Charta is on Google Play: practise on the go. Get the app
Charta

Contrast the strategies open to a firm for managing its risk exposures and identify the circumstances in which each would be chosen.

FRM® Part I · Foundations of Risk Management · How Do Firms Manage Financial Risk? · FRM1.FR.2.a

The idea

A firm has four basic responses to a risk it has identified. It can avoid the risk by not undertaking the activity. It can transfer the risk by buying insurance or using derivatives. It can mitigate the risk by cutting the probability or the size of the loss through controls, diversification or limits. Or it can retain the risk by accepting the loss and funding it from earnings or capital. Avoidance suits risks that are large, hard to control and unrelated to the firm's strengths. Transfer suits low-frequency, high-severity risks that could threaten solvency, even when the premium exceeds the expected loss. Mitigation suits risks the firm can influence cheaply. Retention suits small, frequent losses where cover costs more than it is worth, and core risks the firm is paid to take. The usual mistake is to assume transfer leaves no residual risk. On the exam, match the strategy to frequency, severity and strategic fit.

A practice question

From the question bank, with the reason each wrong option is wrong.

A bank's board decides to withdraw from a line of business entirely because the potential losses cannot be brought within its risk appetite. Which risk management strategy does this represent?

  1. Risk transferWhy not: Transfer keeps the activity and passes the loss to another party through insurance or derivatives; here the activity is stopped.
  2. Risk avoidance - correct
  3. Risk mitigationWhy not: Mitigation keeps the activity and reduces the likelihood or size of losses; withdrawing removes the activity altogether.
  4. Risk retentionWhy not: Retention means knowingly accepting and funding the losses; the bank is eliminating the exposure instead.

Ceasing the activity removes the exposure entirely, which is avoidance. Transfer, mitigation and retention all keep the activity running and differ in who bears or how large the residual loss is.

A harder one

A payments firm introduces dual authorisation and daily reconciliations to cut the number of fraudulent transfers. Fraud losses that still occur are borne by the firm. Which description is accurate?

  1. Risk transfer, because the controls move the fraud losses onto customersWhy not: Controls do not shift losses to anyone else; the firm still pays every fraud that gets through.
  2. Risk avoidance, because the controls remove the possibility of fraudWhy not: Controls lower but cannot remove fraud; avoidance would mean ceasing to offer the payment service.
  3. Mitigation of the frequency of loss, with the remaining losses retained - correct
  4. Pure retention, because no insurance or derivative contract is usedWhy not: Retention is not the whole story: the controls actively reduce the likelihood of loss, which is mitigation.

Controls that reduce the probability of loss are mitigation, and what remains is retained. Strategies are not exclusive: most firms combine mitigation with retention of the residual.

The hardest tier

Losses on a risk are modelled as follows within one year, with at most one event: a loss of USD 2 million with probability 10% and a loss of USD 40 million with probability 1%. The firm can absorb a net outlay of at most USD 10 million in a year. Options: (1) retain everything; (2) full insurance at a premium of USD 0.90 million; (3) a policy with a USD 3 million deductible per event at a premium of USD 0.45 million. Which is the cheapest option in expected annual cost that stays within the firm's capacity, and what is that cost?

  1. Option 1, expected cost USD 0.60 millionWhy not: Option 1 has the lowest expected cost, but a USD 40 million loss exceeds the firm's USD 10 million capacity.
  2. Option 2, expected cost USD 0.90 millionWhy not: Option 2 is within capacity but is not the cheapest; the deductible policy has a lower expected cost.
  3. Option 3, expected cost USD 0.45 millionWhy not: Counts only the premium and omits the losses the firm retains below the USD 3 million deductible.
  4. Option 3, expected cost USD 0.68 million - correct

Option 3 expected cost = 0.45 + 0.10 x 2 + 0.01 x 3 = 0.68. Option 1 costs 0.10 x 2 + 0.01 x 40 = 0.60 but its worst case of 40 breaches capacity; option 2 costs 0.90. Capacity is the binding constraint, not the lowest expected cost.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in How Do Firms Manage Financial Risk?