8010 Operational Risk Manager (ORM) Exam Questions and Answers

Choice 'd' represents a risk that does not arise from its holdings of mortgages. Therefore Choice 'd' is the correct answer.

All the other risks identified are correct - the bank faces interest rate, default and prepayment risks on its mortgages.

Assuming time invariance and the Markov property, it is easy to calculate the transition matrix for any time period as P^n, where P is the given transition matrix for one period and n the number of time periods that we need to compute the new transition matrix for.

However, when the new time period is less than the time period the matrix is available for, the only way to deriving a transition matrix for a partial period is to numerically calculate a matrix M such that M^n = P. Therefore Choice 'b' is the correct answer. Taking cube roots of a matrix is not a possible operation, dividing by 3 gives a matrix meaningless in this context, and P x P x P will give us the transition matrix for 3 years, not 1/3rd of a year.

When a derivative position is entered into, its mark-to-market value is generally close to zero (though the notional may be high). With the passage of time, the derivative's value fluctuates in an unpredictable way, creating a counterparty exposure that may be difficult to estimate and risk manage. Counterparty risk in such cases is estimated based on Potential Future Exposure, which may be calculated using either:

a) Take the mark-to-market at present, and add a certain percentage of the notional, or

b) Perform a Monte Carlo simulation, capturing the stochastic nature of the PFE.

Therefore I and II are valid choices. MLE and parametric estimation are not methods for calculating PFE.

The credit spread is equal to the default rate times the loss given default, or stated another way, default rate times (1 - recovery rate). It is not equal to the default rate times the recovery rate. Therefore statement I is not correct.

When ratings are upgraded by rating agencies, the spread contracts and not widen. Therefore statement II is not correct.

Both recovery rates and probabilities of default are related to the business cycle, and they move in opposite directions. Economic recessions witness an increase in the default rate and a decrease in the recovery rate, and economic expansions result in a decrease in the default rate and an increase in the recovery rates when default does happen. Therefore statement III is correct.

Bond spreads incorporate both the risk of default, but also considerations of liquidity in the case of corporate bonds. Hence statement IV is correct.

Statement I is true, the quantiles of the averaged models are equal to the geometric average of the quantiles of the original models.

Statement II is correct, the number of data points from which model parameters are estimated must be greater than the number of parameters. So if a distribution, say Poisson, has one parameter, we need at least two data points to estimate the parameter. Other complex distributions may have multiple parameters for shape, scale and other things, and the minimum number of observations required will be greater than the number of parameters.

Statement III is true, if the ILD data and scenarios cover the same risk, they are essentially different perspectives on the same risk, and therefore should be combined as weighted averages.

But if they cover completely different risks, the models will need to be added together, not averaged - which is why Statement IV is true.

The easiest way to answer this question is to ignore the joint probability of default as that is irrelevant to expected losses. The joint probability of default impacts the volatility of the losses, but not the expected amount. One way to think about it is to think of asset portfolios, where diversification reduces risk (ie standard deviation) but the expected returns are nothing but the average of the expected returns in the portfolio. Just as the expected returns of the portfolio are not affected by the volatility or correlations (these affect standard deviation), in the same way the joint probability of default does not affect the expected losses. Therefore the expected losses for this portfolio are simply $1m x 10% + $1m x 15% = $250,000.

This can also be seen from the lens of a joint probability distribution as follows:

There are four possibilities for this portfolio:

- Only loan A defaults: loss of $1m: 9% probability

- Only loan B defaults: loss of $1m: 14% probability

- Both loan A and B default: loss of $2m: 1% probability

- Neither A nor B default: loss of $0m: 76% probability

Therefore the expected losses on the portfolio are ($1m x 9%) + ($1m x 14%) + ($2m x 1%) + ($0m x 76%) = $250,000.

(Notes: How is the above table calculated? The totals (10%, 90%, 15% and 85%) are filled in first. The top left cell (both A & B default) is given as 1%. We can now calculate the rest of the cells as the totals are known.)

An observed fact that the KMV approach relies upon is that firms do not default when their liabilities exceed assets, but when asset values are somewhere between short term liabilities and the total liabilities. In fact, the 'default point' in the KMV methodology is defined as the short term debt plus half of the long term debt. The difference between expected value of the assets in one year and this 'default point', when expressed in terms of standard deviation of the asset values, is called the 'distance-to-default'.

Therefore Choice 'd' is the correct answer. The other choices are incorrect.

The Options Theoretic approach to calculating economic capital is a top-down approach that considers the value of capital as being equivalent to a call option with a strike price equal to the notional value of the debt - ie, the shareholders have a call option on the assets of the firm which they can acquire by paying the debt holders a value equal to their notional claim (ie the face value of the debt). Therefore Choice 'a' is the correct answer and the other choices are incorrect.

