Financial risk management

Categories of
Financial risk
Credit risk
Settlement risk Concentration risk Sovereign risk Default risk
Market risk
Interest rate risk Inflation risk Currency risk Equity risk Commodity risk Volatility risk Systemic risk
Liquidity risk
Refinancing risk Deposit risk Margining risk
Investment risk
Model risk Execution risk Valuation risk
Business risk
Reputational risk Operational risk Country risk Political risk Legal risk Moral hazard
Profit risk
Non-financial risk
Stranded asset
v t e

Institutions American Risk and Insurance Association Association of Insurance and Risk Managers in Industry and Commerce Global Association of Risk Professionals Global Risk Institute Institute of Risk Management Professional Risk Managers' International Association Risk and Insurance Management Society Certifications Certificate in Quantitative Finance (CQF) Certified Risk Analyst (CRA) Certified Risk Management Professional (RIMS-CRMP) Certified Risk Professional (MIRM designation) Chartered Enterprise Risk Analyst (CERA; Society of Actuaries ) Chartered Enterprise Risk Actuary (CERA; Institute and Faculty of Actuaries ) Financial Risk Manager (FRM) Professional Risk Manager (PRM)

Financial risk management is the practice of protecting economic value in a firm by managing exposure to financial risk - principally credit risk and market risk, with more specific variants as listed aside - as well as some aspects of operational risk. As for risk management more generally, financial risk management requires identifying the sources of risk, measuring these, and crafting plans to mitigate them.^[1][2] See Finance § Risk management for an overview.

Financial risk management as a "science" can be said to have been born^[3] with modern portfolio theory, particularly as initiated by Professor Harry Markowitz in 1952 with his article, "Portfolio Selection";^[4] see Mathematical finance § Risk and portfolio management: the P world.

The discipline can be qualitative and quantitative; as a specialization of risk management, however, financial risk management focuses more on when and how to hedge,^[5] often using financial instruments to manage costly exposures to risk.^[6]

• In the banking sector worldwide, the Basel Accords are generally adopted by internationally active banks for tracking, reporting and exposing operational, credit and market risks.^[7][8]
• Within non-financial corporates,^[9][10] the scope is broadened to overlap enterprise risk management, and financial risk management then addresses risks to the firm's overall strategic objectives.
• In investment management^[11] risk is managed through diversification and related optimization; while further specific techniques are then applied to the portfolio or to individual stocks as appropriate.

In all cases, the last "

Economic perspective

Neoclassical finance theory prescribes that (1) a firm should take on a project only if it increases shareholder value.^[13] Further, the theory suggests that (2) firm managers cannot create value for shareholders or investors by taking on projects that shareholders could do for themselves at the same cost; see Theory of the firm and Fisher separation theorem.

Given these, there is therefore a fundamental debate relating to "Risk Management" and shareholder value.^[5][14][15] The discussion essentially weighs the value of risk management in a market versus the cost of bankruptcy in that market: per the Modigliani and Miller framework, hedging is irrelevant since diversified shareholders are assumed to not care about firm-specific risks, whereas, on the other hand hedging is seen to create value in that it reduces the probability of financial distress.

When applied to financial risk management, this implies that firm managers should not hedge risks that investors can hedge for themselves at the same cost.

of bearing it outside of the firm."

In practice, however, financial markets are not likely to be perfect markets.[17]^[18][19][20] This suggests that firm managers likely have many opportunities to create value for shareholders using financial risk management, wherein they are able to determine which risks are cheaper for the firm to manage than for shareholders. Here, market risks that result in unique risks for the firm are commonly the best candidates for financial risk management.^[21]

As outlined, businesses are exposed, in the main, to market, credit and operational risk. A broad distinction^[12] exists though, between financial institutions and non-financial firms - and correspondingly, the application of risk management will differ. Respectively:^[12] For Banks and Fund Managers, "credit and market risks are taken intentionally with the objective of earning returns, while operational risks are a

to be controlled". For non-financial firms, the priorities are reversed, as "the focus is on the risks associated with the business" - ie the production and marketing of the services and products in which expertise is held - and their impact on revenue, costs and cash flow, "while market and credit risks are usually of secondary importance as they are a byproduct of the main business agenda". (See related discussion re valuing financial services firms as compared to other firms.) In all cases, as above, risk capital is the last "".

