CISI Risk in Financial Services Cheat Sheet

Use the tables for a quick pre-exam check. Expand a topic’s notes for explanations, examples, and additional distinctions.

Scope and study context

1. Identify the risk type from a short scenario.
2. Separate cause, event, impact, control, and owner.
3. Choose the best control or governance response.
4. Interpret risk metrics and formulas without confusing related terms.
5. Recognize common traps: residual vs inherent risk, market vs credit risk, conduct vs compliance risk, liquidity vs solvency, audit vs risk ownership.

Core risk-management workflow

    flowchart LR
	    A[Identify risk] --> B[Assess inherent risk]
	    B --> C[Select response and controls]
	    C --> D[Measure residual risk]
	    D --> E[Monitor KRIs, limits, losses]
	    E --> F[Report and escalate]
	    F --> G[Review appetite, policies, lessons learned]
	    G --> A

Notes and examples

High-Yield Risk Map

Area	What to know quickly	Common exam trap
Risk governance	Board oversight, risk appetite, policies, reporting, escalation, three lines model	Treating risk management as only a compliance or audit function
Risk process	Identify, assess, measure, mitigate, monitor, report, review	Jumping to controls before defining the risk event and cause
Credit risk	Default risk, counterparty risk, settlement risk, concentration, collateral, netting	Confusing issuer credit risk with market price movement
Market risk	Interest rate, FX, equity, commodity, spread, volatility, basis risk	Assuming VaR predicts the maximum possible loss
Liquidity risk	Funding liquidity vs market liquidity, cash flow mismatch, contingency funding	Confusing a solvent firm with a liquid firm
Operational risk	People, process, systems, external events; cyber, fraud, outsourcing, business continuity	Classifying every loss as operational risk without identifying the root cause
Conduct and compliance risk	Fair client treatment, conflicts, suitability, market abuse controls, regulatory obligations	Thinking compliance risk is only about fines, not client and market outcomes
Model and data risk	Assumptions, validation, data quality, limitations, change control	Treating model output as fact rather than a decision input
Capital and stress testing	Capital absorbs unexpected losses; stress tests explore severe but plausible conditions	Confusing expected loss provisions with capital for unexpected loss
Risk culture	Incentives, challenge, escalation, accountability, tone from the top	Believing policies alone create effective risk management

High-yield risk vocabulary

Risk appetite, limits, and escalation

Common distinction: risk appetite is a governance choice; risk limit is an operating control.

Three lines and governance roles

Notes and examples

Governance traps

• Internal audit does not own risk; it provides independent assurance.
• Risk function challenge is not the same as business approval.
• A policy is not a control unless implemented and evidenced.
• Tone from the top matters, but culture also depends on incentives, accountability, escalation, and consequences.
• Conflicts of interest are conduct and governance risks, not merely administrative issues.

Roles and Responsibilities

Function	Main role	What not to confuse
Board / governing body	Sets strategy, approves risk appetite, oversees risk framework	Does not usually run day-to-day controls
Senior management	Implements strategy and risk appetite, owns business risks	Cannot delegate accountability entirely to risk or compliance teams
First line	Business and operational management owning risks and controls	Not merely “sales”; includes control ownership
Second line	Risk, compliance, financial crime, specialist oversight functions	Challenges and advises; does not replace first-line ownership
Third line	Internal audit independent assurance	Tests the framework; does not design or operate routine controls
External audit / regulators	External assurance or supervision where applicable	Not part of daily risk ownership

Risk Appetite, Limits, and Escalation

Concept	Practical interpretation
Appetite statement	“How much and what type of risk are we prepared to take?”
Limit	“What boundary must a desk, portfolio, process, or person stay within?”
Breach	A limit or policy exception requiring action
Escalation	Timely reporting to the right level of authority
Remediation	Action to correct the breach and address root causes

Exam questions often test whether a breach should be ignored because no loss has occurred. The safer answer is usually that breaches matter because they indicate control failure or risk outside agreed boundaries.

Major risk categories

Credit risk quick reference

Notes and examples

Credit-risk scenario clues

Scenario wording	Likely issue	Best response logic
Borrower misses interest payment	Default / credit deterioration	Review rating, provisions, collateral, recovery
Collateral value falls sharply	Higher LGD / margin shortfall	Revalue, call margin, review haircut
Large exposure to one industry	Concentration risk	Set sector limits, diversify, stress test
Derivative counterparty weakens as exposure rises	Wrong-way counterparty risk	Increase collateral, reduce exposure, review limits
Loan documentation unclear	Legal risk within credit exposure	Legal review, documentation remediation

Credit Risk

Credit risk is the risk of loss from a borrower, issuer, or counterparty failing to meet obligations.