The correct answer is choice 'd'

Marginal VaR is just the change in total VaR from a $1 change in the value of the asset in the portfolio. All other answers are incorrect. Mathematically, it is expressed as follows, where VaRp is the VaR for the portfolio, and Vi is the value of the asset in question.

Other answers describe other VaR related concepts such as incremental VaR, Component VaR and Conditional VaR.

The three pillars under Basel II are minimum capital requirements, supervisory review process and market discipline. Therefore statement I is false. The other two statements are accurate. Therefore Choice 'd' is the correct answer.

A bullet bond is a bond that pays coupons covering interest during the life of the bond and the principal at maturity. An amortizing loan pays the interest as well as a part of the principal with every payment. Therefore, the exposure of the amortizing loan continually reduces, and approaches zero towards the end of its life. The bullet bond will always have a higher exposure at any time during its life when compared to an equivalent amortizing loan. Hence Choice 'd' is the correct answer.

According to the Basel II framework, Tier 1 capital, also called core capital or basic equity, includes equity capital and disclosed reserves.

Tier 2 capital, also called supplementary capital, includes undisclosed reserves, revaluation reserves, general provisions/general loan-loss reserves, hybrid debt capital instruments and subordinated term debt issued originally for 5 years or longer.

Tier 3 capital, or short term subordinated debt, is intended only to cover market risk but only at the discretion of their national authority. This only includes short term subordinated debt originally issued for 2 or more years.

An interesting thing to note is the difference between 'subordinated term debt' under Tier 2 and the 'short term subordinated debt' under Tier 3. The distinction is based upon the years to maturity at the time the debt was issued. The remaining time to maturity is not relevant. For the subordinated term debt included under Tier 2, the amount that can be counted towards capital is reduced by 20% for every year when the debt is due within 5 years. This takes care of the time to maturity problem for Tier 2 subordinated debt. For Tier 3 short term subordinated debt, this is not an issue because debt will only qualify for Tier 3 if it has a lock-in clause stipulating that the debt is not required to be repaid if the effect of such repayment is to take the bank below minimum capital requirements.

Statement I is correct. Retail Risk Based Pricing (RRBP) involves the use of borrower specific data (such as FICO scores, average balances etc) to arrive at credit decisions. These 'retail' credit decisions may include decisions on whether to grant a line of credit, a mortgage, issue a credit card, or any of the various other retail activities a bank may be dealing with. At the same time, this data can also be used to price the product, in addition to providing a yes or no credit decision so that risky borrowers are charged more than less risky borrowers.

Statement II is not correct, because an integrated Risk Information Management Environment includes three elements - people, processes and technology (and not just people and processes).

Statement III is correct. An LDM is a blue print of an organization's data, and describes the relationships between the various data elements.

Statement IV is not correct because reference data and metadata are not the same thing. Reference data refers to relatively static data, such as customer name (while actual transactions may not be so static). Metadata refers to data about data, and is stored in a data dictionary.

Therefore Choice 'b' is the correct answer and the rest are incorrect.

Credit reserves are created in respect of expected losses, which are considered the cost of doing business. Unexpected losses are borne by economic credit capital, which is a part of economic capital. Therefore Choice 'c' is the correct answer.

Historical Simulation VaR is conceptually very straightforward: actual prices as seen during the observation period (1 year, 2 years, or other) become the 'scenarios' forming the basis of the valuation of the portfolio. For each scenario, full revaluation is performed, and a P & L data set becomes available from which the desired loss quantile can be extracted.

Historical simulation is based upon actually seen prices over a selected historical period, therefore no distributional assumptions are required. The data is what the data is, and is the distribution. Statement I is therefore not correct.

It uses full revaluation for each historical scenario, therefore statement II is correct.

Since the prices are taken from actual historical observations, a correlation matrix is not required at all. Statement III is therefore incorrect (it would be true for Monte Carlo and parametric Var).

Historical simulation VaR suffers from the limitation that if enough representative data points are no available during the historical observation period from which the scenarios are drawn, the results would be inaccurate. This is likely to be the case for new products. Therefore Statement IV is incorrect.

EVT, when used in the context of operational risk measurement, focuses on tail events and attempts to build a distribution of losses beyond what is covered by VaR. Statements I, II and II are correct. Statement IV describes conditional VaR (CVAR) and not EVT.

Choice 'c' is the correct answer.

Choice 'a' is the correct answer. Refer to the detailed loss event type classification under Basel II (see Annex 9 of the accord). You should know the exact names of all loss event types, and examples of each.

The state of the economy, credit quality of individual borrowers and concentration risk are all factors that affect the credit risk facing a lender. Mark to market accounting does not change the credit risk, or the underlying economic reality facing the institution. Therefore Choice 'b' is the correct answer.