in conducting their business, and how well these risks are managed and understood is a key driver [22] behind profitability, as well as of the quantum of capital they are required to hold.^[23] Financial risk management in banking has thus grown markedly in importance since the (This has given rise[24] to dedicated degrees and professional certifications.)

The broad distinction between

on the other, carries through to the management of risk at these institutions. Investment Banks profit from (. The major focus for risk managers here is therefore on market and credit risk. Commercial and Retail Banks, as deposit taking institutions, profit from the spread between deposit and loan rates. The focus of risk management is then on .

All banks will focus also on operational risk, impacting here (at least) through

regulatory capital

; (large) banks are also exposed to Macroeconomic systematic risk - risks related to the aggregate economy the bank is operating in^[25] (see Too big to fail).

Specific banking frameworks
Market risk
FRTB Internal models approach (IMA) Standardized approach (market risk)
Credit risk
Internal ratings-based approach (IRB) Foundation IRB (F-IRB) Advanced IRB (A-IRB) Standardized approach (credit risk)
Counterparty credit risk
Current exposure method (CEM) Standardised method (SM) Standardized approach (counterparty credit risk) (SA-CCR)
Operational risk
Advanced measurement approach (AMA) Basic indicator approach Standardized approach (operational risk) Standardised measurement approach (SMA)
v t e

For

- as outlined - the major focus is on credit and market risk. Credit risk is inherent in the business of banking, but additionally, these institutions are exposed to .

The discipline [26] ^{[27] [7] [8]} is, as discussed, simultaneously concerned with (i) managing, and as necessary

; and (ii) calculating and monitoring the resultant — with regulatory capital as a floor.

Correspondingly, and broadly, the analytics [27]^[26] are based as follows: For (i) on

. For (ii) on These calculations are mathematically sophisticated, and within the domain of quantitative finance.

The regulatory capital quantum is calculated via specified formulae: risk weighting the exposures per highly standardized asset-categorizations, applying the aside frameworks, and the resultant capital — at least 12.9%^[29] of these Risk-weighted assets (RWA) — must then be held in specific "tiers" and is measured correspondingly via the various capital ratios. In certain cases, banks are allowed to use their own estimated risk parameters here; these "internal ratings-based models" typically result in less required capital, but at the same time are subject to strict minimum conditions and disclosure requirements. As mentioned, additional to the capital covering RWA, the aggregate

ratios.

The financial crisis exposed holes in the mechanisms used for hedging (see Fundamental Review of the Trading Book § Background, Tail risk § Role of the 2007–2008 financial crisis, Value at risk § Criticism, and Basel III § Criticism). As such, the methodologies employed have had to evolve, both from a modelling point of view, and in parallel, from a regulatory point of view.

Regarding the modelling, changes corresponding to the above are: (i) For the daily

regulatory capital. (ii) For Value at Risk, the traditional Extensions to VaR include . For both (i) and (ii), model risk is addressed^[34] through regular validation of the models used by the bank's various divisions; for VaR models, backtesting is especially employed.

Regulatory changes, are also twofold. The first change, entails an increased emphasis^[35] on bank stress tests.^[36] These tests, essentially a simulation of the balance sheet for a given scenario, are typically linked to the macroeconomics, and provide an indicator of how sensitive the bank is to changes in economic conditions, whether it is sufficiently capitalized, and of its ability to respond to market events. The second set of changes, sometimes called "

addresses counterparty risk; other modifications are being phased in from 2023.

