A bank lends USD 20 million to a logistics company and expects to lose, on average, about USD 160,000 of it, an amount it can price into the interest rate. What it cannot price away is the year the borrower fails, the year the property market turns and many borrowers fail together, or the morning a trader’s typing error opens a position nobody intended. Risk management is the discipline of telling these situations apart and deciding what to do about each.

This first chapter of FRM Part 1 sets out the structure the rest of the curriculum builds on, organized around GARP’s ten building blocks. It defines risk and maps the main types of risk, including how a loss in one type spills into another. It then works through the tools for measuring loss, from expected loss to value at risk and expected shortfall, and closes with the questions that apply to the whole firm: incentives, aggregation, risk-adjusted return and enterprise risk management.

What Risk Is, and Why Risk Taking Needs Risk Management

Put plainly, risk is the possibility that bad things happen. In finance the idea is wider, because the uncertainty that can produce a loss can also produce a gain. A bank lending to a small business is exposed to the chance the business fails, and that same exposure is why the loan earns interest. Risk is the variability of outcomes around what you expect, and in business it is usually the price of the reward being pursued.

That is why risk taking and risk management are two sides of one activity. Risk taking accepts an uncertain outcome in pursuit of a return. Risk management asks of each such decision whether the risk is in proportion to the reward, and whether the firm could keep the reward while carrying less risk. A firm that only takes risk is gambling, and one that avoids all risk earns nothing. The job is to keep the risks the firm is good at bearing and to shed, shrink or price the rest.

Instinct is a poor guide. Behavioral research shows that people lean too heavily on instinct and personal experience, and that the way a choice is framed changes how much risk they will take. Formal risk management exists partly to correct for this.

The craft is old. Ancient merchants tied loan repayment to the safe arrival of their cargo, and by the fourteenth century merchants in northern Italy had split the insurance from the loan, creating the first standalone instrument for transferring financial risk. Futures, financial theory and risk transfer markets followed over the next centuries. In GARP’s phrase, risk management is an old craft, a young science, and an even younger profession.

The ten building blocks

GARP organizes the subject around ten building blocks. They are not ranked, and not every firm needs a sophisticated version of each. Their value is diagnostic: most risk disasters come from ignoring a fundamental, such as a type of risk nobody watched or a link between two risks nobody saw, rather than from a failed advanced technique. Exhibit 1 lists the ten and the question each one asks.

The sections below take the blocks in an order that lets each idea build on the last: the types of risk, the process, the measurement tools, and then the questions that apply to the firm as a whole.

A Map of the Main Types of Risk

Before a risk can be managed it has to be named. A risk typology sorts a firm’s risks into families, so it can drill into the drivers of each, spot gaps nobody is watching, and make someone accountable for each domain. It also mirrors how most banks organize risk, with separate teams for market risk, credit risk and the rest, teams that worked largely in isolation until the mid-1990s.

Each family needs its own skills and attitude. Banks seek out market and credit risk because these grow with reward, but operational risk brings no extra reward, so firms try to reduce it. The families also evolve with market practice: rogue trading grew with the derivatives business, and cyber and data privacy risk grew with the digital economy.

Market Risk: General, Specific and Basis Risk

Market risk is the risk that changes in market prices and rates reduce the value of a position. Prices move every day, and that volatility is the engine of market risk. From a financial institution’s point of view, its four main forms follow the underlying asset: equity risk, interest rate risk, currency risk and commodity price risk.

In every market two drivers are at work. General market risk is the risk that a whole asset class falls, taking every asset in it down. Specific market risk is the risk that one asset falls by more than its class. If a stock index drops 8 percent in a month while one retailer’s shares drop 20 percent, a holder of that retailer has suffered both.

Market risk is managed through the relationships between positions, since the specific risks in a diversified portfolio partly cancel. The same relationships can also create risk: an index fund may track its benchmark imperfectly, and a hedge may offset its exposure only partly. That second mismatch is basis risk, the risk that a hedge and the exposure it protects stop moving together.

