Free sample chapter from FRM Level I: Foundations of Risk Management.

Chapter 1: The Building Blocks of Risk Management

Chapter 1: The Building Blocks of Risk Management

Risk management has a vocabulary problem. Almost every word in it — risk, exposure, loss, capital — is also an ordinary English word, and the ordinary meanings are close enough to the technical ones to feel safe and wrong enough to cost you marks. This chapter fixes the vocabulary, and it does so by making every term do work on a single set of numbers you will still be using in Chapter 7.

Our subject is Ravensmoor Financial Group, a mid-sized bank holding company. Ravensmoor's commercial lending division holds 400 loans of $6 million each — $2,400 million of exposure — and its chief risk officer, Ingrid Halvorsen, has been asked by the board a question that sounds simple: how much could this book lose?

There is no single answer. By the end of this chapter you will have produced three defensible ones that differ by a factor of twenty, and you will understand exactly which assumption separates them. That gap is not a failure of the arithmetic. It is the reason the discipline exists.

Learning Objectives

1.1 What Risk Is, and What Managing It Means

Start with the definition, because the exam does.

Risk Exposure to uncertainty about a future outcome that matters. Two conditions must hold: the outcome must be uncertain, and the firm must be exposed to it. An uncertain event you are not exposed to is somebody else's risk; a certain loss you are exposed to is not a risk but a cost.

Notice what the definition does not say. It does not say risk is the possibility of loss. Uncertainty runs in both directions, and a great deal of confusion in practice comes from firms that measure only the downside and then act surprised when the upside fails to arrive either. It also does not say risk is bad. A bank that took no credit risk would hold no loans, earn no spread, and go out of business with an immaculate risk report.

That gives us the distinction the curriculum cares about most.

Halvorsen puts this to her board in a sentence they remember: our job is not to reduce the number on the risk report; it is to make sure the number is right and that we are being paid for it.

1.2 The Toolkit: Quantitative, Qualitative, and Enterprise-Wide

Risk management is not one technique. The curriculum groups the tools into three families, and a common exam trap is treating them as competitors when they are complements.

Quantitative measures attach a number to an exposure. Expected loss, unexpected loss, value at risk, expected shortfall, duration, beta, sensitivity measures — anything that turns a position into a magnitude. They are precise, comparable across desks, and aggregate arithmetically (sometimes — see §1.8). Their weakness is that they can only measure what has been modelled, and they inherit every assumption of the model that produced them.

Qualitative techniques assess risks that resist measurement: a risk-and-control self-assessment, a scenario workshop, an expert panel, a heat map ranking exposures by likelihood and severity. They are the only tools available for genuinely novel risks — a new regulation, a reputational event, a strategic misstep — because there is no history to estimate from. Their weakness is the obvious one: two competent people can rate the same risk differently and neither can be proven wrong.

Enterprise risk management (ERM) is the integrating frame rather than a third measurement technique. It insists that risks be viewed together, at the level of the firm, rather than desk by desk. We return to it properly in Chapter 6; for now hold the idea that a firm can be safe in every division and unsafe overall.

1.3 Expected Loss: The Cost of Doing Business

Halvorsen's first number is the one she can defend most easily.

Expected loss (EL) The mean of the loss distribution — the average loss the firm would suffer per period if this year were repeated many times. It is a forecast of a recurring cost, not a worst case.

For credit exposure it factors into three drivers a candidate must be able to name and multiply:

where $EAD$ is the exposure at default, $PD$ is the probability of default over the horizon, and $LGD$ is the loss given default — the fraction of exposure not recovered.

The keystroke order matters more than it looks. Multiplying the two rates first leaves 0.0081 on the display — the expected loss rate of 81 basis points — which is the number a loan officer actually prices into the spread. Reaching $19.44 million without ever seeing 0.81% means you have the answer but not the intuition, and the exam asks for both.

n_loans, notional = 400, 6.0          # $M
pd, recovery = 0.0180, 0.55
lgd = 1 - recovery

el_loan = notional * pd * lgd
el_book_long = n_loans * el_loan
el_book_short = (n_loans * notional) * pd * lgd

print(f"LGD                    : {lgd:.2%}")
print(f"expected loss rate     : {pd * lgd:.4%}")
print(f"EL, one loan           : ${el_loan:,.4f}M")
print(f"EL, book (400 x loan)  : ${el_book_long:,.2f}M")
print(f"EL, book (EAD x PD x LGD): ${el_book_short:,.2f}M")
# Output:
# LGD                    : 45.00%
# expected loss rate     : 0.8100%
# EL, one loan           : $0.0486M
# EL, book (400 x loan)  : $19.44M
# EL, book (EAD x PD x LGD): $19.44M

Because expected loss is a forecast of a recurring cost, it is handled like one: priced into the loan spread and provisioned for on the income statement. A bank does not hold capital against expected loss any more than an airline holds capital against fuel. It charges for it.