Credit Risk Types

Type	Meaning	Example
Default risk	Borrower or issuer fails to pay	Bond issuer misses interest payment
Counterparty credit risk	Trading counterparty defaults before final settlement	Derivatives counterparty fails while contract has positive value
Settlement risk	One party pays or delivers but does not receive the counter-value	Securities or FX settlement failure
Concentration risk	Excessive exposure to one borrower, sector, region, product, or correlated group	Loan book concentrated in commercial property
Country / sovereign risk	Government or country conditions impair repayment or transfer	Capital controls prevent payment
Wrong-way risk	Exposure increases when counterparty credit quality worsens	Counterparty likely to default exactly when exposure is largest

Credit Risk Mitigation

Tool	How it helps	Watch for
Credit analysis	Assesses ability and willingness to repay	Historic data may not capture future stress
Limits	Caps exposure by name, sector, rating, or product	Limits must be monitored and enforced
Collateral	Provides recovery source	Valuation, haircuts, liquidity, legal enforceability
Netting	Reduces gross exposures to net exposure	Depends on legal enforceability
Guarantees	Adds another repayment source	Guarantor credit quality matters
Covenants	Trigger early action if credit quality deteriorates	Weak monitoring reduces value
Diversification	Reduces idiosyncratic risk	Does not eliminate systematic risk

Credit Risk Traps

• A high-quality counterparty can still create settlement or operational risk.
• Collateral reduces loss given default but may not prevent default.
• Diversification helps only when exposures are not highly correlated.
• Credit ratings are inputs, not guarantees.
• A lower probability of default does not always mean a lower expected loss if exposure or loss severity is high.

Market risk quick reference

Notes and examples

Derivatives sensitivity terms

Term	Main meaning	Common trap
Delta	Price sensitivity to underlying	Delta changes for nonlinear instruments
Gamma	Sensitivity of delta to underlying	High gamma means delta hedge changes quickly
Vega	Sensitivity to volatility	Not the same as value-at-risk
Theta	Sensitivity to time decay	Often important for options
Rho	Sensitivity to interest rates	Relevant for options and rates products
Duration	Bond price sensitivity to yield	Longer duration usually means more rate sensitivity
Convexity	Change in duration as yield changes	Improves estimate for large yield moves

Market Risk

Market risk is the risk of loss from movements in market prices or rates.

Main Market Risk Categories

Risk	Driver	Example
Interest rate risk	Changes in yield curves or rates	Bond value falls when yields rise
Equity risk	Share price or index movement	Equity portfolio loses value
FX risk	Exchange rate movement	Foreign currency asset declines in home currency terms
Commodity risk	Commodity price movement	Energy price exposure
Credit spread risk	Change in spread over risk-free rates	Corporate bond spread widens
Volatility risk	Change in expected volatility	Option values move as implied volatility changes
Basis risk	Imperfect relationship between hedge and exposure	Hedge instrument does not move exactly with hedged item

Interest Rate Review

For plain fixed-rate bonds:

• When yields rise, bond prices generally fall.
• When yields fall, bond prices generally rise.
• Longer duration usually means greater price sensitivity.
• Convexity means the price-yield relationship is curved, not linear.

VaR, Stress Testing, and Backtesting

Tool	What it does	Limitation
Value at Risk (VaR)	Estimates potential loss over a time horizon at a confidence level	Does not show worst possible loss beyond the confidence level
Stress test	Measures effect of severe but plausible scenarios	Scenario design may miss real future shocks
Scenario analysis	Explores impact of defined market or business events	Depends on assumptions
Sensitivity analysis	Tests effect of changing one variable	May ignore interactions between variables
Backtesting	Compares model forecasts with actual outcomes	Past performance may not validate future accuracy

Exam trap: if a question says “maximum possible loss,” VaR is usually not the correct description. VaR is a probabilistic estimate under assumptions.

Liquidity risk quick reference

Key distinction: a firm can be solvent but illiquid if assets exceed liabilities but cash is unavailable when needed. A firm can also appear liquid temporarily while being economically weak.

Notes and examples

Liquidity Risk

Liquidity risk is the risk that a firm cannot meet obligations as they fall due, or can do so only at unacceptable cost.