Basis risk is often a bigger practical problem than an open exposure, because it hides in positions that look safe. A hedge built on a historical price relationship works only while that relationship holds, and if it breaks, the hedge can lose more than having no hedge at all.

Credit Risk and the Three Levers That Drive It

Credit risk is the risk that one party fails to meet its financial obligations to another. It takes several forms:

• Default risk, also called bankruptcy risk: a borrower fails to pay interest or principal on a loan.
• Downgrade risk: a borrower or counterparty is downgraded, signaling higher risk and often causing an immediate fall in the value of any security linked to its credit.
• Counterparty risk: the other side of a market trade fails to perform. This includes settlement risk, also called Herstatt risk after a German bank closed by regulators in 1974. The timing of that closure meant counterparties had already paid their leg of foreign exchange trades in Deutsche Marks, but Herstatt never paid its leg in US dollars.

Three levers set the size of a credit risk: the probability of default, the exposure at the moment of default, and the amount recovered afterwards. A firm can move all three, by choosing stronger borrowers, by limiting exposure, and by structuring the instrument: whether it is secured and by what, where the lender ranks in a bankruptcy, and which covenants restrict the borrower.

Exposure is plain on a loan but volatile on a derivative. An interest rate swap usually has no market value when it is signed, so it starts with no credit exposure. As rates move, one side gains at the other’s expense, and a contract that began at zero can become a large exposure to a counterparty that now owes a great deal.

Credit risk across a whole portfolio

A single borrower’s probability of default is traditionally assessed from risk factors such as financial ratios and industry. A portfolio’s risk also depends on concentration, the size of each exposure relative to the whole, and on how the risk factors relate. A credit portfolio is far riskier when:

• it holds a few large loans rather than many small ones;
• the returns or default probabilities of the loans are positively correlated, for example because the borrowers share an industry or a region; and
• the exposure, the probability of default and the loss given default rise together, for example because recoveries fall just as defaults climb.

Each condition makes losses more likely to arrive together, and credit portfolio models exist to find risk hiding in these combinations. In 2021 several large banks had financed big, concentrated positions for the family office Archegos Capital; when the positions were unwound, Credit Suisse alone reported a loss of roughly USD 5.5 billion.

Funding Liquidity and Market Liquidity

Liquidity risk is one name for two quite separate risks, and the two must be kept apart.

Funding liquidity risk is the risk that a firm cannot raise enough cash, or assets it can turn into cash, to meet its obligations. A fast-growing small company faces it when bills fall due before revenue arrives. Banks face it by design, because they take short-term deposits and lend for longer terms at higher rates, which is why asset-liability management (ALM), using gap and duration analysis, sits at the center of banking. Many banks that failed in the 2007 to 2009 crisis had large maturity mismatches and relied on wholesale funding that lost confidence in them. In March 2023, Silicon Valley Bank failed after customers tried to withdraw roughly USD 42 billion in a single day.

Market liquidity risk, also called trading liquidity risk, is the risk of loss when markets seize up and a seller must accept an abnormally low price, or cannot sell at all. Trading volume and bid-ask spreads gauge liquidity in normal markets, but say little about whether a market will stay liquid in a crisis, which is when it matters.

The two feed each other. A bank that loses its funding may have to sell assets fast, and if they cannot be sold at fair prices, the losses deepen the funding problem.

Operational, Business, Strategic and Reputation Risk

Operational risk

The Basel Committee on Banking Supervision defines operational risk as “the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events.” The definition includes legal risk but excludes business, strategic and reputation risk. It is deliberately broad, covering everything from money laundering and cyber attacks to terrorism and rogue trading. A wave of rogue trading losses in the 1990s was one of the things that persuaded regulators to include operational risk in bank capital requirements.

Many corporate disasters outside banking fit the same definition, from plant accidents to governance scandals such as the collapse of Enron in 2001, and for many non-financial firms operational risk is the main daily concern, often handled through insurance.