To

By increasing order of aggregation:

1. Financial institutions will set[38]^[26][39] limit values for each of the Greeks, or other sensitivities, that their traders must not exceed, and traders will then hedge, offset, or reduce periodically if not daily; see the techniques listed below. These limits are set given a range ^[40] of plausible changes in prices and rates, coupled with the board-specified risk appetite^[41] re overnight-losses.^[42]
2. Desks, or areas, will similarly be limited as to their VaR quantum (total or incremental, and under various calculation regimes), corresponding to their allocated ^[43] economic capital; a loss which exceeds the VaR threshold is termed a "VaR breach". RWA - with other regulatory results - is correspondingly monitored from desk level^[38] and upward.
3. Each area's (or desk's) concentration risk will be checked^[44][37][45] against thresholds set for various types of risk, and / or re a single counterparty, sector or geography.
4. Leverage Ratio, as leveraged positions could lose large amounts
   for a relatively small move in the price of the underlying.
5. Relatedly,
   high quality liquid assets"; NSFR, the Net Stable Funding Ratio, assesses its ability to finance assets and commitments within a year (addressing also, maturity transformation risk). Any "gaps", also, must be managed.^[46]
6. total loss absorbency capacity, TLAC, is sufficient^[47] given both RWA and leverage. (See also "MREL"^[48]
   for EU institutions.)

Periodically,[49] these all are estimated under a given stress scenario — regulatory and,^[50] often, internal — and risk capital,^[22] together with these limits if indicated,^[22][51] is correspondingly revisited (or optimized^[52]). The approaches taken center either on a hypothetical or historical scenario,^[35][27] and may apply increasingly sophisticated mathematics^[53][27] to the analysis. More generally, these tests provide estimates for scenarios beyond the VaR thresholds, thus “preparing for anything that might happen, rather than worrying about precise likelihoods".^[54] A reverse stress test, in fact, starts from the point at which "the institution can be considered as failing or likely to fail... and then explores scenarios and circumstances that might cause this to occur".^[55]

A key practice,^[56] incorporating and assimilating the above, is to assess the Risk-adjusted return on capital, RAROC, of each area (or product). Here,^[57] "economic profit" is divided by allocated-capital; and this result is then compared^[57][23] to the target-return for the area — usually, at least the equity holders' expected returns on the bank stock^[57] — and identified under-performance can then be addressed. (See similar below re. DuPont analysis.) The numerator, risk-adjusted return, is realized trading-return less a term and risk appropriate funding cost as charged by Treasury to the business-unit under the bank's funds transfer pricing (FTP) framework;^[58] direct costs are (sometimes) also subtracted.^[56] The denominator is the area's allocated capital, as above, increasing as a function of position risk;^[59][60][56] several allocation techniques exist.^[43] RAROC is calculated both

), and

Other teams, overlapping the above Groups, are then also involved in risk management. Corporate Treasury is responsible for monitoring overall funding and capital structure; it shares responsibility for monitoring liquidity risk, and for maintaining the FTP framework. Middle Office maintains the following functions also:

, of particular interest to risk managers. Credit Risk monitors the bank's debt-clients on an ongoing basis, re both exposure and performance. In the Front Office - since counterparty and funding-risks span assets, products, and desks - specialized XVA-desks are tasked with centrally monitoring and managing overall CVA and XVA exposure and capital, typically with oversight from the appropriate Group.^[31] "Stress Testing" may similarly be centralized.

Performing the above tasks — while simultaneously ensuring that computations are consistent ^[62] over the various areas, products, teams, and measures — requires that banks maintain a significant investment ^[63] in sophisticated infrastructure, finance / risk software, and dedicated staff. Risk software often deployed is from FIS, Kamakura, Murex, Numerix (FINCAD) and Refinitiv. Large institutions may prefer systems developed entirely "in house" - notably

("Quartz") - while, more commonly, the pricing library will be developed internally, especially as this allows for currency re new products or market features.

^{[65] [66] [67] [68]} are, by nature, more conservative than Investment banks, earning steady income from lending and deposits; their focus is more on the "". The biggest concern here - as mentioned - is the credit risk due to (the spread between deposit and loan rates).