Funding Liquidity vs Market Liquidity

Type	Meaning	Example
Funding liquidity risk	Inability to raise cash or meet payment obligations	Firm cannot roll over short-term funding
Market liquidity risk	Inability to sell or close a position quickly without large price impact	Thinly traded bond must be sold at a deep discount

Key Liquidity Concepts

Concept	Review point
Cash flow mismatch	Timing gap between inflows and outflows
Contingency funding plan	Pre-agreed actions for liquidity stress
Liquid asset buffer	Assets available to generate cash under stress
Haircut	Discount applied to collateral or asset value
Intraday liquidity	Ability to meet obligations during the business day
Encumbered assets	Assets already pledged and not freely available
Liquidity stress	Sudden withdrawals, margin calls, market closure, funding freeze

A firm may be solvent on a balance-sheet basis but illiquid if it cannot generate cash quickly enough.

Operational risk and resilience

Notes and examples

Business continuity and incident terms

Term	Meaning	Exam trap
BCP	Business continuity plan to maintain critical operations	Broader than IT recovery
DR	Disaster recovery, usually technology recovery	Part of resilience, not the whole plan
RTO	Recovery time objective: target time to restore	Time measure
RPO	Recovery point objective: acceptable data loss point	Data-loss measure
Crisis management	Strategic response and communications	Includes clients, regulators, staff, media
Incident management	Detect, contain, recover, learn	Should include root-cause analysis
Resilience	Ability to prevent, adapt, respond, recover, learn	Not just backup systems

Operational Risk

Operational risk arises from inadequate or failed internal processes, people, systems, or external events.

Operational Risk Sources

Source	Examples
People	Error, fraud, inadequate training, misconduct
Process	Poor procedures, failed reconciliations, weak approvals
Systems	Outage, cyber incident, data corruption, failed interface
External events	Natural disaster, supplier failure, terrorism, pandemic disruption

Operational Risk Tools

Tool	Purpose
Risk and control self-assessment	Identifies key risks and evaluates controls
Loss event database	Records incidents and near misses
Key risk indicators	Monitors emerging risk trends
Scenario analysis	Tests severe operational events
Business continuity planning	Maintains critical services during disruption
Disaster recovery	Restores systems and data
Outsourcing oversight	Manages third-party service risks
Cyber controls	Protect confidentiality, integrity, and availability

Operational Risk Traps

• A trading loss caused by market movement is market risk; a trading loss caused by booking error may be operational risk.
• Outsourcing does not remove accountability for the activity.
• A near miss matters because it may reveal control weakness.
• Insurance may reduce financial impact but not reputational, client, regulatory, or continuity consequences.

Conduct, compliance, and financial crime

Capital, prudential risk, and Basel-style concepts

Key formulas and calculation reminders

Expected credit loss

\[ \text{Expected loss} = \text{PD} \times \text{LGD} \times \text{EAD} \]

Use this for average expected credit loss. Do not confuse expected loss with worst-case loss or capital for unexpected loss.

Risk score

\[ \text{Risk score} = \text{Likelihood} \times \text{Impact} \]

Risk matrices are simple prioritization tools. They are not precise measurement models.

Capital ratio

\[ \text{Capital ratio} = \frac{\text{Eligible regulatory capital}}{\text{Risk-weighted assets}} \]

Higher capital supports loss absorption. Do not assume a specific required percentage unless it is provided in the question or study material.

RAROC

\[ \text{RAROC} = \frac{\text{Risk-adjusted return}}{\text{Economic capital}} \]

RAROC helps compare business returns after considering the risk capital consumed.

Parametric VaR approximation

\[ \text{VaR} \approx z_c \times \sigma \times V \times \sqrt{t} \]

Where \(z_c\) is the confidence-level factor, \(\sigma\) is volatility, \(V\) is portfolio value, and \(t\) is the time horizon. Watch sign conventions: VaR is normally expressed as a positive loss amount.

Bond price sensitivity

\[ \Delta P \approx -D_{\text{mod}} \times P \times \Delta y \]

A rise in yield usually reduces a fixed-rate bond price. Longer modified duration means greater sensitivity.

PV01 / DV01 approximation

\[ \text{PV01} \approx D_{\text{mod}} \times P \times 0.0001 \]

PV01 estimates the price change for a one basis point yield move.

VaR, stress testing, and scenarios

Notes and examples

VaR traps

• A 99% VaR is not the maximum possible loss.
• VaR depends on horizon, confidence level, data, model, and assumptions.
• Diversification benefits may disappear when correlations rise in stress.
• VaR may understate illiquid positions, basis risk, jump risk, and model risk.
• Backtesting exceptions do not automatically prove fraud or misconduct; they may indicate model weakness, volatility change, or data issues.