Measuring operational risk has proved far harder than recognizing it. From the late 1990s banks built loss databases and statistical models, partly to hold capital against it, but regulators doubted the models. In 2016 the Basel Committee changed course: banks should keep the tools to understand the risk, while regulatory capital would come from a simpler standardized approach based on bank size, scaled up for banks with a record of large operational losses. With legal claims, cyber attacks and data privacy penalties, operational risk remains among the largest risks banks face.

Business and strategic risk

Business risk covers the ordinary worries of running a firm: demand, pricing, suppliers, competition and new products. Strategic risk comes from large, long-term decisions about the firm’s direction, backed by big commitments of capital, people and reputation, such as a bank deciding whether to build, buy or partner with a financial technology business.

General management owns these risks, but three points tie them to risk management:

1. Management must state a risk appetite that covers major business and strategic decisions. A firm may be cautious on credit risk and entrepreneurial on business risk, but the difference should be a deliberate, explained choice.
2. The risk team can quantify parts of business and strategic risk. Credit specialists are often drawn into supply chain risk, and macroeconomic scenario analysis can sharpen strategic decisions.
3. Business decisions create large exposures in other risk families, so risk managers must be involved from the start of planning. Financing a power plant may be impossible without an energy price hedging strategy, and growing a lending book may quietly require lower credit standards. Banks that fail to align business, strategy and risk do not survive for long.

Reputation risk

Reputation risk is the danger of a sudden fall in a firm’s market standing or brand that has economic consequences, such as losing customers or counterparties. It usually follows a failure somewhere else that damages confidence in either the firm’s financial soundness or its fair dealing.

For a bank, doubts about soundness can be self-fulfilling: a large credit loss starts rumors, and depositors withdraw because they expect others to, so banks need plans to reassure markets quickly. A reputation for fair dealing matters as much, because a firm that misrepresents a product’s risks can lose its best customers. Standing with regulators is a special case, since a bank that loses a regulator’s trust may face repeated examinations and curbs on its activities.

The Risk Management Process: Identify, Analyze, Assess, Manage

The first building block is the classic risk management process. The risk manager identifies the risk, analyzes and measures it, assesses what a risk event would do to the firm, and then manages it by choosing a response. The cycle repeats, because the business keeps changing.

Identifying the type of risk matters as much as measuring its size, because the type shapes the response. A manufacturer usually accepts the operational risks of its factory but avoids or transfers large market and credit risks, and investors punish losses in risks they think a firm had no business carrying, such as a speculative derivatives loss at a furniture maker.

Tools for identifying and triaging risk

Identification usually starts with the tools in Exhibit 2. None of them needs a model; all of them need access to the people who run the business.

The four responses

Exhibit 3 sets out the four responses, each with an example.

As a firm improves, it sheds the risks that destroy value or are not essential, which frees it to take more of the risks where it creates value. A farmer who can hedge the harvest price can plant more, and a bank that controls credit risk can lend more. Risk management therefore supports specialization, scale and wealth creation, not only survival, and it never ends, because each success becomes a platform for bigger undertakings.

Known Risks, Unknown Risks and Knightian Uncertainty

A common mistake is to concentrate on the risks that are known and measurable and ignore the rest. The second building block guards against it by separating what can be measured from what cannot.

The distinction dates from 1921, when Frank Knight and John Maynard Keynes each separated measurable risk from something deeper. Knight’s risk is a situation where the outcome is unknown but its probabilities can be estimated reasonably well. His uncertainty is a situation where the decision maker cannot know enough even to assign probabilities. Today the second is called Knightian uncertainty.

In 2002, US Secretary of Defense Donald Rumsfeld put the same idea as known knowns, known unknowns and unknown unknowns, arguing that people focus on the risks they have data for and neglect larger ones they understand poorly. A fourth case completes Figure 4: risks that are known but not acknowledged, the elephant in the room.

A 2018 Bank of England speech drew a similar line between “moonwalking bears”, risks that are visible to anyone paying attention, and “underwater icebergs”, risks that stay hidden until they surface. The first is a failure of attention and the second a failure of foresight.