Concentration risk in a credit portfolio arises due to a high degree of correlation between the default probabilities of the issuers of securities in the portfolio. For example, the fortunes of the issuers in the same industry may be highly correlated, and an investor exposed to multiple such borrowers may face 'concentration risk'.

A low degree of correlation, or independence of individual defaults in the portfolio actually reduces or even eliminates concentration risk.

The fact that issuers are from the same country may not necessarily give rise to concentration risk - for example, a bank with all US based borrowers in different industries or with different retail exposure types may not face practically any concentration risk. What really matters is the default correlations between the borrowers, for example a lender exposed to cement producers across the globe may face a high degree of concentration risk.

Marginal VaR of a component of a portfolio is the change in the portfolio VaR from a $1 change in the value of the component. It helps a risk analyst who may be trying to identify the best way to influence VaR by changing the components of the portfolio. Marginal VaR is also important for calculating component VaR (for VaR disaggregation), as component VaR is equal to the marginal VaR multiplied by the value of the component in the portfolio.

Marginal VaR is by definition the derivative of the portfolio value with respect to the component i. This is reflected in Choice 'a' above. Using the definitions and relationships between correlation, covariance, beta and volatility of the portfolio and/or the component, we can show that the other two choices are also equivalent to Choice 'a'.

Therefore all the choices present are correct.

The probability of default would make the future cash flows from both the bonds identical. If p be the probability of default, the cash flows from the risky corporate bond would be

= (cash flows in the event of default x probability of default) + (cash flows without default x (1 - probability of default))

= > p*0 + (1 - p)*(1 + 8.5%) = (1 - p)*1.085.

The cash flows from the treasury bond would be 1.04. These two should be equal, ie,

1.04 = (1- p)*1.085, implying p = 4.15%.

(Note: The above is a simplification intended for the exam. In reality investors would demand a 'credit risk premium' for the corporate bond over and above the expected default loss rate. They are unlikely to be happy with just being compensated with exactly the expected default loss rate plus the risk-fre rate because the expected default loss rate itself is uncertain. They would demand some premium over and above what the default rate alone might mathematically imply above the risk free rate. In this question, this credit risk premium is ignored.)

The point that this question is trying to emphasize is the independence of the risk management function. The risk function should be segregated from the risk taking functions as to maintain independence and objectivity.

Choice 'd', Choice 'c' and Choice 'a' run contrary to this requirement of independence, and are therefore not correct. The risk function should report directly to senior levels, for example directly to the audit committee, and not be a part of the risk taking functions.

It is the cross-default clauses in debt agreements that generally provide that a default on one obligation is considered a credit event applying to all debts of the obligor, and therefore we are able to deal with credit risk at the borrower level, and not at the level of the individual security. It also helps avoid situations where borrowers can selectively default on some obligations while continuing to service others. Therefore Choice 'a' is the correct answer. The other choices are incorrect.

Assuming time invariance and the Markov property, it is easy to calculate the transition matrix for any time period as P^n, where P is the given transition matrix for one period and n the number of time periods that we need to compute the new transition matrix for. Thus Choice 'b' is the correct answer.

Error rates are generally modeled using the Poisson distribution. Recall that the Poisson distribution has only one parameter - λ - which is its mean and also its variance.

In the given case, the mean number of errors is 2,000,000 x 0.005% = 100. Since this is the variance as well, the standard deviation is √100 = 10. Therefore the range of outcomes within 2 standard deviations of the mean is 100 +/- (2*10) = 80 to 120 errors in a day.

Once we have a number of distributions in the model space, the task is to select the "best" distribution that is likely to be a good estimate of true severity. We have a number of distributions to pick from, an empirical dataset (from internal or external losses), and we can estimate the parameters for the different distributions. We then have to decide which distribution to pick, and that generally requires considering both approximation and fitting errors.

There are three methods that are generally used for selecting a model:

1. The cross-validation method: This method divides the available data into two parts - the training set, and the validation set (the validation set is also called the 'testing set'). Parameter estimation for each distribution is done using the training set, and differences are then calculated based on the validation set. Though the temptation may be to use the entire data set to estimate the parameters, that is likely to result in what may appear to be an excellent fit to the data on which it is based, but without any validation. So we estimate the parameters based on one part of the data (the training set), and check the differences we get from the remaining data (the validation set).

2. Complexity penalty method: This is similar to the cross-validation method, but with an additional consideration of the complexity of the model. This is because more complex models are likely to produce a more exact fit than simpler models, this may be a spurious thing - and therefore a 'penalty' is added to the more complex models as to favor simplicity over complexity. The 'complexity' of a model may be measured by the number of parameters it has, for example, a log-normal distribution has only two parameters while a body-tail distribution combining two different distributions may have many more.

