CISI Risk in Financial Services Quick Review

How to Use This Quick Review

This page is an independent review aid for candidates preparing for the Chartered Institute for Securities & Investment exam CISI Risk in Financial Services, exam code CISI Risk. Use it to refresh high-yield risk concepts before moving into topic drills, mock exams, and detailed explanations.

A good final-review sequence:

1. Scan the risk map to identify weak areas.
2. Review the decision rules for risk identification, measurement, control, and reporting.
3. Practise with original practice questions by topic.
4. Read detailed explanations, especially for questions you got right by guessing.
5. Return to this page to tighten definitions, comparisons, and common traps.

High-Yield Risk Map

Core Definitions Candidates Must Separate

Risk Management Lifecycle

Use this sequence to answer scenario questions. The exam often tests whether you can choose the next best action, not just define the risk.

Practical Decision Rule

When a question asks what a firm should do first, prefer the option that:

1. Identifies or understands the risk accurately.
2. Protects clients, market integrity, or critical operations.
3. Escalates material breaches through governance channels.
4. Avoids hiding, delaying, or informally bypassing controls.

Governance and the Three Lines Model

Governance Checklist

High-quality risk governance usually includes:

• Clear board and committee responsibilities.
• Documented risk appetite and limits.
• Independent challenge.
• Timely management information.
• Escalation for breaches and near misses.
• Fit between incentives and desired conduct.
• Evidence that issues are tracked to completion.

Common Governance Mistakes

• Treating risk management as a compliance formality.
• Assuming a policy is effective without testing controls.
• Rewarding revenue while ignoring risk-adjusted performance.
• Escalating only realised losses, not near misses or limit breaches.
• Failing to update risk assessments after business change.

Risk Appetite, Limits, and Escalation

Decision Rule: Limit Breach

If a scenario describes a limit breach, the best response is usually:

1. Confirm facts and materiality.
2. Escalate according to policy.
3. Reduce or remediate the exposure if required.
4. Document cause and action taken.
5. Review whether the limit, control, or behaviour needs change.

Avoid answers that simply “wait until month-end reporting” or “offset later without notification” when escalation is required.

Market Risk Quick Review

Market risk is the risk of loss from adverse changes in market variables, including interest rates, equity prices, credit spreads, foreign exchange rates, commodity prices, volatility, and correlations.

Bond Price and Yield Relationship

For plain fixed-rate bonds:

• Yields rise → bond prices usually fall.
• Yields fall → bond prices usually rise.
• Longer duration → greater price sensitivity.
• Lower coupon → generally higher duration.
• Convexity improves the estimate for larger yield moves.

Approximate duration relationship:

\[ \frac{\Delta P}{P} \approx -D_{\text{mod}} \times \Delta y \]

Where \(D_{\text{mod}}\) is modified duration and \(\Delta y\) is the change in yield.

Value at Risk

Value at Risk (VaR) estimates the potential loss over a time horizon at a stated confidence level under model assumptions.

Example interpretation:
A one-day 99% VaR of £1 million means the model estimates a 1% chance of losing more than £1 million over one day, assuming the model and data are appropriate.

Market Risk Traps

• VaR is not the maximum possible loss.
• A hedge can reduce one risk while introducing basis, liquidity, counterparty, or operational risk.
• Diversification depends on correlations, which may rise during market stress.
• Stop-loss limits control realised or triggered losses but do not prevent gap risk.
• Models should be supported by stress testing and scenario analysis.

Credit Risk Quick Review

Credit risk is the risk that a counterparty, borrower, issuer, or obligor fails to meet obligations in full and on time.

Core expected loss formula:

\[ \text{Expected Loss (EL)} = PD \times LGD \times EAD \]

Where:

• \(PD\) = probability of default.
• \(LGD\) = loss given default.
• \(EAD\) = exposure at default.