The boundary moves. Before 1950 the health risk of smoking was a Knightian uncertainty and tobacco advertising claimed doctors’ approval; by the mid-1970s it had become a quantified risk. Some uncertainties, such as nuclear war, may never be quantified, yet they can still be managed, by avoidance, once their severity is accepted.

Expected Loss, Unexpected Loss and Tail Loss

Some losses a firm can plan for and others it has to survive, and telling them apart is the third building block. Expected loss (EL) is the average loss a position or portfolio is likely to produce. In some portfolios losses rarely stray far from this average, and they can be measured statistically with reasonable confidence over a fairly short period.

EL depends on how likely the loss event is, how exposed the firm is, and how severe the loss would be. For the credit risk of a loan these become the probability of default, the exposure at default and the loss given default.

The three terms multiply because each one scales the others. Halve the exposure and the expected loss halves; double the probability of default and it doubles. If any one of the three is zero, there is no expected loss at all, which is exactly why lenders work so hard on all three levers.

Expect the unexpected

Even well-behaved portfolios surprise. A fraud uncovered in a card book or an unlucky run of defaults pushes losses above the average, and how far they depart from it is the unexpected loss (UL). In practice it is often measured as the gap between a loss reached only rarely, at a chosen high confidence level, and the expected loss.

Portfolio structure drives unexpected loss: many small, diversified loans make it unlikely that one large default or a cluster of defaults hits at once. Both EL and UL also shift as the economy and the book change, so estimating them takes judgment as well as statistics.

From unexpected to extreme

Some portfolios swing far more over a decade, with long runs of good years and short runs of very bad ones. They are deceptive, because a calm stretch encourages complacency before a shock arrives. Against positions like these, banks hold large amounts of risk capital to survive unexpected losses, in addition to pricing the expected loss. Figure 5 places the pieces on the loss distribution of a USD 200 million loan book with the same 3 percent PD and 50 percent LGD, whose borrowers share exposure to one economic cycle, assuming its risk team estimates that losses exceed USD 18 million in only one year out of 1,000.

Value at Risk and Expected Shortfall

In January 1990, Dennis Weatherstone, the new chief executive of J.P. Morgan, asked for a report of the bank’s total risk on his desk at 4:15 every afternoon. Meeting that request helped produce a single firm-wide risk number, value at risk (VaR), and J.P. Morgan published its methodology in 1994.

VaR is usually defined as the worst expected loss over a given horizon, under normal market conditions, at a given confidence level. Every VaR statement has three parts: an amount, a horizon and a confidence level.

A 10-day VaR of USD 25 million at 99 percent confidence means that, under normal conditions, there is a 1 percent probability the desk loses more than USD 25 million over the next ten trading days. It does not cap the loss, and it says nothing about how much more could be lost when the threshold is breached.

VaR moves with the confidence level and the shape of the loss distribution. Easing the confidence level from 99 percent to 95 percent lowers it, because a more common loss is being reported, and a fatter-tailed distribution raises it.

Expected shortfall: looking inside the tail

VaR marks where the tail begins without measuring what is in it: two portfolios can share a VaR of USD 5 million while one occasionally loses USD 6 million and the other USD 60 million. Expected shortfall (ES), also called conditional VaR, fixes this by averaging the losses that exceed the VaR.

Risk Factors, and How Risks Interact

Risk factor breakdown, the fourth building block, splits a risk into the drivers that produce losses and studies how they move, alone and together. For credit risk the primary factors are PD, LGD and EAD, and each has deeper drivers: a firm’s probability of default depends on its financial strength, its industry, its management and more.

The question is how far down to go. Scoring management quality may mean looking at sub-factors such as the team’s experience, and judging cyber exposure means asking whether the weakness lies in systems, processes or people. Thin loss data and limited analytical resources usually cap the analysis. New data sources and machine learning are loosening that limit, and unsupervised learning can surface clusters and correlations nobody thought to look for, which is one way to find unknown unknowns.

Separating the factors pays off. Before Basel II, banks spent millions of dollars rebuilding their rating systems to record PD, LGD and exposure separately, because a loss record split into its drivers predicts far better than one blended loss rate.

