Arm 54 Chapter 1

Front 1

Risk

Back 1

Uncertainty about outcomes that can be either negative or positive

Front 2

Traditional concept of risk

Back 2

Risk is a hazard that can happen to an individual or organization

Front 3

ISO

Back 3

International Organization for Standardization

Front 4

ISO 31000 definition of risk management

Back 4

Coordinated activities to direct and control an organization with regard to risk

Front 5

COSO definition of risk management

Back 5

The identification, assessment, and response to risk to a specific objective

Front 6

RIMS definition of risk management

Back 6

Strategic risk management is a business discipline that drives deliberation and action regarding uncertainties and untapped opportunities that affect an organization’s strategy and strategy execution

Front 7

ARM 54 definition of risk management

Back 7

The process of making and implementing decisions that enable an organization to optimize its level of risk

Front 8

Hazard risk

Back 8

Risk from accidental loss, including the possibility of loss or no loss

Front 9

Risk profile

Back 9

A set of characteristics common to all risks in a portfolio

Front 10

The 4 high-level categories of risk

Back 10

• Hazard (pure) risk
• Operational risks
• Financial risks
• Strategic risks

Front 11

Why has the evolution of risk management occurred?

Back 11

The evolution of risk management has occurred in part because of high-profile failures of large organizations during the late twentieth and early twenty-first centuries, followed by the global financial crisis.

Front 12

Systemic risk

Back 12

The potential for a major disruption in the function of an entire market or financial system.

Front 13

Cost of risk

Back 13

The total cost incurred by an organization because of the possibility of accidental loss.

Front 14

An organization’s cost of risk is the total of these:

Back 14

• Costs of accidental losses not reimbursed by insurance or other outside sources
• Insurance premiums or expenses incurred for noninsurance indemnity
• Costs of risk control techniques to prevent or reduce the size of accidental losses
• Costs of administering risk management activities

Front 15

How does risk management reduce the deterrent effects of uncertainty about potential future accidental losses?

Back 15

By making these losses less frequent, less severe, or more foreseeable.

Front 16

How does reducing uncertainty benefit an organization?

Back 16

• Alleviates or reduces management's fears about potential losses, thereby increasing the feasibility of ventures that once appeared too risky
• Increases profit potential by greater participation in investment or production activities
• Makes the organization a safer investment, and, therefore, more attractive to suppliers of investment capital through which the organization can expand

Front 17

Downside risk

Back 17

Losses and failures.

Front 18

Risk appetite

Back 18

The total exposed amount that an organization wishes to undertake on the basis of risk-return tradeoffs for one or more desired and expected outcomes.

Front 19

How does risk management benefit the entire economy?

Back 19

• Reducing waste of resources
• Improving allocation of productive resources
• Reducing systemic risk

Front 20

These are typical risk management goals:

Back 20

• Tolerable uncertainty
• Legal and regulatory compliance
• Survival
• Business continuity
• Earnings stability
• Profitability and growth
• Social responsibility
• Economy of risk management operations

Front 21

Value at risk

Back 21

A threshold value such that the probability of loss on the portfolio over the given time horizon exceeds this value, assuming normal markets and no trading in the portfolio.

Front 22

An organization’s legal obligations are typically based on these items:

Back 22

• Standard of care that is owed to others
• Contracts entered into by the organization
• Federal, state, provincial, territorial, and local laws and regulations

Front 23

An organization should take these steps to provide business continuity and, therefore, resiliency:

Back 23

• Identify activities whose interruptions cannot be tolerated
• Identify the types of accidents that could interrupt such activities
• Determine the standby resources that must be immediately available to counter the effects of those accidents
• Ensure the availability of the standby resources at even the most unlikely and difficult times

Front 24

These are the basic measures that apply to risk management:

Back 24

• Exposure
• Volatility
• Likelihood
• Consequences
• Time horizon
• Correlation

Front 25

Exposure

Back 25

Any condition that presents a possibility of gain or loss, whether or not an actual loss occurs.