Controls and assurance

Notes and examples

Control effectiveness

Assessment	Question to ask	Evidence
Design effectiveness	Would the control address the risk if performed correctly?	Policy, process map, control description
Operating effectiveness	Did the control operate as intended over time?	Samples, logs, approvals, reconciliations
Coverage	Does it cover all relevant products/entities/processes?	Scope, population testing
Timeliness	Is the control performed soon enough?	Timestamps, escalation records
Independence	Is review performed by someone sufficiently independent?	Role segregation, reporting lines

Risk responses

Reporting and escalation

Good risk reporting is accurate, timely, relevant, escalated, and action-oriented.

Scenario decision table

Common exam traps checklist

• Do not choose insurance as eliminating operational risk; it only transfers some financial impact.
• Do not call every regulatory issue conduct risk; conduct focuses on customer/market outcomes, compliance on rule adherence.
• Do not call every price movement credit risk; market risk can occur without default.
• Do not treat collateral as risk-free; value, enforceability, liquidity, and concentration matter.
• Do not confuse funding liquidity with market liquidity.
• Do not confuse risk appetite with risk capacity or limits.
• Do not assume diversification removes systemic risk.
• Do not assume outsourcing transfers accountability away from the firm.
• Do not treat VaR as a worst-case loss.
• Do not let a strong KPI hide a worsening KRI.
• Do not confuse root cause remediation with temporary workaround.
• Do not select internal audit as the owner of first-line controls.
• Do not assume high capital fixes poor culture, conduct, or operational control weaknesses.
• Do not ignore correlation and concentration in stress scenarios.
• Do not overlook reputational impact as a secondary consequence.

Fast revision drill

For any practice question, answer in this order:

1. Risk type: credit, market, liquidity, operational, conduct, compliance, model, strategic, reputational, financial crime, or legal.
2. Risk driver: people, process, system, market factor, counterparty, behavior, governance, external event.
3. Exposure metric: PD/LGD/EAD, VaR, duration, cash-flow gap, KRI, loss data, breach count, complaints.
4. Control: preventive, detective, corrective, or governance response.
5. Owner: first line owns; second line challenges; third line assures.
6. Escalation: compare with appetite/limit, report breach, remediate root cause.
7. Residual risk: decide whether remaining risk is acceptable.

Cheat Sheet for CISI Risk in Financial Services

This Cheat Sheet is an independent companion for candidates preparing for the Chartered Institute for Securities & Investment CISI Risk in Financial Services exam, official code CISI Risk. Use it to refresh high-yield concepts before moving into topic drills, mock exams, original practice questions, and detailed explanations.

The exam rewards candidates who can connect risk definitions to practical decisions: identifying the source of risk, choosing an appropriate control, understanding governance responsibilities, and recognising the limitations of measurement tools.

Core Risk Language

Essential Definitions

Notes and examples

Expected Loss and Unexpected Loss

Credit risk often uses the expected loss relationship:

\[ \text{Expected Loss} = \text{PD} \times \text{LGD} \times \text{EAD} \]

Where:

• PD = probability of default.
• LGD = loss given default.
• EAD = exposure at default.

Expected loss is the average loss anticipated over a period. Unexpected loss is the adverse variation around that expectation and is a key reason firms hold capital.

Risk Management Framework

A strong framework does not eliminate risk. It makes risk visible, owned, measured, controlled, and escalated.

    flowchart LR
	    A[Identify risks] --> B[Assess likelihood and impact]
	    B --> C[Measure exposure]
	    C --> D[Choose response]
	    D --> E[Implement controls]
	    E --> F[Monitor indicators and limits]
	    F --> G[Report and escalate]
	    G --> H[Review and improve]
	    H --> A

The Risk Response Decision

A common exam mistake is to choose a risk transfer answer as if it removes the risk completely. Transfer normally changes the risk profile; it may introduce counterparty, legal, basis, or operational risk.

Controls: Fast Classification

Control Quality Checklist

A good control is:

1. Linked to a specific risk and cause.
2. Owned by a named person or team.
3. Performed at the right frequency.
4. Evidenced and auditable.
5. Escalated when exceptions occur.
6. Reviewed when business activity changes.

Conduct, Compliance, Legal, and Reputational Risk

Distinguish the Concepts

Notes and examples

Conduct risk can exist even where a narrow rule breach is not obvious. Look for fairness, transparency, conflicts of interest, suitability, market abuse prevention, and client outcomes.