For these banks, regulatory oversight is often tighter due to their direct impact on the financial system. Thus they are also

.

Given their business model and risk appetite, [67] as outlined, various differences result vs risk management at investment banks.

• Banks here maintain specific (and often additional) capital buffers to cover potential loan losses:- reflecting the fact that retail and commercial loans usually attract higher RWA results ^[70] than for assets typical in investment banking. See, e.g., the ALLL and NPL ratios.
• At the same time, credit exposure for these banks is to significantly more clients than at investment banks. For retail banks, "
  credit scoring and probability of default. Commercial banks deal with mid-sized corporate loans and bonds, and apply accounting- and financial analysis to determine creditworthiness; the approach differs re investment banking in that the broad client base allows for (necessitates) automation, with close monitoring on an exception basis
  .
• Concentration risk, relatedly, differs in its management: the concern is sector concentration as opposed to "name concentration". Here, in calculating VaR for a credit portfolio, ^[71] banks will incorporate a joint default probability for the various sectors and / or industries.
• Both retail and commercial banks employ strict liquidity management to ensure enough cash for customer withdrawals: at a minimum meeting the above NSFR and LCR requirements; but also complying with their regulator's reserve requirement. See also liquidity at risk.
• Both use
  interest rate risk in the banking book," ^[46][72] IRRBB, which deals with the risks associated with a change in interest rates, including interest rate gaps, basis risk, yield curve risk, and option risk
  .

The Risk Management function typically exists

run on the bank

). Specialised software is employed here, both operationally and for risk management and modelling.

Contribution analytics

: Profit and Loss for units sold at current fixed costs.

for varying

(scenario-based) Revenue levels, at current Fixed and Total costs.

In corporate finance, and financial management more generally,^[73][10] financial risk management, as above, is concerned with

The scope here - ie in non-financial firms[12] - is thus broadened^[9][75][76] (re banking) to overlap enterprise risk management, and financial risk management then addresses risks to the firm's overall strategic objectives, incorporating various (all) financial aspects^[77] of the exposures and opportunities arising from business decisions, and their link to the firm’s appetite for risk, as well as their impact on share price. In many organizations, risk executives are therefore involved in strategy formulation: "the choice of which risks to undertake through the allocation of its scarce resources is the key tool available to management."^[78]

Re the standard framework,^[77] then, the discipline largely focuses on operations, i.e. business risk, as outlined. Here, the management is ongoing^[10] — see following description — and is coupled with the use of insurance,^[79] managing the net-exposure as above: credit risk is usually addressed via provisioning and credit insurance; likewise, where this treatment is deemed appropriate, specifically identified operational risks are also insured.^[76]

, and hence share price.

Correspondingly, the practice here covers two perspectives; these are shared with corporate finance more generally:

1. Both risk management and corporate finance share the goal of enhancing, or at least preserving, firm
   Risk Analysts complement this work with model-based analytics more broadly;^[82][83] in some cases, employing sophisticated stochastic models,^[83][84] in, for example, financing activity prediction problems, and for risk analysis ahead of a major investment
   .
2. Firm exposure to long term market (and business) risk is a direct result of previous
   exotic derivatives usually trade OTC. Complementary to this hedging, periodically, Treasury may also adjust the capital structure, reducing financial leverage - i.e. repaying debt-funding - so as to accommodate increased business risk; they may also suspend dividends.^[92]

Multinational corporations are faced with additional challenges, particularly as relates to foreign exchange risk, and the scope of financial risk management modifies significantly in the international realm.^[90] Here, dependent on time horizon and risk sub-type — transactions exposure^[93] (essentially that discussed above), accounting exposure,^[94] and economic exposure^[95] — so the corporate will manage its risk differently. The forex risk-management discussed here and above, is additional to the per transaction

mechanisms).

Hedging-related transactions will attract their own accounting treatment, and corporates (and banks) may then require changes to systems, processes and documentation;^[96][97] see

.