When risk factors move together

The most dangerous losses come when factors that look separate are linked. Commercial real estate is the classic case. Demand rises with the economy, supply lags because buildings take years to finish, prices climb, and lenders loosen loan-to-value limits to win business. When oversupply and a weaker economy turn prices down, lenders pull credit, developers run short of cash and collateral loses value, in a self-reinforcing spiral. The lender’s probability of default rises just as recoveries fall. This combination, where exposure or loss severity rises together with the chance of default, is wrong-way risk, and it appears in derivatives too, when a contract’s value grows just as the counterparty weakens.

How risk flows from one type to another

Whole risk families interact in the same way, which is the second half of the seventh building block. In a severe crisis risk can pass from credit to liquidity to market risk, as in 2007 to 2009. Inside one firm, a trader’s “fat finger” error (operational risk) can create a large unintended position (market risk) whose loss damages the firm’s standing (reputation risk). Figure 7 traces both paths.

Structural Change: From Tail Risk to Systemic Crisis

Some risk events defeat judgment because they are extremely rare, others because they come from changes in a market nobody observed. The fifth building block covers both.

Even a stable complex system, such as the climate or a financial market, produces very rare events over long periods. These tail risk events are an extreme form of unexpected loss and are hard to find in data because there are so few, though a long history should show traces. Where data are scarce, extreme value theory (EVT) helps make the tail more visible.

Structural change is more dangerous. When a system’s structure changes, large losses may become more frequent or larger, factors may begin to move in lockstep, and new types of loss may appear. More history does not help, because it describes a system that no longer exists, and a “once in 100 years” event can recur every decade until the problem is fixed. Expected and unexpected losses can shift as well as the tail.

Financial markets are especially exposed, because behavior, regulation and new products reshape them constantly. In the early 2000s, interest-only mortgages and loans with low initial rates grew from a small fraction of new US mortgage lending to a substantial share, while lending to borrowers with damaged credit histories also rose. A model calibrated on the 1990s mortgage market was measuring a market that had quietly changed, a large part of the story of the 2007 to 2009 crisis.

Human Agency, Conflicts of Interest and the Three Lines of Defense

Structural change is not the only wild card. Unlike natural systems, financial systems are run by intelligent people who react to change, sometimes in a calculating way. A trader who carefully predicts the effect of a market reform finds that rivals are trying to predict the prediction. A regulator who helped write a rule may later join a consultancy and advise firms on how to work around it.

Inside a firm, the people who best understand how a risk is generated are best placed to game it, and often have the least reason to reveal it; a trader paid on this year’s profit gains nothing by advertising a large possible loss next year. That conflict of interest is why many financial firms organize oversight in three lines of defense, shown in Exhibit 4.

The safeguards do not always work. Controls have loopholes and age quickly as products change, and in a worrying number of rogue trading cases the trader had worked in the middle or back office and knew exactly where controls were weak. In 2012 JPMorgan Chase lost about USD 6.2 billion on a large credit derivatives position run from London, the “London Whale” case; investigations found that a newly adopted VaR model had sharply cut the risk the position appeared to carry, and the change had not been properly checked. Understanding human agency and conflicts of interest is the sixth building block.

Why Risk Is Hard to Add Up

With so many risks and measures, the central difficulty is seeing the whole: which businesses are riskiest, and when total risk nears an intolerable level. That is risk aggregation, the eighth building block.

Market risk lends itself best to measurement and aggregation, yet it was long compared by notional amount rather than by notional combined with volatility. That made no sense across assets as different as Treasury notes and a volatile commodity.

Derivatives made the problem worse from the 1970s: they can be highly volatile, their risk is only loosely tied to their notional, and portfolios built so that positions offset each other make total notional almost meaningless.

Options desks use the Greeks, such as delta, the sensitivity of an option’s value to the underlying price, and theta, the change in value as expiration nears. They are essential on the desk but of little use for the whole firm, because they cannot be added together and the same delta implies different risk in currencies than in commodities.