Conflicts of Interest

Common controls include:

• Disclosure where appropriate.
• Avoidance where the conflict cannot be managed.
• Information barriers.
• Independent review.
• Personal account dealing rules.
• Gifts and entertainment controls.
• Fair allocation policies.

Exam questions often include a tempting answer of “disclose and continue.” Disclosure alone is not always enough if the conflict remains unmanaged.

Model Risk and Data Risk

Model risk is the risk of loss or poor decision-making from incorrect, misused, or poorly governed models.

Model output should support judgment, not replace it. A precise number can still be wrong if assumptions are unrealistic.

Capital, Solvency, and Prudential Thinking

Capital protects a firm and its stakeholders by absorbing losses. Risk management connects business activity to the amount and quality of capital needed.

Do not confuse:

• Provisions for expected losses with capital for unexpected losses.
• Liquidity with solvency.
• Accounting value with realisable value under stress.

Enterprise-Wide Risk and Aggregation

Risks interact. A strong answer recognises second-order effects.

Correlation and concentration matter. Risks that look diversified in normal conditions may become highly correlated in stress.

Common Decision Rules

When Asked “What Is the Best Control?”

Choose the control that directly addresses the cause of the risk.

Notes and examples

When Asked “Who Is Responsible?”

If the issue is…	Likely responsibility
Day-to-day risk taking and controls	First line
Policy, oversight, challenge, compliance monitoring	Second line
Independent assurance over the framework	Third line / internal audit
Risk appetite and oversight	Board / governing body
Implementation of appetite and controls	Senior management

When Asked “What Should Happen After a Breach?”

A practical sequence is:

1. Stop or contain the issue where necessary.
2. Escalate promptly.
3. Assess impact.
4. Identify root cause.
5. Remediate the immediate breach.
6. Strengthen controls to prevent recurrence.
7. Record evidence and monitor completion.

Common Candidate Mistakes

Rapid Review Tables by Risk Type

Risk Type, Signal, and Control

Notes and examples

Measurement Tools

Tool	Best for	Weakness
Heat map	Prioritising risks by likelihood and impact	Can be subjective
Limits	Day-to-day control	Must be calibrated and enforced
KRIs	Early warning	Poor indicators create false comfort
Stress tests	Severe scenario analysis	Scenario selection is judgmental
Loss data	Learning from incidents	Past losses may understate future exposure
RCSA	Business-led risk assessment	Can become a checklist exercise
Audit testing	Independent assurance	Periodic, not continuous
Dashboards	Management oversight	Can hide detail if poorly designed

Practice Strategy for CISI Risk

Use this Cheat Sheet first, then move into independent companion practice. The fastest improvement usually comes from alternating short review with original practice questions and detailed explanations.

Suggested Practice Sequence

1. Definitions drill Practise appetite, tolerance, inherent risk, residual risk, KRI, operational risk, credit risk, market risk, and liquidity risk.

2. Risk classification drill For each scenario, identify the primary risk and any secondary risks.

3. Control selection drill Match risk causes to preventive, detective, corrective, and compensating controls.

4. Governance drill Decide whether the issue belongs mainly to the first line, second line, third line, senior management, or board oversight.

5. Scenario mixed practice Use question bank sets that combine risk types, escalation, controls, and measurement limitations.

6. Mock exam practice Sit timed mock exams only after you can explain why wrong answers are wrong.

What to Review After Each Question

For every missed question, write one line for each:

• What risk type was being tested?
• What clue in the wording mattered?
• Which answer was tempting but wrong?
• What rule would help next time?

Final Exam-Readiness Checklist

Before attempting a full mock exam, make sure you can:

• Explain risk appetite, tolerance, limits, inherent risk, and residual risk.
• Distinguish credit, market, liquidity, operational, conduct, compliance, legal, and reputational risk.
• Apply the three lines model to practical scenarios.
• Choose controls based on the cause of the risk.
• Recognise the limits of VaR, stress testing, ratings, models, and collateral.
• Explain why outsourcing, insurance, hedging, and collateral reduce but do not eliminate risk.
• Identify when escalation is required.
• Connect risk events to second-order impacts.
• Learn from detailed explanations, not just answer keys.

Use this Cheat Sheet as your final concept check, then move into topic drills, original practice questions, and timed question bank practice with detailed explanations to convert recognition into exam-ready judgment.

Put the review into practice