It is common for large corporations to have dedicated risk management teams — typically within

Three lines of defence

). For small firms, it is impractical to have a formal risk management function, but these typically apply the above practices, at least the first set, informally, as part of the financial management function; see discussion under Financial analyst.

The discipline relies on a range of software,

). [100]

the premiums they collect from insured parties. They will, in turn, manage their own risks [103] ^{[104] [105] [102]} with a focus on solvency and the ability to pay claims: ^[106] are concerned more with longevity risk and interest rate risk; Short-Term Insurers (Property, Health, Casualty) ^[101] emphasize catastrophe- and claims volatility risks.

Fundamental here, therefore, is risk selection and

, which as outlined, prevent insurers from taking on unprofitable business. For expected claims — i.e. those theoretically inhering in the (IBNR). To absorb unexpected losses, insurance companies maintain a minimum level of capital plus an additional solvency margin. Capital requirements are based on the risks an insurer faces, such as underwriting risk, market risk, credit risk, and operational risk, and are governed by frameworks such as Solvency II (Europe) and Risk-Based Capital ^[107] (U.S.). To further mitigate large-scale risks — i.e. to reduce exposure to catastrophic losses — insurers transfer portions of their risk to Reinsurers. Here, analogous to VaR for banks, to estimate potential losses at various thresholds insurers use simulations, while stress tests assess how extreme events might impact capital and reserves under various scenarios. In parallel with all these, as above, premiums collected are invested to generate returns which will supplement underwriting profits, and the fund is then risk-managed as follows: ALM must ensure that investments align with the timing and amount of expected claim payouts; while returns (“float”) are defended using the techniques outlined in the next section.

Specific treatments will, as outlined, differ by insurer-profile:

• Life Insurers
  excess death
  claims.
• Short-Term Insurers
  hurricanes, earthquakes). Stress tests therefore emphasize short-term catastrophic scenarios, and specialized catastrophe models are widely used. Rapid claims settlement reduces reserving duration compared to life insurance, and portfolios lean toward liquid, shorter-term assets (e.g., cash, short-term bonds). Reinsurance is widely utilized to cap exposure to catastrophes; as are quota-share or excess-of-loss treaties
  re single events.

In a typical insurance company, Risk Management and the Actuarial Function are separate but closely related departments, each with distinct responsibilities. In smaller companies, the lines might blur, with actuaries taking on some risk management tasks, or vice versa. Regardless, the Head Actuary (or Chief Actuary or Appointed Actuary) has specific responsibilities, typically requiring formal "sign-off”: Reserve Adequacy and Solvency and Capital Assessment, as well as Reinsurance Arrangements. The relevant calculations are usually performed with specialized software — provided e.g. by WTW and Milliman — and often using R or SAS.

money market funds

) will realise more predictable returns if there is prudent market regulation.

so as to achieve the lowest risk for a given targeted return, or equivalently the highest return for a given level of risk; these risk-efficient portfolios form the "efficient frontier" (see Markowitz model). The logic here is that returns from different assets are highly unlikely to be perfectly correlated, and in fact the correlation may sometimes be negative. In this way, market risk particularly, and other financial risks such as (see below) can at least partially be moderated by forms of diversification.

A key issue, however, is that the (assumed) relationships are (implicitly) forward looking. As observed in the

). A related issue is that and as the fund manager diversifies, so this problem compounds (and a large fund may also exert market impact). See Modern portfolio theory § Criticisms.

Addressing these issues, more sophisticated approaches have been developed, both to defining risk, and to the optimization itself. (Respective examples: (tail) risk parity, focuses on allocation of risk, rather than allocation of capital; the Black–Litterman model modifies the "Markowitz optimization", to incorporate the views of the portfolio manager.^[111]) Relatedly, modern financial risk modeling employs a variety of techniques — including value at risk,^[112] historical simulation, stress tests, and extreme value theory — to analyze the portfolio and to forecast the likely losses incurred for a variety of risks and scenarios.