Front 26

How does risk relate to exposure?

Back 26

Generally, the risk increases as the exposure increases, assuming the risk is nondiversifiable.

Front 27

What does exposure measure?

Back 27

Exposure provides a measure of the maximum potential damage associated with an occurrence.

Front 28

Volatility

Back 28

Frequent fluctuations, such as in the price of an asset.

Front 29

How does risk relate to volatility?

Back 29

Generally, risk increases as volatility increases.

Front 30

Law of large numbers

Back 30

A mathematical principle stating that as the number of similar but independent exposure units increases, the relative accuracy of predictions about future outcomes (losses) also increases.

Front 31

Why is the term “likelihood” used instead of “probability”?

Back 31

The term “likelihood” is used rather than “probability” because probability analysis relies on the law of large numbers.

Front 32

What are consequences?

Back 32

Consequences are the measure of the degree to which an occurrence could positively or negatively affect an organization. The greater the consequences, the greater the risk.

Front 33

Describe how risk should be managed, depending on likelihood (low to high) and consequences (minor to major).

Back 33

• low likelihood & minor consequences = may not be necessary to actively manage the risk
• high likelihood & minor consequences = should usually be managed through organization’s routine business practices
• low likelihood & major consequences = should be managed
• high likelihood & major consequences = require significant, continuous risk management

Front 34

Time horizon

Back 34

Estimated duration

Front 35

How does risk relate to time horizon?

Back 35

Longer time horizons are generally riskier than shorter ones.

Front 36

How should an organization manage time-horizon-related risk?

Back 36

Although an organization may have little or no control over the time horizon of a risk, the organization should evaluate and manage this risk just as it would manage other risks over which it has no control, such as weather-related risks.

Front 37

Correlation

Back 37

A relationship between two variables

Front 38

How does risk relate to correlation?

Back 38

If two or more risks are similar, they are usually highly correlated. The greater the correlation, the greater the risk. Uncorrelated risks can reduce risk to the extent that they provide a balance or hedge.

Front 39

What risk-management strategy can reduce the risk of correlation?

Back 39

Diversification can reduce the risk of correlation.

Front 40

What are the most commonly-used classifications of risk?

Back 40

• Pure and speculative risk
• Subjective and objective risk
• Diversifiable and nondiversifiable risk
• Quadrants of risk (hazard, operations, financial, and strategic)

Front 41

Pure risk

Back 41

A chance of loss or no loss, but no chance of gain

Front 42

Speculative risk

Back 42

A chance of loss, no loss, or gain

Front 43

How do pure risk and speculative risk differ in desirability?

Back 43

Because there is no opportunity for financial gain, pure risks are always undesirable. In comparison, speculative risk involves a chance of gain. As a result, it can be desirable, as evidenced by the fact that every business venture involves speculative risks.

Front 44

Credit risk

Back 44

The risk that customers or other creditors will fail to make promised payments as they come due.

Front 45

These are the four speculative risks in investments

Back 45

• Market risk
• Inflation risk
• Interest rate risk
• Liquidity risk

Front 46

Market risk

Back 46

The risk associated with fluctuations in prices of financial securities, such as stocks and bonds

Front 47

Inflation risk

Back 47

The risk associated with the loss of purchasing power because of an overall increase in the economy’s price level

Front 48

Interest rate risk

Back 48

The risk associated with a security’s future value because of changes in the interest rates

Front 49

Liquidity risk

Back 49

The risk associated with being able to liquidate an investment easily and at a reasonable price; the risk that an asset cannot be sold on short notice without incurring a loss

Front 50

Subjective risk

Back 50

The perceived amount of risk based on an individual’s or organization’s opinion

Front 51

Objective risk

Back 51

The measurable variation in uncertain outcomes based on facts and data

Front 52

Why do subjective and objective risk sometimes differ substantially?