3. The bootstrap method: The bootstrap method estimates fitting error by drawing samples from the empirical loss dataset, or the fit already obtained, and then estimating parameters for each draw which are compared using some statistical technique. If the samples are drawn from the loss dataset, the technique is called a non-parametric bootstrap, and if the sample is drawn from an estimated model distribution, it is called a parametric bootstrap.

4. Using goodness of fit statistics: The candidate fits can be compared using MLE based on the KS distance, for example, and the best one selected. Maximum likelihood estimation is a technique that attempts to maximize the likelihood of the estimate to be as close to the true value of the parameter. It is a general purpose statistical technique that can be used for parameter estimation technique, as well as for deciding which distribution to use from the model space.

All the choices listed are the correct answer.

Bank B's exposure is measured by the price it paid for the bonds, which in this case is $7m ($10m x 70/100). Hence Choice 'c' represents the correct answer.

(Note that the question is asking for 'exposure' and not the legal claim in the event of default. The legal claim in the event of default would be the full notional of $10m. )

The initial issue price and issue size are irrelevant.

Recovery rates vary a great deal from year to year, and are difficult to predict. Therefore statement III is true. Similarly, any attempt to predict these is hamstrung by a high standard error, which can be as high as the historical mean itself. The error does not cancel itself out due to the effect of the business cycle making the error directionally biased. Thus statement IV is false.

Statement II is true as these are all factors that make forecasting recovery rates for any credit risk model rather difficult. Statement I is false because recovery rates are difficult to predict and assumptions are not easy to make.

The current Basel rules for the basic VaR based charge for market risk capital set market risk capital requirements as the maximum of the following two amounts:

1. 99%/10-day VaR,

2. Regulatory Multiplier x Average 99%/10-day VaR of the past 60 days

The 'regulatory multiplier' is a number between 3 and 4 (inclusive) calculated based on the number of 1% VaR exceedances in the previous 250 days, as determined by backtesting.

- If the number of exceedances is < = 4, then the regulatory multiplier is 3.

- If the number of exceedances is between 5 and 9, then the multiplier = 3 + 0.2*(N-4), where N is the number of exceedances.

- If the number of exceedances is > =10, then the multiplier is 4.

So you can see that in most normal situations the risk capital requirement will be dictated by the multiplier and the prior 60-day average VaR, because the product of these two will almost often be greater than the current 99% VaR.

The correct answer therefore is = max(200mm, 3*250mm) = $750mm.

Interestingly, also note that a 99% VaR should statistically be exceeded 1%*250 days = 2.5 times, which means if the bank's VaR model is performing as it should, it will still need to use a reg multiplier of 3.

According to ISDA standard definitions, the legal claim for OTC derivatives is the current replacement value of the contract. Therefore Choice 'c' is the correct answer. None of the other choices are correct.

A cumulative accuracy plot measures the accuracy of credit ratings assigned by rating agencies by considering the relative rankings of obligors according to the ratings given. Choice 'd' is the correct answer.

For a number of processes, including many in finance, while a distribution such as the normal distribution is a good approximation of the distribution near the modal value of the variable, the same normal distribution may not be a good estimate of the tails. For this reason, the Pareto distribution is one of the distributions that is often used to model the tails of another distribution. Generally, if you have a set of observations, and you discard all observations below a threshold, you are left with what are called 'exceedances'. The threshold needs to be reasonably far out in the tail. If from each value of the exceedances you subtract the threshold value, the resulting dataset is estimated by the generalized Pareto distribution.

The Pareto distribution has a 'shape parameter'. The average of two Pareto distributions with tail parameters ξ1 and ξ2 (ξ is a Greek character, pronounced as 'sai' (saa-eee)), is the weighted average of ξ1 and ξ2 with weights proportional to the number of observations in the datasets underlying the distributions.

The recovery rate, the default hazard rate (also called the average default intensity) and the spread on debt are linked by the equation Hazard Rate = Spread/(1 - Recovery Rate). Therefore, the recovery rate implicit in the given data is = 1 - 8%/10% = 20%.

When a operational loss frequency distribution (which, for example, may be based upon a Poisson distribution) and a loss severity distribution (for example, based upon a lognormal distribution), it is assumed that the frequency of losses and the severity of the losses are completely independent and do not impact each other. Therefore statement II is correct, and the others are not valid assumptions underlying the operational loss distribution.

Credit reserves are created in respect of expected losses, which are considered the cost of doing business. Unexpected losses are borne by economic credit capital, which is a part of economic capital. This question is a bit nuanced - and 'economic capital' would generally be a good answer as well. However, taking a rather beady eyed view of the terminology and distinguishing between 'economic credit capital' which is a subset of 'economic capital', we can say that 'economic credit capital' is a more appropriate Choice 'a's the question relates to credit losses.

The CDS rate is approximated by the [Loss given default x Default hazard rate]. Thus Choice 'b' is the correct answer.