Here, guided by the analytics, fund managers (and traders) will apply specific risk hedging techniques.^[108][11] As appropriate, these may relate to the portfolio as a whole or to individual holdings:

• To protect the overall portfolio,
  stock index it is part of: thus if the portfolio-value declines, the index will have declined likewise with the derivative holder profiting correspondingly.^[113] Fund managers may (instead) engage in "portfolio insurance
  ", a dynamic hedging process that involves selling index futures during periods of decline and using the proceeds to offset portfolio losses.

• Fund managers, or traders, may also wish to hedge a specific stock's price. Here, they may likewise^[113] buy a single-stock put, or sell a single-stock future. Alternative strategies may rely on assumed relationships between related stocks, employing, for example, a "long/short" strategy.

• cashflow. Here the fund manager employs interest rate immunization or cashflow matching. Immunization is a strategy that ensures that a change in interest rates will not affect the value of a fixed-income portfolio (an increase in rates results in a decreased instrument value). It is often used to ensure that the value of a pension fund's assets (or an asset manager's fund) increase or decrease in an exactly opposite fashion to their liabilities, thus leaving the value of the pension fund's surplus (or firm's equity) unchanged, regardless of changes in the interest rate. Cashflow matching is similarly a process of hedging in which a company or other entity matches its cash outflows - i.e., financial obligations - with its cash inflows over a given time horizon. See also laddering,^[118] dedicated portfolio
  .

• For individual
  KMV to estimate the (risk neutral^[121]) probability of default, hedging where appropriate, usually via credit default swaps. Probabilities (actuarial) may also be obtained from Bond credit ratings; then, often at a portfolio level — e.g. for credit-VaR — analysts will use a transition matrix of these^[122] to estimate the probability and impact of a "credit migration",^[123][124] aggregating the bond-by-bond result. Interest rate- and credit risk together, may be hedged via a Total return swap. See Fixed income analysis

• For
  underlying security
  .

Further, and more generally, various safety-criteria may guide overall portfolio construction. The Kelly criterion^[125] will suggest - i.e. limit - the size of a position that an investor should hold in her portfolio. Roy's safety-first criterion^[126] minimizes the probability of the portfolio's return falling below a minimum desired threshold. Chance-constrained portfolio selection similarly seeks to ensure that the probability of final wealth falling below a given "safety level" is acceptable.

Managers may also employ factor models^[127] (generically APT) to measure exposure to macroeconomic and market risk factors^[128] using time series regression. Ahead of an anticipated movement in any of these factors, the Manager may then, as indicated, reduce holdings, hedge, or purchase offsetting exposure. Inflation for example, although impacting all securities,

In parallel with all above,

"benchmark"

. Here, they will use attribution analysis preemptively so as to diagnose the source early, and to take corrective action: realigning, often factor-wise, on the basis of this "feedback".^[135][136] As relevant, they will similarly use style analysis to address style drift. See also Fixed-income attribution.

Given the complexity of these analyses and techniques, Fund Managers typically rely on sophisticated software (as do banks, above). Widely used platforms are provided by BlackRock (Aladdin), Refinitiv (Eikon), Finastra, Murex, Numerix, MPI and Morningstar.

Articles

• Outline of finance § Risk management

Discussion

• Asset and liability management
• Basel III: Finalising post-crisis reforms
• Corporate governance
• Enterprise risk management
• Finance § Risk management
• Risk management § Finance

Lists

• economic crises
• asset bubbles
• stock market crashes and bear markets
• trading losses
• corporate collapses and scandals
• accounting scandals
• banking crises
  • bank runs
  • largest U.S. bank failures
  • bank failures in the United States (2008–present)

References

External links

• Glossary of financial risk management terms, Risk.net
• Risk management resources, Global Risk Institute
• Risk knowledge library, Risk and Insurance Management Society
• Risk management entries, Fincyclopedia
• Risk Journals, Risk.net
• Global Association of Risk Professionals, GARP
• Professional Risk Managers' International Association, PRMIA
• Chartered Enterprise Risk Analyst, Society of Actuaries