VaR caught on because it puts every position on one scale, a money loss at a stated confidence. It proved almost too useful, stretched to long horizons, whole industries and risk types it was not built for, even though at least three main methods exist and all rest on simplifying assumptions. The 2007 to 2009 crisis exposed these weaknesses and turned firms against relying on one metric. VaR remains an important tool, and regulators have made its calculation more consistent and strengthened the measures alongside it.

Stress testing and reverse stress testing

Two supplements matter here. Scenario analysis and stress testing skip the question of how likely a rare event is and instead measure the impact of a plausible worst-case scenario, which may unfold over a long period and may be set by the firm or by a regulator; the numbers measure severity, not frequency. Reverse stress testing runs the other way: the firm fixes a loss it cannot tolerate, finds a tail scenario that would cause it, and works backward to the exposures and risk factors driving it, and to what it could change to prevent that outcome.

Balancing Risk and Reward: Economic Capital and RAROC

A common measure of risk makes the ninth building block possible: comparing what each activity earns with the risk it creates. A firm absorbs unexpected losses with economic capital, also called risk capital, the capital it believes it needs given its own view of its risks. That differs from regulatory capital, which follows regulators’ rules, as Exhibit 5 shows.

Risk often hides in good times. Business A may carry steady expected losses but few unexpected ones, while Business B shows almost no expected loss and then very large losses at the end of each cycle. In calm years B looks better, and a firm that grows it, perhaps by cutting prices, sets up the losses that arrive when the cycle turns. Banking systems have done this repeatedly. A risk-adjusted view of profit stops a firm from rewarding the business quietly building the most risk.

The classic tool is risk-adjusted return on capital (RAROC), a ratio of reward to risk.

An activity adds shareholder value only if its RAROC exceeds the hurdle rate, the cost of equity capital that shareholders require for the risk they bear. The hurdle rate times the economic capital is the profit an activity must earn just to break even on a risk-adjusted basis.

Firms use RAROC in four routine ways: to compare business lines that need different amounts of capital, as above; to judge a new investment, such as a new credit product, against the hurdle; to find products or customer segments priced too low to earn a risk-adjusted profit, or high enough to cut and still add value; and to weigh the cost of a risk management action, such as insurance, against the capital and losses it saves.

RAROC is only as good as the risk numbers beneath it, and business heads often dispute them, sometimes for self-interested reasons. The same caution applies to every metric. A measure that tracks one component of risk, such as exposure, can fall while risk rises: a bank that loosens credit standards to win back market share may lend less and still carry more credit risk. Key risk indicators (KRIs), such as staff turnover as a signal of one kind of operational risk, are proxies whose link to the risk rests on judgment. A dashboard of proxies is not a view of risk itself.

Enterprise Risk Management: Seeing the Whole Firm

At many firms each division manages its own risks in a silo, ignoring the exposures of the rest of the firm. The tenth building block, enterprise risk management (ERM), breaks down those silos and builds one picture of risk across all types and business lines, using tools such as a clear statement of corporate risk appetite and firm-wide risk committees.

Early ERM efforts leaned too hard on a single number, such as total economic capital or firm-wide VaR. The 2007 to 2009 crisis showed that risk cannot be reduced to one number:

• Risk is multi-dimensional, so it has to be approached from many angles with many methods.
• Risk develops over time and crosses risk types, so even a wide view taken at a single point in time can miss what matters.
• Risk demands expert judgment combined with statistical science, not one in place of the other.

Economic capital still matters for balancing risk and reward, but the insight that saves a firm may come from elsewhere: a worst-case scenario, a new risk indicator, a risk manager who spots a structural change in a market, or a market-based credit signal that warns of trouble at a major counterparty in time to act. Firms need a broad set of tools and plenty of curiosity.

Insight must then lead to action, so modern ERM also covers how information reaches decisions, and the firm’s governance and risk culture. A firm that pushes for growth and then finds it misjudged the risks needs a tested way to change course. ERM has become a whole-of-firm approach to the risk management process and its link to strategy, and it shapes how the firm thinks about risk and therefore what kind of firm it is.

Frequently Asked Questions