Note that this is also equal to the credit spread on the reference bond over the risk free rate. Therefore credit spreads and CDS rates are generally the same. Also, 'loss given default' is nothing but (1 - Recovery rate). This can be substituted in the formula for the credit spread to get an alternative expression that directly refers to the recovery rate. Therefore all other choices are incorrect.

The correct answer is Choice 'd'. The following is a brief description of the major approaches available to model credit risk, and the analysis that underlies them:

1. CreditMetrics: based on the credit migration framework. Considers the probability of migration to other credit ratings and the impact of such migrations on portfolio value.

2. CreditPortfolio View: similar to CreditMetrics, but adds the impact of the business cycle to the evaluation.

3. The contingent claims approach: uses option theory by considering a debt as a put option on the assets of the firm.

4. KMV's EDF (expected default frequency) based approach: relies on EDFs and distance to default as a measure of credit risk.

5. CreditRisk+: Also called the 'actuarial approach', considers default as a binary event that either happens or does not happen. This approach does not consider the loss of value from deterioration in credit quality (unless the deterioration implies default).

The correct answer is choice 'a'

The correct order of steps to addressing data quality problems in an organization would include:

1. Assesing the current state

2. Designing the future state, and

3. Planning and implementation which would include identifying the gaps between the current and the desired future state, and implementation to address the gaps.

Therefore Choice 'a' is the correct answer.

Choice 'c' is incorrect because a gap analysis cannot be performed without understanding the 'as-is' (which results from understanding the current state).

Choice 'b' is non-sensical, and Choice 'd' is a flippant option (though often used in real life situations by management as an easy (and ineffective) way to escape accountability for difficult problems)

This situation represents one of the paradoxes in estimating severity that one needs to be aware of - the improvement in controls reduces the weight of the body/middle of the distribution and moves it towards the tails (as the total probability under the curve must stay at 100%) and the distribution becomes more heavy tailed. As a result, the 99.9th percentile loss actually increases. instead of decreasing, creating a counterintuitive result. Therefore the correct answer is that the capital required will increase.

If scenario analysis produces such a result, the analyst must question if the 1 in 100 year loss severity is still accurate. If the new control has reduced the severity in the body of the distribution, the question as to why the more extreme losses have not changed should be raised.

The actuarial or CreditRisk+ model considers default as an 'end of game' event modeled by a Poisson distribution. The annual number of defaults is a stochastic variable with a mean of μ and standard deviation equal to √μ.

The probability of n defaults is given by (μ^n e^-μ) /n!, and therefore in this case is equal to (=2^4 * exp(-2))/FACT(4)) = 0.0902.

Note that CreditRisk+ is the same methodology as the actuarial approach, and requires using the Poisson distribution.

Choice 'a' is the correct answer. The other choices represent non-sensical statements.

The correct answer is choice 'b'

Both statements are accurate. Basel II requires pooled probabilities of default to be applied to risk buckets that contain similar exposures. Also, stress testing is mandatory for both market and credit risk.

Economic capital is sub-additive, ie, because of the correlation being less than perfect between the risks of the different business units, the total economic capital for the firm will be less than the sum of the EC for the individual business units. Therefore Choice 'b' is the correct answer.

In practice, correlations are difficult to estimate reliably, and banks often use estimates and corroborate their capital calculations with reference to a number of data points.

Right after inception' is incorrect as the interest rate swap (IRS) would be valued at close to zero right after inception and the credit risk would be minimum. Choice 'a' (ie 10 years, at maturity) is incorrect as at maturity there would be no more cash flows to exchange, and the replacement value of the contract would again be close to zero.

Therefore the worst time for the counterparty to default is somewhere between inception and maturity - in fact the range of possible outcomes for the contract increases with the passage of time, and we should find the worst time to default to be a later date. However, towards maturity, the value of the contract starts to go towards zero again, and the maximum value is reached around 7 years. 2 years is too early for the maximum to be reached for the 10 year IRS, and therefore choice a is the correct answer.

Under the contingent claims approach, credit risk is evaluated as the value of the put on the firm's assets with a strike price equal to the face value of the debt and maturity equal to the maturity of the obligation. The Black Scholes model can then be used to value the put, and therefore an increase in volatility and the time to expiry (ie maturity) will increase the value of the debt. An increase in the risk free rate will actually reduce the value of the put, therefore statements I and III are correct and Choice 'b' is the correct answer.

The correct answer is Choice 'd'. The following is a brief description of the major approaches available to model credit risk, and the analysis that underlies them:

1. CreditMetrics: based on the credit migration framework. Considers the probability of migration to other credit ratings and the impact of such migrations on portfolio value.

2. CreditPortfolio View: similar to CreditMetrics, but adds the impact of the business cycle to the evaluation.

3. The contingent claims approach: uses option theory by considering a debt as a put option on the assets of the firm.

4. KMV's EDF (expected default frequency) based approach: relies on EDFs and distance to default as a measure of credit risk.

