit discussion of the risk/reward
tradeoffs. The relevant questions are: what are we trying to do? and What are the trade-offs?
One firm reported: “This [risk appetite] approach allows an intelligent discussion of ‘who we are’
and the optimal business mix and balance based on risk and return.” Another said: “getting the
head of strategy to recognize and incorporate Risk management personnel into planning
decisions was big win for us.”

508.2. B. Aggregation of risk appetite should be done on both a “normal course” and
stressed basis

 In regard to (A), (C), and (D), each is FALSE.

 In regard to false (A), risk aggregation is not a mature practice: "A number of
participating firms report substantial progress in the creation of risk appetite frameworks,
and they report seeing tangible benefits. However, the financial services industry as a
whole is still at the early stages of what needs to be seen as a journey. It is doubtful
whether any single firm has fully completed that journey, and the identification of a
comprehensive set of industry-wide sound practices is still some way off. This report
nevertheless contains a number of valuable insights and proven techniques for
enhancing risk appetite practices."
 In regard to false (C), "the best way of expressing risk appetite in a way that covers all
relevant risks is also proving a challenge for firms. This is particularly true in respect to
risks that are less quantifiable and require a more qualitative approach. Once the
process moves beyond traditional credit and market risks—where historical data is
abundantly available—to focus on reputational, strategic, and operational risks,
significant challenges remain. However, it is widely recognized that an RAF cannot be
confined to risks that can be easily measured. To be meaningful, risk appetite needs to
take a comprehensive view across a firm, and risk appetite statements need to capture
and include those risks that cannot be easily quantified. The identification and effective
mitigation of such risks is a difficult challenge that is not, of course, confined to risk
appetite. While some firms are comfortable tracking these risks with qualitative
indicators, most are making significant efforts to quantify such risks, though, for
example, proxy measures and use a combination of qualitative and detailed quantitative
elements in their risk appetite statements."

7
  In regard to false (D), this section is instructive: "89. The technical challenges involved
in risk aggregation are numerous and complex. In practice, most banks use a variety of
regulatory and economic capital measures for risk aggregation purposes. However,
these measures suffer from a number of important weaknesses when used for this
purpose. These include:
o The inability of capital measures to capture and reflect non-quantifiable risks
o The challenges of determining the appropriate treatment of risk concentrations
and diversification within and between risk types.
o The difficulty of directly linking capital measures to specific macroeconomic
stress scenarios.
o The inability of capital measures to capture the liquidity dimensions of risk, which
are so crucial for understanding potential losses in severe scenarios.
o More fundamentally, the non-intuitive nature of capital measures. Experience has
shown that it is difficult to get senior managers and directors to engage in a
meaningful way with statistical variables and capital measures (e.g., value at
Risk at 99% or 99.95% confidence levels) and use them with confidence in the
risk appetite process. The experience of a number of firms has been that it can
be easier to get active engagement from senior management and directors
around specific macroeconomic scenario assumptions.

508.3. B. False: It is an absolute requirement that the business (and not risk
management) take ownership and drive the development of line-of-business risk appetite
and profile

IIF: "108. It is an absolute requirement that the business (and not risk management) take
ownership and drive the development of line-of-business risk appetite and profile. It must be
recognized that risk appetite does not belong to the risk management staff and is not simply
another way to set limits and constrain business. Business unit risk appetite frameworks are the
main vehicle for providing guidance and clarity regarding which activities and risks businesses
can consider and what would be outside of agreed upon appetite …
"117. At the same time, risk management must allow the businesses to take charge of the
process of developing line-of-business–level risk appetite statements. This means the business
unit leaders themselves, not the embedded risk management staff within the business units."

 In regard to (A), (C) and (D), each is TRUE.

Discuss here in forum: https://www.bionicturtle.com/forum/threads/p1-t1-508-implementation-

of-a-risk-appetite-framework-raf.8251/