1.4 Unexpected Loss: The Reason Capital Exists

Expected loss is what Ravensmoor budgets for. It is not what threatens the bank. Losses vary around their mean, and in a bad year the book loses far more than $19.44 million.

Unexpected loss (UL) The variation of loss around its expected value — conventionally the standard deviation of the loss distribution. It is the loss the firm did not budget for, and therefore the loss that must be absorbed by capital rather than by pricing.

For a single exposure, with default and recovery both uncertain and independent of one another:

The two terms under the root are the two things that can surprise you. The first is default uncertainty: the borrower either defaults or does not, a Bernoulli outcome with variance $PD(1-PD)$, scaled by the loss you take when it happens. The second is recovery uncertainty: even given default, you do not know what you will recover, and $\sigma_{LGD}$ measures that dispersion.

import numpy as np

notional, pd, lgd, sigma_lgd = 6.0, 0.0180, 0.45, 0.25

default_term = pd * (1 - pd) * lgd ** 2
recovery_term = pd * sigma_lgd ** 2
ul_loan = notional * np.sqrt(default_term + recovery_term)
el_loan = notional * pd * lgd

print(f"default-uncertainty term : {default_term:.8f}")
print(f"recovery-uncertainty term: {recovery_term:.8f}")
print(f"default share of variance: {default_term / (default_term + recovery_term):.1%}")
print(f"UL, one loan             : ${ul_loan:,.5f}M")
print(f"EL, one loan             : ${el_loan:,.5f}M")
print(f"UL / EL                  : {ul_loan / el_loan:.2f}x")
# Output:
# default-uncertainty term : 0.00357939
# recovery-uncertainty term: 0.00112500
# default share of variance: 76.1%
# UL, one loan             : $0.41153M
# EL, one loan             : $0.04860M
# UL / EL                  : 8.47x

1.5 One Book, Three Answers

Halvorsen now has a per-loan unexpected loss of $0.41153 million. The board wants a number for the book. There are three ways to get one, all defensible, and they do not agree.

Route one: add them up. Four hundred loans, each with $0.41153 million of unexpected loss:

$164.61 million — which is exactly what the single-exposure formula returns if you feed it $EAD = 2400$, because the formula is linear in exposure. Adding standalone unexpected losses and treating the book as one giant obligor are the same calculation. And that calculation embeds an assumption: it is only correct if every loan defaults at the same time. Standard deviations add arithmetically only under perfect positive correlation.

Route two: assume independence. If the 400 borrowers default independently, variances add rather than standard deviations, so the portfolio's unexpected loss scales with the square root of the number of loans:

$8.23 million. Twenty times smaller than route one, on the same loans.

Route three: model the correlation. Reality is neither. Borrowers are not independent — they share an economy — but they do not all fail together either. The standard approach makes each borrower's fortunes depend partly on one systematic factor and partly on its own circumstances, with an asset correlation $\rho$ setting the mix. At Ravensmoor's estimate of $\rho = 0.15$, the book's unexpected loss is $23.19 million — and, unlike the capital number below, that one can be done by hand.

The variance of a sum is the sum of every variance plus every covariance. Four hundred loans contribute 400 variances and $400 \times 399$ pairwise covariances, and each covariance is the product of the two loans' loss-given-default amounts and the covariance of their default indicators:

Here $\rho_D$ is the default correlation — the correlation between two borrowers' default indicators — not the asset correlation. Turning an asset correlation of 0.15 into a default correlation needs a bivariate normal probability, which no exam calculator has, so the exam hands you $\rho_D$. For Ravensmoor it is 0.022856 (the callout below explains why it is so much smaller than 0.15).

From unexpected loss to capital

Standard deviation is a summary, not a capital requirement. To set capital, Ravensmoor simulates the whole loss distribution and reads off a high percentile. This is the one number in the chapter that cannot be done by hand: a percentile of a correlated, skewed loss distribution has no calculator formula, and the exam will always give it to you.