5. CreditRisk+: Also called the 'actuarial approach', considers default as a binary event that either happens or does not happen. This approach does not consider the loss of value from deterioration in credit quality (unless the deterioration implies default).

By assuming the assets to be independent, we are reducing the correlation from a positive number to zero. Reducing asset correlations reduces the combined standard deviation of the assets, and therefore reduces economic capital. Therefore Choice 'b' is the correct answer.

Note that this question could also be phrased in terms of the impact on VaR estimates, and the answer would still be the same. Both VaR and economic capital are a multiple of standard deviation, and if standard deviation goes down, both VaR and economic capital estimates will reduce.

The credit migration approach to assessing portfolio credit risk involves obtaining a distribution of future portfolio values from the ratings migration matrix. First, the frequencies in the matrix are used as probabilities, and expected future values of the securities belonging to each rating category are calculated. These are then discounted to the present using the discount rate appropriate to the 'future' rating category. This gives us a forward distribution of the value of each security in the portfolio. These are then combined using the default correlations between the issuers. The default correlation between the issuers is often proxied using asset returns, and recognizing that default occurs when asset values fall below a certain threshold. A distribution for the future value of the portfolio is generated using simulation, and from this distribution the Credit VaR can be calculated.

Thus, we need the migration matrix, the risk horizon from which the present values need to be calculated, and the forward yield curve or the discount curve for each rating category for the risk horizon. Thus, Choice 'd' is the correct answer.

When modeling operational loss frequency distribution (which, for example, may be based upon a Poisson distribution) and a loss severity distribution (for example, based upon a lognormal distribution), it is assumed that the frequency of losses and the severity of the losses are completely independent and do not impact each other. Therefore Choice 'a' is correct, and the others are not valid assumptions underlying the operational loss modeling.

Once each of these distributions has been built, a random number is drawn from each to determine a loss scenario. The process is repeated many times as part of a Monte Carlo simulation to get a the loss distribution.

Choice 'c' is the correct answer. The Markov property is the assumption that there is no ratings momentum, and that transition probabilities are dependent only upon where the rating currently is and where it is going to. Where it has come from, or what the past changes in ratings have been, have no effect on the transition probabilities. ('Herstatt risk' refers to settlement risk, and is irrelevant.)

Measures of risk sensitivity include delta, gamma, vega, PV01, convexity and CR01, among others. They allow approximating the change in the value of a portfolio from a change (generally small) in one of the underlying risk factors.

Risk sensitivity measures are derivatives of the value of the portfolio, calculated with respect to the risk factor. Some risk sensitivity measures are second derivatives, and allow a more precise calculation of the change in the value of the portfolio. Many risk sensitivities are represented by Greek letter, but not all.

Delta (δ) is a measure of the change in portfolio value based on a 1% change in the value of the underlying. Gamma (γ) is a second order derivative that improves the calculation as part of a Taylor expansion. CR01 is a measure of the change due to a 1 basis point change in the credit spread. PL01 is not a measure of any kind of risk sensitivity, it does not mean anything.

The major problem with using return on equity as a measure of performance is that return on equity is not adjusted for risk. Therefore, a riskier investment will always come out ahead when compared to a less risky investment when using return on equity as a performance metric.

Return on equity does not ignore the effect of leverage (though return on assets does) because it considers the income attributable to equity, including income from leveraged investments.

Return on equity is generally measured after interest and taxes at the company wide level, though at business unit level it may use earnings before interest and taxes. However this does not create a problem so long as all performance being covered is calculated in the same way.

Cash flows being different from accounting earnings can create liquidity issues, but this does not affect the effectiveness of ROE as a measure of performance.

increasing the timing differences between the two legs of the transaction will increase settlement risk and not reduce it. Using escrow arrangements, such as central clearing houses to settle transactions (eg the DTCC in the United States) reduces settlement risk. Cash settlements based on netting arrangements reduce settlement risk, while physical delivery combined with gross cash payments increase it.

Therefore Choice 'a' is the correct answer.

Top down approaches do not consider event frequency and severity, on the other hand they focus on high level available data such as total capital, income volatility, peer group information on risk capital etc. Bottom up approaches focus on severity and frequency distributions for events. Statement I is therefore not correct.

Top down approaches do indeed rely upon high level aggregate data and tend to infer operational risk capital requirements from these. Bottom up approaches look at more detailed firm specific information. Statement II is correct.

Scenario analysis requires estimating losses from risk scenarios, and allows incorporating the judgment and views of managers in addition to any data that might be available from internal or external loss databases. Statement III is correct. Therefore Choice 'b' is the correct answer.

Refer to the detailed loss event type classification under Basel II (see Annex 9 of the accord). You should know the exact names of all loss event types, and examples of each.