Credit Risk Mitigation

Credit Risk Decision Rules

• If credit quality deteriorates, review exposure, collateral, limits, and provisioning/impairment indicators.
• If collateral value falls, exposure may increase even if the borrower has not defaulted.
• If exposures are netted, check whether netting is legally enforceable.
• If a counterparty is highly correlated with the exposure, consider wrong-way risk.
• A high credit rating reduces perceived default likelihood but does not eliminate risk.

Liquidity Risk Quick Review

Liquidity risk is the risk that a firm cannot meet obligations when due, or can do so only at excessive cost.

Liquidity Management Tools

• Cash-flow forecasting.
• Maturity mismatch analysis.
• Liquid asset buffers.
• Diversified funding sources.
• Contingency funding plans.
• Stress testing.
• Collateral and margin monitoring.
• Early warning indicators.

Liquidity Traps

• A solvent firm can still fail from liquidity pressure.
• Market liquidity can disappear when many firms try to sell the same assets.
• Short-term wholesale funding can be fragile.
• Collateralised positions can create liquidity strain through margin calls.
• Liquidity risk often interacts with market, credit, and reputational risk.

Operational Risk Quick Review

Operational risk arises from inadequate or failed internal processes, people, systems, or external events.

Control Types

Operational Risk Assessment Tools

Operational Risk Traps

• A process with no recent losses is not automatically low risk.
• Manual workarounds increase error and key-person risk.
• Outsourcing transfers activity, not accountability.
• Insurance may reduce financial impact but does not remove operational failure.
• Cyber risk is not only an IT issue; it includes governance, people, suppliers, and response.

Conduct, Compliance, and Reputational Risk

Conduct Risk Indicators

• High complaints or repeated complaint themes.
• Products sold outside target market.
• Incentives linked only to volume or revenue.
• Poor disclosure or confusing communications.
• Conflicts of interest not identified or managed.
• Vulnerable clients not treated appropriately.
• Weak post-sale monitoring.

Decision Rule: Client or Market Harm

If a scenario involves possible client harm, market abuse, mis-selling, conflicts, or misleading information, choose the response that prioritises:

1. Fair treatment and transparency.
2. Escalation to the correct control function.
3. Remediation where harm occurred.
4. Prevention of recurrence.
5. Documentation and management accountability.

Financial Crime and Fraud Risk

Financial services firms must manage exposure to criminal misuse and dishonest activity. For exam review, focus on risk-based thinking rather than memorising isolated procedures.

Trap

A risk-based approach does not mean ignoring low-risk clients or transactions. It means proportionate controls, monitoring, and escalation based on assessed risk.

Capital, Prudential Risk, and Resilience

Capital and prudential risk concepts appear across financial services because firms need enough financial resources to absorb losses and continue operating.

Capital and Risk Traps

• Capital is a buffer, not a substitute for controls.
• More capital does not eliminate liquidity risk.
• A low-risk-weighted exposure can still create concentration or operational risk.
• Stress testing is useful because normal models may fail in abnormal conditions.

Stress Testing and Scenario Analysis

Stress Testing Decision Rules

• Use severe but plausible scenarios.
• Include second-order effects, such as margin calls, rating downgrades, client withdrawals, or market illiquidity.
• Challenge assumptions, especially correlations and liquidity.
• Link results to actions: limits, capital, funding, controls, or contingency plans.
• Do not treat stress testing as a one-off exercise.

Model Risk

Model risk is the risk of loss, poor decisions, or misreporting from incorrect, inappropriate, or misused models.

Good Model Governance

• Clear model owner.
• Documented purpose and limitations.
• Independent validation.
• Data quality controls.
• Change control.
• Ongoing performance monitoring.
• User understanding of outputs.
• Escalation when model performance deteriorates.

Trap

A sophisticated model can still be wrong. In exam scenarios, prefer answers that combine model output with expert challenge, validation, stress testing, and governance.

Outsourcing and Third-Party Risk

Outsourcing can improve efficiency but creates dependency on external providers.