Back 52

• Familiarity and control (e.g., thinking driving is safer than air travel)
• Consequences over likelihood (“it can’t happen to me”, overstating likeliness due to heightened/personal awareness)
• Risk awareness (if an organization is unaware of its risks, it will perceive them as lower than they are)

Front 53

Diversifiable risk

Back 53

A risk that affects only some individuals, businesses, or small groups

Front 54

Nondiversifiable risk

Back 54

A risk that affects a large segment of society at the same time

Front 55

How does diversifiability of risk relate to correlation?

Back 55

Diversifiable risk is not highly correlated and can be managed through diversification, or spread, of risk. Nondiversifiable risks (e.g., inflation, unemployment, natural disasters) are correlated — their gains or losses tend to occur simultaneously rather than randomly.

Front 56

Hazard risks arise from:

Back 56

Property, liability, or personnel loss exposures. They are generally the subject of insurance.

Front 57

Operational risks arise from:

Back 57

People or a failure in processes, systems, or controls, including those involving information technology.

Front 58

Financial risks arise from:

Back 58

The effect of market forces on financial assets or liabilities; they include market risk, credit risk, liquidity risk, and price risk.

Front 59

Strategic risks arise from:

Back 59

Trends in the economy and society, including changes in the economic, political, and competitive environments, as well as from demographic shifts.

Front 60

Market risk

Back 60

Uncertainty about an investment’s future value because of potential changes in the market for that type of investment

Front 61

Which quadrants of risk are pure risks?

Back 61

• Hazard risk
• Operational risk

Front 62

Which quadrants of risk are speculative risks?

Back 62

• Financial risk
• Strategic risk

Front 63

How do the classifications of risk differ from the quadrants of risk?

Back 63

Whereas the classifications of risk focus on some aspect of the risk itself, the four quadrants of risk focus on the risk source and who traditionally manages it.

Front 64

What concept do the various definitions of ERM share?

Back 64

The various definitions of ERM all include the concept of managing all of an organization’s risks to help an organization meet its objectives.

Front 65

The three main theoretical concepts (pillars) of ERM

Back 65

• Interdependency
• Correlation
• Portfolio theory

Front 66

RIMS definition of ERM

Back 66

A strategic business discipline that supports the achievement of an organization’s objectives by addressing the full spectrum of its risks and managing the combined impact of those risks as an interrelated risk portfolio.

Front 67

Casualty Actuarial Society (CAS) definition of ERM

Back 67

The discipline by which an organization in any industry assesses, controls, exploits, finances, and monitors risks from all sources for the purpose of increasing the organization’s short- and long-term value to its stakeholders.

Front 68

COSO definition of ERM

Back 68

A process, effected by an entity’s board of directors, management, and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives.

Front 69

What is portfolio theory in ERM?

Back 69

In an ERM context, a portfolio is a combination of risks. The portfolio theory assumes that risk includes both individual risks and their interactions.

Front 70

Interdependency in ERM

Back 70

The silo type of management that is typical of traditional risk management ignores any interdependencies and assumes that a financial risk is unrelated to a hazard risk. The traditional assumption of independence may not always be valid. When it isn’t, the assumption may result in an inefficient treatment of an organization’s portfolio of risks.

Front 71

Statistical independence

Back 71

Events are statistically independent if the probability of one event occurring does not affect the probability of a second event occurring.

Front 72

What is the role of the Chief Risk Officer in ERM?

Back 72

As facilitator, the CRO engages the organization’s management in a continuous conversation that establishes risk strategic goals in relationship to the organizations strengths, weaknesses, opportunities, and threats (SWOT).

Front 73

How does the CRO shape an organization’s risk culture under ERM?

Back 73

The CRO’s responsibility includes helping the enterprise to create a risk culture in which managers of the organization’s divisions and units, and eventually individual employees, become risk owners.

Front 74

Name two major impediments to successfully adopting ERM

Back 74

• Technological deficiency
• Traditional organizational culture with entrenched silos