Statement I is correct. Data is often divided into two sets - a 'training set' that is used to create and fine-tune the model while the 'control set' is used to prove that the model works on sample data. Back testing is then perfomed using actual data that becomes available over time, or may already be available as historical data.

Statement II is incorrect. A risk manager often spends a great deal of time in managing data, and ensuring that the data being used is accurate enough for the purpose it is being used for. A risk manager can expect to spend a good part of his or her team's time in cleansing data. While he or she can try to get the IT processes and systems to produce correct data in the first place so it requires minimal subsequent cleansing or validation, this task is likely to remain a key part of a risk manager's role for quite some time in the future given the challenges nearly all organizations face in managing risk data.

Statement III is correct. There was not enough granular data available on the underlying components of some of the derivative debt securities whose markets dried up during the crisis that began in 2007. This was because investors became increasingly unsure of what the value of these securities, such as CDOs was, leading to market seizure and firesale prices.

Statement IV is not correct. There is no easy solution to the lack of enough historical data, which is used to create as well as test models, and construct stress scenarios. Analytical approaches are not a good enough substitute for real market data. During the recent crisis, many instruments had rather short histories and there was not enough data available, and risk managers and portfolio managers relied upon analytical approaches to value and price them. Many of the assumptions that underpinned these approaches were untested in the real world and turned out to be incorrect.

Therefore Choice 'c' is the correct answer and the rest are incorrect.

The total variance of the system is 100^2 + 40^2 + 30^2 = 12500 (as variance = volatility squared). The first factor alone has a variance of 10,000, or 80%. Therefore only the first factor will be included in the final analysis, and the rest will be ignored.

Interestingly, this example highlights one of the limitations of PCA. Obviously, the second and third factors are material when considering volatility, though the effect of squaring them to get the variance makes them appear less important than they are.

All the factors listed above contributed to systemic failure. Liquidity risk was not on the radar of regulators, and was a second priority for risk managers, and most of the focus was on capital adequacy as liquidity was thought to be an unlikely problem. Liquidity, regardless of capital adequacy, was the primary cause of failure of a number of institutions during the crisis.

Similarly, stress tests proved to be much milder than the shocks that were actually experienced, and the strategy of 'originate and distribute' implied that the mortgage and other debt originators had no interest in any due diligence as they intended to package and sell the debt to other investors.

Therefore Choice 'd' is the correct answer.

Under the CreditPortfolio View approach, the credit rating transition matrix is adjusted for the state of the economy in a way as to increase the probability of defaults when the economy is not doing well, and vice versa. Therefore Choice 'a' is the correct answer. The other choices represent nonsensical options.

Choice 'b' is the correct answer. All other answers are incorrect.

Refer to the detailed loss event type classification under Basel II (see Annex 9 of the accord). You should know the exact names of all loss event types, and examples of each.

Statement I is true - capital adequacy indeed is a reference to the ability of the firm to stay a 'going concern'. (Going concern is an accounting term that means the ability of the firm to continue in business without the stress of liquidation.)

Statement II is not true because even though the stated objective of regulatory capital requirements is similar to the purposes for which economic capital is calculated, regulatory capital calculations are based upon a large number of ad-hoc estimates and parameters that are 'hard-coded' into regulation, while economic capital is generally calculated for internal purposes and uses an institution's own estimates and models. They are rarely identical.

Statement II is not true as the purpose of economic capital is to provide a buffer against unexpected losses. Expected losses are covered by the P & L (or credit reserves), and not capital.

Statement IV is incorrect as even though economic capital may be calculated at very high confidence levels, that is never 100% which would require running a 'risk-free' business, which would mean there are no profits either. The level of confidence is set at a level which is an acceptable balance between the interests of the equity providers and the debt holders.

Regardless of the approach being followed by a bank (ie, whether foundation IRB or advanced IRB), it must make its own estimates for the probability of default. Banks following the foundation IRB approach may use values set by the supervisor for the other three parameters, though those following the advanced IRB approach may use their own estimates for all four inputs. (This is also the difference between advanced IRB and the foundation IRB approaches.) Therefore Choice 'a' is the correct answer.

Also note the four difference elements that go as inputs to the internal ratings based approach in the choices provided.

High frequency and low severity risks, for example the risks of fraud losses for a credit card issuer, may have high expected losses, but low unexpected losses. In other words, we can generally expect these losses to stay within a small expected and known range. The capital requirement will be the worst case losses at a given confidence level less expected losses, and in such cases this can be expected to be low.

On the other hand, medium severity medium frequency risks, such as the risks of unexpected legal claims, 'fat-finger' trading errors, will have low expected losses but a high level of unexpected losses. Thus the capital requirement for such risks will be high.

