Apply, weigh and contrast the ways risk is gauged and handled, namely enterprise risk management, qualitative risk assessment techniques and quantitative measures.
The idea
Enterprise risk management (ERM) is a firm-wide, integrated framework. It identifies, assesses and responds to all material risks together, linked to strategy and risk appetite, rather than leaving each unit to manage its own risks in a silo. Within it, firms use two families of tools. Qualitative techniques include risk and control self-assessments, risk registers, heat maps of likelihood against impact, scenario workshops and expert judgement. They suit risks that are hard to measure or have no loss history, but they are subjective and coarse. Quantitative measures include standard deviation, sensitivities, value at risk, expected shortfall and stress tests. They give comparable numbers, but depend on models and past data and can create false precision. Good practice combines both. The exam favours the judgement of which tool fits which risk.
A practice question
Which feature best characterizes enterprise risk management (ERM)?
- Each business line managing its own risks independently, using its own methods and definitions.Why not: That is silo-based risk management, the approach ERM was designed to replace.
- A single quantitative model that converts every risk into one capital number automatically.Why not: ERM is a framework and governance process; a single model is at most one tool within it.
- Insuring all risks with external insurers so that none remain on the balance sheet.Why not: Risk transfer is one possible response; ERM is about integrated identification, assessment and decision-making.
- A firm-wide framework that treats all material risks together, linked to strategy and appetite. - correct
ERM's defining feature is integration: a consistent, firm-wide view of all material risks tied to strategy and appetite, with clear governance, in place of separate unit-level approaches.
A harder one
A bank plans to launch a mobile payments product. Management wants to understand reputational and conduct risks for which no reliable loss history exists. Which approach is most appropriate as the primary tool?
- A historical-simulation VaR using the bank's past 500 daily returns.Why not: No return history exists for a new product, and VaR does not capture reputational or conduct events.
- Structured scenario analysis and expert workshops, recorded in a risk register. - correct
- A parametric expected shortfall calibrated to the volatility of an equity index.Why not: Calibrating to an unrelated volatility gives false precision; expected shortfall measures market loss on known positions.
- Waiting until enough losses have accumulated, then fitting a statistical loss distribution.Why not: Defers assessment until after losses occur; where data are absent, qualitative judgement is needed now.
Qualitative techniques suit risks that are hard to measure or lack data. Scenario analysis with expert input is the practical primary tool for a new product's reputational and conduct risks.
The hardest tier
Which is the strongest reason ERM can add value beyond managing market, credit and operational risk separately?
- It reveals interactions and concentrations across risks, so total risk is judged against capital. - correct
- It removes the need for specialist risk functions because one committee handles every risk.Why not: ERM coordinates specialist expertise; it does not replace it.
- It guarantees a lower regulatory capital requirement by combining all risks into one measure.Why not: Integration can show diversification, but it guarantees nothing and may reveal concentrations that raise required capital.
- It replaces quantitative measures with qualitative judgement, which is cheaper and more consistent.Why not: ERM uses quantitative and qualitative tools together; it does not replace numbers with judgement.
The value of ERM lies in the integrated view: seeing how risks combine, where they concentrate, and whether total risk fits capital and strategy. Silos cannot show this.
In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.
Start free →More in The Building Blocks of Risk Management
- Define risk and set risk management against risk taking, showing how the two differ.
- Tell expected loss and unexpected loss apart, illustrating both with examples.
- Read the link between risk and reward, and show how risk management can be distorted when interests conflict.
- Describe the main classes of risk and set them apart, showing how each arises and judging what effect each could have on an organization.
- Show how different risk factors can act on one another, and outline why combining risk exposures into a total is hard.