The distribution is violently asymmetric. Most years the book loses less than its average — that is what it means for a distribution with a long right tail to have a mean above its median. A few years it loses catastrophically. At the 99.9th percentile the annual loss is $181.19 million, and the distance from expected loss to that point is $161.75 million. That distance is economic capital: the cushion that lets Ravensmoor survive a one-in-a-thousand year.

import numpy as np
from scipy.stats import norm, multivariate_normal

n_loans, notional = 400, 6.0
pd, lgd, sigma_lgd = 0.0180, 0.45, 0.25

ul_loan = notional * np.sqrt(pd * (1 - pd) * lgd ** 2 + pd * sigma_lgd ** 2)
naive_sum = n_loans * ul_loan
independent = np.sqrt(n_loans) * ul_loan

def default_correlation(rho):
    k = norm.ppf(pd)
    joint = multivariate_normal.cdf([k, k], mean=[0, 0], cov=[[1, rho], [rho, 1]])
    return (joint - pd ** 2) / (pd * (1 - pd))

def portfolio_ul(rho):
    cov = notional ** 2 * lgd ** 2 * default_correlation(rho) * pd * (1 - pd)
    return np.sqrt(n_loans * ul_loan ** 2 + n_loans * (n_loans - 1) * cov)

print(f"route 1  perfect correlation : ${naive_sum:,.2f}M")
print(f"route 2  independent         : ${independent:,.2f}M")
print(f"route 3  rho = 0.15          : ${portfolio_ul(0.15):,.2f}M")
print(f"ratio of the extremes        : {naive_sum / independent:.0f}x")
print(f"default correlation at 0.15  : {default_correlation(0.15):.4f}")
# Output:
# route 1  perfect correlation : $164.61M
# route 2  independent         : $8.23M
# route 3  rho = 0.15          : $23.19M
# ratio of the extremes        : 20x
# default correlation at 0.15  : 0.0229

The 200,000-year simulation behind Figure 1.2 — each year draws one systematic factor, 400 borrower shocks and an LGD for every default — returns a standard deviation of $23.09 million against the formula's $23.19 million — agreement to within half a percent, which is what simulation error looks like at this sample size. When a closed form and a simulation agree to that tolerance, you have evidence that both are right; when they disagree by more, one of them has a bug.

1.6 Risk, Reward, and the Conflicts Between Them

Ravensmoor holds this book because it is paid to. The spread on the loans compensates for the 81 basis points of expected loss computed in §1.3, funds the capital held against unexpected loss, and leaves a return for shareholders. That is the risk-reward relationship in its healthy form: more risk is compensated with more expected return, and the compensation is set by the market rather than chosen by the risk taker.

The relationship breaks in a specific and predictable way: when the person taking the risk is not the person bearing it.

1.7 The Classes of Risk

Halvorsen's board report divides Ravensmoor's exposures into eight classes. The exam expects you to define each, say how it arises, and judge its impact.

Market risk — loss from movements in market prices: interest rates, equity prices, exchange rates, commodity prices, and credit spreads. It arises wherever the firm holds a position whose value is marked to a market. Ravensmoor's securities portfolio carries $44.0 million.

Credit risk — loss from a counterparty failing to perform. It arises from lending, but equally from derivative counterparties, settlement exposure and trade receivables. At $161.8 million it is Ravensmoor's dominant exposure, which is typical for a commercial bank and the reason §1.3 to §1.5 spent so long on it.

Liquidity risk — the risk of being unable to meet obligations when due. It has two faces the exam distinguishes carefully: funding liquidity risk (the firm cannot raise cash — depositors leave, wholesale markets close) and market liquidity risk (an asset cannot be sold near its marked value). $22.0 million.

Operational risk — loss from inadequate or failed internal processes, people and systems, or from external events. Fraud, settlement failure, model error, a cyber-attack, a flood. Note that it is defined by cause, not by where the loss lands, which is why operational losses often first appear as credit or market losses. $31.5 million.

Legal and regulatory risk — loss from litigation, unenforceable contracts, regulatory penalties or changes in the rules. $12.5 million.

Business risk — loss from ordinary commercial uncertainty: volumes, margins and costs moving against the firm. It is the risk any company runs. $15.0 million.

Strategic risk — loss from major decisions that turn out badly: an acquisition that fails to integrate, a market entered at the wrong moment. Low frequency, high severity, and essentially unquantifiable in advance, which makes it a qualitative-assessment risk. $9.0 million.

Reputational risk — loss of franchise value when customers, counterparties or staff lose confidence. It is almost always a consequence of another risk crystallising rather than a primary cause. $6.5 million.

1.8 Interaction and Aggregation

Figure 1.3 sums to $302.3 million. Ravensmoor does not hold $302.3 million of capital, and Halvorsen would be criticised if she asked for it. Understanding why is the last building block.

Risk factors interact. The eight classes are not eight independent machines. Consider the sequence that ended several institutions in 2008, which we will meet properly in Chapter 7:

1. Credit losses rise, so the market marks down the bank's assets — credit risk becomes market risk.
2. The mark-down raises doubts about solvency, so short-term lenders decline to roll their funding — market risk becomes funding liquidity risk.
3. The bank sells assets to raise cash, into a market where everyone else is selling, realising losses far below model value — funding liquidity risk becomes market liquidity risk, and the losses feed back into step 1.

Each arrow is a different risk class. The whole sequence is one event. A firm that measured the three risks separately and independently would have found each survivable.