It is also worthwhile mentioning high severity and low frequency risks - for example a rogue trader circumventing all controls and bringing the bank down, or a terrorist strike or natural disaster creating other losses - will probably have zero expected losses & high unexpected losses but only at very high levels of confidence. In other words, operational risk capital is unlikely to provide for such events and these would lie in the part of the tail that is not covered by most levels of confidence when calculating operational risk capital.

Note that risk capital is required for only unexpected losses as expected losses are to be borne by P & L reserves. Therefore the operational risk capital requirements for a low severity high frequency risk is likely to be low when compared to other risks that are lower frequency but higher severity.

Thus Choice 'c' is the correct answer.

The Basel II framework allows the use of the basic indicator approach, the standardized approach and the advanced measurement approaches for operational risk. There is no approach called the 'internal measurement approach' permitted for operational risk. Choice 'a' is therefore the correct answer.

There are multiple ways to incorporate scenario analysis for modeling operational risk capital - and the exact approach used depends upon the quantity of loss data available, and the quality of scenario assessments. Generally:

- If there is no past loss data available, scenarios are the only practical means to model operational risk loss distributions. Both frequency and severity estimates can be modeled based on scenario data.

- If there is plenty of past data available, scenarios can be used as a modifier for estimates that are based solely on data (for example, consider the MAX of the loss estimates at the desired quantile as provided by the data, and as indicated by scenarios)

- If high quality scenario data is available, and there is sufficient past data, one could mix scenario assessments with the loss data and fit the combined data set to create the loss distribution. Alternatively, both could be fitted with severity estimates and then the two severities could be parametrically combined.

In short, there is considerable flexibility in how scenarios can be used.

Statement I is therefore correct, and so is statement II as both indicate valid uses of scenarios.

Statement III is not correct because it may be okay to create severity estimates based on scenario data alone.

Statement IV is not correct because while using scenarios as modifiers to other means of estimation is acceptable, that is not the only use of scenarios.

KMV Moody's uses a proprietary database to convert the distance to default to expected default probabilities.

According to the option pricing approach developed by Merton, the shareholders of a firm have a put on the assets of the firm where the strike price is equal to the face value of the firm's debt. This is just a more complicated way of saying that the debt holders are entitled to all the assets of the firm if these assets are insufficient to pay off the debts, and because of limited liability of the shareholders of a corporation this part payment will fully extinguish the debt.

A firm will default on its debt if the value of the assets falls below the face value of the debt. Therefore Choice 'a' is the correct answer. All other choices are incorrect.

(There are two ways to consider this sort of optionality, and I have mentioned only one for this question:

1. The equity holders can sell the assets of the firm to the debt holders at a price equal to the face value of the debt, ie a put. (ie they can extinguish their liability to the debt holders in full by handing them the assets of the firm, effectively selling them the assets at the value of the debt)

2. The equity holders have a long position in a call option where they can keep the assets of the firm by paying a price equal to the face value of the debt (ie, they can pay off the debt holders and keep the assets)

For this question, perspective 1 applies but you should be aware of the second one too as a question may reference that view point.)

We will need to calculate the joint probability distribution of the portfolio as follows. Probability of the join t default of both A and B =

The marginal probabilities (ie the standalone probabilities of default of the two bonds) are known, and if we can calculate the probability of joint defaults of the two bonds, we can calculate the rest of the entries. We then multiply the probabilities with the expected loss under each scenario and add them up to get the total expected loss.

The calculations are shown below. The expected loss is $5.5m, and therefore the correct answer is Choice 'd'.

Credit risk is the risk from a borrower defaulting on moneys lent. Counterparty risk, on the other hand, is the risk that a counterparty to a derivative transaction will be unable to pay at the time the transaction is in-the-money.

Credit risk therefore relates more to the banking book, counterparty risk relates more to the trading book. Credit risk and counterparty risk differ in that for counterparty risk, the amount at risk fluctuates for counterparty risk depending upon the value of the underlying derivative. Counterparty risk generally starts at zero, for most swaps and other derivatives are near zero value at inception. Over time, as the prices of the underlying instruments move, one party ends up owing money to the other. A deterioration in the financial situation of the party owing moneys may lead to a loss to the other party, resulting in counterparty risk. Counterparty risk can also arise from stock lending operations and repo trades.

Credit risk on the other hand is the traditional risk of default by a borrower, or a bank's customer who has taken a loan or has an overdraft or other credit facility.

Statement I is therefore incorrect as credit risk and counterparty risks are different.

Statement II is correct as counterparty risk is 'contingent' in the sense it arises only if the transaction with the counterparty ends up being in-the-money, and the counterparty defaults.

Statement III is incorrect. The statement describes credit risk.

Statement IV is incorrect, as the exposure is known for moneys lent. Derivative exposures for the future are difficult to estimate, they can even turn from moneys owed to moneys due as the value of the underlying changes.