Key Trap

Outsourcing an activity does not outsource the firm’s responsibility for managing the risk.

Cyber and Technology Risk

Common Cyber Controls

• Multi-factor authentication.
• Least-privilege access.
• Patch management.
• Network monitoring.
• Data encryption.
• Backup and recovery testing.
• Security awareness training.
• Vendor security due diligence.
• Incident response playbooks.

Derivatives and Risk Transfer

Derivatives can hedge, speculate, transform exposures, or create leverage.

Hedging Traps

• A hedge reduces a specified exposure; it may introduce new risks.
• Perfect hedges are rare.
• Hedge accounting and economic hedging are not the same thing.
• Closing or rebalancing a hedge can create liquidity and operational risk.
• OTC derivatives add counterparty and collateral-management risk.

Settlement, Custody, and Asset Servicing Risk

Trap

A settlement issue may create credit, liquidity, operational, legal, and reputational risk at the same time.

Risk Reporting and Management Information

Good risk reporting should be clear, timely, accurate, relevant, and actionable.

Weak Reporting Signals

• Too much data and no prioritisation.
• No comparison with appetite or limits.
• No trend or root-cause analysis.
• Breaches reported without action owners.
• Management information not tailored to the audience.
• Manual spreadsheet dependency without control.

Risk Culture and Behaviour

Culture is tested through behaviour, incentives, and decisions under pressure.

Exam Trap

A firm may have policies, committees, and reports but still have poor risk culture if behaviours, incentives, and accountability are weak.

Common Scenario Question Patterns

“What Is the Main Risk?”

Identify the immediate source of loss or failure.

“Best Control?”

Match the control to the cause.

“Best Next Step?”

Key Formula and Quantitative Concepts

You do not need to turn every risk question into a calculation. But these concepts are useful for interpreting quantitative wording.

Expected Loss

\[ \text{Expected Loss} = PD \times LGD \times EAD \]

• Higher probability of default increases expected loss.
• Higher loss given default increases expected loss.
• Higher exposure at default increases expected loss.
• Collateral usually reduces LGD, not PD.

Duration Approximation

\[ \frac{\Delta P}{P} \approx -D_{\text{mod}} \times \Delta y \]

• Price and yield move in opposite directions.
• Longer duration means higher sensitivity.
• Approximation is less accurate for large yield moves unless convexity is considered.

Risk-Adjusted Thinking

A high return is not automatically attractive. Ask:

• What risks were taken to earn it?
• Is the return sustainable?
• Is capital usage appropriate?
• Are tail risks hidden?
• Are risks within appetite and limits?

Quick Comparison Tables

Risk Reduction Choices

Diversification vs Hedging

Audit, Compliance, and Risk

Common Candidate Mistakes

• Memorising definitions without applying them to scenarios.
• Confusing credit risk with market risk when a bond falls because spreads or yields move.
• Treating VaR as a worst-case loss.
• Assuming outsourcing transfers responsibility.
• Forgetting that liquidity risk can affect solvent firms.
• Confusing risk appetite with a specific trading limit.
• Choosing “write a policy” when the scenario requires escalation or remediation.
• Assuming a control is effective because it exists.
• Ignoring secondary risks created by hedges, insurance, or collateral.
• Overlooking conduct risk when questions mention incentives, disclosure, conflicts, or client outcomes.

Final 30-Minute Review Plan

Use this if you are close to practice mode or final revision.

How to Turn This Review into Question-Bank Practice

After reviewing the quick review, move into independent companion practice:

1. Start with topic drills on your weakest risk categories.
2. Use original practice questions to test scenario judgement, not just memory.
3. Review detailed explanations for every missed question.
4. Track whether mistakes are caused by definitions, calculations, or decision rules.
5. Finish with mixed-question sets so you can identify the risk type without prompts.

Practical next step: choose one weak area from this page, complete a focused question bank drill on that topic, and read the explanations until you can explain why each wrong option is wrong.