This cuts both ways, and the exam tests the direction. Interaction can make aggregate risk larger than the sum, when one risk triggers another as above. It can also make it smaller than the sum, when the risks are genuinely unrelated: a cyber-attack and a rise in credit spreads have no particular reason to arrive in the same quarter, so their 99.9th percentiles almost certainly do not coincide. Summing them assumes they do.

That is the same mathematics as §1.5, one level up. Adding the eight standalone numbers to get $302.3 million assumes perfect correlation between risk classes, exactly as adding 400 standalone unexpected losses to get $164.61 million assumed perfect correlation between borrowers.

1.9 Putting It All Together

Halvorsen's answer to the board, assembled from the pieces of this chapter.

The problem. How much could the $2,400 million commercial book lose in a year, and what should the bank hold against it?

Why this step: the budgeted loss. Expected loss is a recurring cost, so it is priced and provisioned, not capitalised. From §1.3: $2,400M × 1.80% × 45% = $19.44 million, an expected loss rate of 81 basis points that must appear in the loan spread.

Why this step: the variation around it. Unexpected loss is what capital absorbs. The per-loan figure from §1.4 is $0.41153 million, but the book's figure depends on correlation — and from §1.5 the honest range is $8.23 million to $164.61 million. At Ravensmoor's estimated asset correlation of 0.15, $23.19 million.

Why this step: the capital number. Standard deviation is not a capital requirement. Simulating the book gives a 99.9th-percentile annual loss of $181.19 million, so economic capital — the distance from expected loss to that percentile — is $161.75 million.

Why this step: the firm-wide view. Credit is one of eight classes. Summing all eight standalone numbers gives $302.3 million, which overstates the requirement because it assumes every tail arrives in the same year. The firm-wide number requires the aggregation judgement of §1.8, not addition.

import numpy as np

n_loans, notional = 400, 6.0
pd, lgd, sigma_lgd = 0.0180, 0.45, 0.25
ead = n_loans * notional

el = ead * pd * lgd
ul_loan = notional * np.sqrt(pd * (1 - pd) * lgd ** 2 + pd * sigma_lgd ** 2)
naive_sum, independent = n_loans * ul_loan, np.sqrt(n_loans) * ul_loan
rho_d = 0.022856                     # default correlation at asset correlation 0.15
ul_015 = np.sqrt(n_loans * ul_loan ** 2
                 + n_loans * (n_loans - 1) * (notional * lgd) ** 2 * rho_d * pd * (1 - pd))
q999 = 181.19                         # INPUT: 99.9th percentile of the 200,000-year simulation

standalone_classes = [161.8, 44.0, 31.5, 22.0, 15.0, 12.5, 9.0, 6.5]

print(f"expected loss (priced, provisioned) : ${el:,.2f}M   ({pd * lgd:.2%} of exposure)")
print(f"UL, perfect correlation             : ${naive_sum:,.2f}M")
print(f"UL, independent defaults            : ${independent:,.2f}M")
print(f"UL, rho = 0.15                      : ${ul_015:,.2f}M")
print(f"99.9% loss                          : ${q999:,.2f}M")
print(f"economic capital (99.9% minus EL)   : ${q999 - el:,.2f}M")
print(f"sum of 8 standalone class numbers   : ${sum(standalone_classes):,.1f}M  <- not a capital requirement")
# Output:
# expected loss (priced, provisioned) : $19.44M   (0.81% of exposure)
# UL, perfect correlation             : $164.61M
# UL, independent defaults            : $8.23M
# UL, rho = 0.15                      : $23.19M
# 99.9% loss                          : $181.19M
# economic capital (99.9% minus EL)   : $161.75M
# sum of 8 standalone class numbers   : $302.3M  <- not a capital requirement

The board's instinct was that a bigger number is a more prudent number. The chapter's lesson is the opposite: $164.61 million and $8.23 million describe the same loans, and the difference between them is an assumption, not a margin of safety. Choosing between them is risk management. Adding up whatever numbers are to hand is not.

Chapter Summary

What's Next

Chapter 2 takes the exposures you have just learned to name and measure and asks what Ravensmoor should do about them — accept, avoid, mitigate or transfer — and who inside the firm gets to decide. That is the pairing of risk appetite with risk governance, and it is where the $23.19 million becomes a constraint on the lending business rather than a line in a report.

The loan book itself returns in Chapter 3, where Ravensmoor sells part of it and buys protection on another part, and the expected loss you computed here turns out to be harder to move than it looks.

Concept Checks

Fast recall before the exam-format questions — no calculator needed.

Exam-Style Practice

Standalone four-option questions at the real exam's pace — 2.4 minutes each.

Get the full course: FRM Level I: Foundations of Risk Management