CISI Risk in Financial Services Quick Review

Quick Review for CISI Risk in Financial Services

This Quick Review is an independent companion for candidates preparing for the Chartered Institute for Securities & Investment CISI Risk in Financial Services exam, official code CISI Risk. Use it to refresh high-yield concepts before moving into topic drills, mock exams, original practice questions, and detailed explanations.

The exam rewards candidates who can connect risk definitions to practical decisions: identifying the source of risk, choosing an appropriate control, understanding governance responsibilities, and recognising the limitations of measurement tools.

High-Yield Risk Map

Core Risk Language

Essential Definitions

Expected Loss and Unexpected Loss

Credit risk often uses the expected loss relationship:

\[ \text{Expected Loss} = \text{PD} \times \text{LGD} \times \text{EAD} \]

Where:

• PD = probability of default.
• LGD = loss given default.
• EAD = exposure at default.

Expected loss is the average loss anticipated over a period. Unexpected loss is the adverse variation around that expectation and is a key reason firms hold capital.

Risk Management Framework

A strong framework does not eliminate risk. It makes risk visible, owned, measured, controlled, and escalated.

    flowchart LR
	    A[Identify risks] --> B[Assess likelihood and impact]
	    B --> C[Measure exposure]
	    C --> D[Choose response]
	    D --> E[Implement controls]
	    E --> F[Monitor indicators and limits]
	    F --> G[Report and escalate]
	    G --> H[Review and improve]
	    H --> A

The Risk Response Decision

A common exam mistake is to choose a risk transfer answer as if it removes the risk completely. Transfer normally changes the risk profile; it may introduce counterparty, legal, basis, or operational risk.

Governance and the Three Lines Model

Roles and Responsibilities

Risk Appetite, Limits, and Escalation

Exam questions often test whether a breach should be ignored because no loss has occurred. The safer answer is usually that breaches matter because they indicate control failure or risk outside agreed boundaries.

Controls: Fast Classification

Control Quality Checklist

A good control is:

1. Linked to a specific risk and cause.
2. Owned by a named person or team.
3. Performed at the right frequency.
4. Evidenced and auditable.
5. Escalated when exceptions occur.
6. Reviewed when business activity changes.

Credit Risk

Credit risk is the risk of loss from a borrower, issuer, or counterparty failing to meet obligations.

Credit Risk Types

Credit Risk Mitigation

Credit Risk Traps

• A high-quality counterparty can still create settlement or operational risk.
• Collateral reduces loss given default but may not prevent default.
• Diversification helps only when exposures are not highly correlated.
• Credit ratings are inputs, not guarantees.
• A lower probability of default does not always mean a lower expected loss if exposure or loss severity is high.

Market Risk

Market risk is the risk of loss from movements in market prices or rates.

Main Market Risk Categories

Interest Rate Review

For plain fixed-rate bonds:

• When yields rise, bond prices generally fall.
• When yields fall, bond prices generally rise.
• Longer duration usually means greater price sensitivity.
• Convexity means the price-yield relationship is curved, not linear.

VaR, Stress Testing, and Backtesting

Exam trap: if a question says “maximum possible loss,” VaR is usually not the correct description. VaR is a probabilistic estimate under assumptions.

Liquidity Risk

Liquidity risk is the risk that a firm cannot meet obligations as they fall due, or can do so only at unacceptable cost.

Funding Liquidity vs Market Liquidity

Key Liquidity Concepts

A firm may be solvent on a balance-sheet basis but illiquid if it cannot generate cash quickly enough.

Operational Risk

Operational risk arises from inadequate or failed internal processes, people, systems, or external events.

Operational Risk Sources

Operational Risk Tools

Operational Risk Traps

• A trading loss caused by market movement is market risk; a trading loss caused by booking error may be operational risk.
• Outsourcing does not remove accountability for the activity.
• A near miss matters because it may reveal control weakness.
• Insurance may reduce financial impact but not reputational, client, regulatory, or continuity consequences.

Conduct, Compliance, Legal, and Reputational Risk

Distinguish the Concepts

Conduct risk can exist even where a narrow rule breach is not obvious. Look for fairness, transparency, conflicts of interest, suitability, market abuse prevention, and client outcomes.

Conflicts of Interest

Common controls include:

• Disclosure where appropriate.
• Avoidance where the conflict cannot be managed.
• Information barriers.
• Independent review.
• Personal account dealing rules.
• Gifts and entertainment controls.
• Fair allocation policies.

Exam questions often include a tempting answer of “disclose and continue.” Disclosure alone is not always enough if the conflict remains unmanaged.

Model Risk and Data Risk

Model risk is the risk of loss or poor decision-making from incorrect, misused, or poorly governed models.

Model output should support judgment, not replace it. A precise number can still be wrong if assumptions are unrealistic.

Capital, Solvency, and Prudential Thinking

Capital protects a firm and its stakeholders by absorbing losses. Risk management connects business activity to the amount and quality of capital needed.

Do not confuse:

• Provisions for expected losses with capital for unexpected losses.
• Liquidity with solvency.
• Accounting value with realisable value under stress.

Enterprise-Wide Risk and Aggregation

Risks interact. A strong answer recognises second-order effects.

Correlation and concentration matter. Risks that look diversified in normal conditions may become highly correlated in stress.

Common Decision Rules

When Asked “What Is the Best Control?”

Choose the control that directly addresses the cause of the risk.

When Asked “Who Is Responsible?”

When Asked “What Should Happen After a Breach?”

A practical sequence is:

1. Stop or contain the issue where necessary.
2. Escalate promptly.
3. Assess impact.
4. Identify root cause.
5. Remediate the immediate breach.
6. Strengthen controls to prevent recurrence.
7. Record evidence and monitor completion.

Common Candidate Mistakes

Rapid Review Tables by Risk Type

Risk Type, Signal, and Control

Measurement Tools

Practice Strategy for CISI Risk

Use this Quick Review first, then move into independent companion practice. The fastest improvement usually comes from alternating short review with original practice questions and detailed explanations.

Suggested Practice Sequence

1. Definitions drill Practise appetite, tolerance, inherent risk, residual risk, KRI, operational risk, credit risk, market risk, and liquidity risk.

2. Risk classification drill For each scenario, identify the primary risk and any secondary risks.

3. Control selection drill Match risk causes to preventive, detective, corrective, and compensating controls.

4. Governance drill Decide whether the issue belongs mainly to the first line, second line, third line, senior management, or board oversight.

5. Scenario mixed practice Use question bank sets that combine risk types, escalation, controls, and measurement limitations.

6. Mock exam practice Sit timed mock exams only after you can explain why wrong answers are wrong.

What to Review After Each Question

For every missed question, write one line for each:

• What risk type was being tested?
• What clue in the wording mattered?
• Which answer was tempting but wrong?
• What rule would help next time?

Final Exam-Readiness Checklist

Before attempting a full mock exam, make sure you can:

• Explain risk appetite, tolerance, limits, inherent risk, and residual risk.
• Distinguish credit, market, liquidity, operational, conduct, compliance, legal, and reputational risk.
• Apply the three lines model to practical scenarios.
• Choose controls based on the cause of the risk.
• Recognise the limits of VaR, stress testing, ratings, models, and collateral.
• Explain why outsourcing, insurance, hedging, and collateral reduce but do not eliminate risk.
• Identify when escalation is required.
• Connect risk events to second-order impacts.
• Learn from detailed explanations, not just answer keys.

Use this Quick Review as your final concept check, then move into topic drills, original practice questions, and timed question bank practice with detailed explanations to convert recognition into exam-ready judgment.