Risk Management, Compliance, Ethics and Governance

Introduction and context

Investment banking converts capital, information and relationships into transactions: underwriting securities, advising on mergers and acquisitions, arranging financing, making markets and distributing investment products. These activities create value, but they also expose the firm, its clients and the financial system to interconnected risks. A failed control may produce a direct financial loss, regulatory sanctions, litigation, loss of licence, damaged reputation and broader market instability.

Risk management is therefore not merely a back-office activity. It is a strategic discipline that influences which clients a bank accepts, which transactions it undertakes, how much capital it commits, how information is handled and how senior management is held accountable. Compliance establishes minimum legal and regulatory standards; ethics addresses the quality of decisions when rules are incomplete or competing interests exist; governance allocates authority, oversight and accountability.

This chapter examines the principal risks faced by investment banks and the systems used to manage them. It also considers conflicts of interest, insider information, information barriers, suitability, anti-money-laundering obligations, fiduciary responsibility and ethical decision-making.

Learning objectives

By the end of this chapter, the learner should be able to:

1. Distinguish market, credit, liquidity, operational, legal and reputational risk.
2. Explain how risk appetite, limits, escalation and the three-lines model support governance.
3. Interpret basic measures such as expected loss, value at risk and stress loss.
4. Analyse conflicts of interest, material non-public information and information barriers.
5. Explain suitability, know-your-customer and anti-money-laundering requirements.
6. Apply ethical reasoning to ambiguous investment-banking decisions.
7. Evaluate a transaction through an integrated risk and governance framework.

1. The architecture of risk governance

Risk, uncertainty and control

Risk is the possibility that an event will prevent an institution from achieving its objectives. It has at least three dimensions: the likelihood of an event, the magnitude of its consequences and the speed with which consequences emerge. Uncertainty is broader: outcomes or probabilities may be unknown. A risk framework must therefore combine quantitative measurement with judgement, scenario analysis and qualitative controls.

A useful distinction is between inherent risk and residual risk. Inherent risk exists before controls; residual risk remains after controls. Controls may reduce the probability of an event, its impact, or both. A control is effective only if it is appropriately designed, consistently performed and independently tested.

Risk appetite and limits

Risk appetite is the amount and type of risk a firm is willing to accept in pursuit of its objectives. A board-approved risk-appetite statement normally combines qualitative boundaries—such as zero tolerance for bribery—with quantitative limits on market positions, counterparty exposure, liquidity, leverage, concentration and operational loss.

Limits translate strategy into action. Examples include a maximum exposure to one counterparty, a maximum inventory of a security, a stop-loss threshold, a minimum liquidity buffer and a maximum concentration in a sector. Limits should have clear owners, reliable data, defined escalation procedures and consequences for breaches. A limit that is routinely exceeded without escalation is not a genuine control.

The three lines model

The first line consists of front-office and operational businesses that own risks and operate controls. The second line includes risk management and compliance, which set frameworks, challenge decisions and monitor adherence. The third line is internal audit, which independently evaluates governance, risk management and internal control. The board and its committees provide ultimate oversight, while external auditors and regulators provide additional scrutiny.

Independence is essential. A risk officer who reports solely to a revenue-producing desk may face pressure to approve transactions. Modern governance therefore commonly gives the chief risk officer and chief compliance officer direct access to the board or a board committee.

2. Principal risks in investment banking

Market risk

Market risk is the possibility of loss from changes in prices, rates, spreads, currencies, commodities or volatility. An underwriting desk may hold securities before distribution; a market-making desk may carry inventory; an advisory business may face foreign-exchange exposure through fees and expenses.

Common sensitivities include duration for interest-rate exposure, delta for linear price sensitivity to an underlying asset, vega for sensitivity to implied volatility and basis risk arising when related instruments do not move together. Hedging reduces exposure but does not eliminate it. A hedge may be imperfect because of maturity mismatch, basis movements, liquidity constraints, model error or counterparty default.

Value at Risk (VaR) estimates a loss threshold over a specified horizon and confidence level. In a simplified historical interpretation, a one-day 99% VaR of $10 million means that, under the model and data assumptions, losses are expected to exceed $10 million on approximately 1% of comparable days. It does not mean that the maximum possible loss is $10 million, nor does it predict the size of losses beyond the threshold.

Here, ΔP is the change in portfolio value over the chosen horizon, q_1−α is its (1−α) quantile, and α is the confidence level. The sign convention reports a positive loss threshold. The measure assumes that the estimation method, data and portfolio representation are appropriate. VaR is supplemented by stress testing and expected shortfall because it can obscure the severity of tail losses.

Expected shortfall at confidence level α is the average loss conditional on losses exceeding the VaR threshold:

where L is portfolio loss. Expected shortfall is more informative about tail severity, but it is sensitive to model specification and sparse extreme observations.

Credit risk

Credit risk is the possibility that a borrower, issuer, counterparty or guarantor fails to perform. It includes default risk, downgrade risk, settlement risk, concentration risk and wrong-way risk, where exposure increases as the counterparty’s credit quality deteriorates.

A basic expected-loss framework is:

PD is probability of default over the relevant horizon; LGD is loss given default, expressed as a proportion of exposure after recoveries and collateral; and EAD is exposure at default, measured in currency units. The formula assumes that the three estimates are defined over compatible horizons and that their dependence is either appropriately modelled or acceptable for the intended use. It is an average-loss estimate, not a forecast of the exact loss on a particular transaction.

For example, if PD = 2%, LGD = 45% and EAD = $20 million, then EL = 0.02 × 0.45 × $20 million = $180,000. The result supports pricing, provisioning and limit decisions, but it does not capture unexpected loss, market liquidity effects or systemic contagion.

Credit analysis combines financial statements, cash-flow forecasts, industry conditions, management quality, collateral, covenants, legal documentation and external ratings. Investment banks also manage counterparty exposure through netting agreements, collateral or margin, central clearing and credit limits.

Liquidity risk

Liquidity risk has two related forms. Funding liquidity risk is the inability to meet obligations when due. Market liquidity risk is the inability to sell or hedge a position quickly without materially affecting its price. A position may be profitable in a valuation model but dangerous if it cannot be monetised during stress.

Liquidity management includes cash forecasting, maturity analysis, diversified funding, committed facilities, unencumbered liquid assets, collateral monitoring and contingency funding plans. Stress scenarios should assume market-wide disruption, firm-specific reputational damage, collateral calls, withdrawal of wholesale funding and reduced market depth. Liquidity risk often amplifies other risks: a market loss can trigger margin calls, while a reputational event can accelerate withdrawals.

Operational risk

Operational risk arises from inadequate or failed processes, people, systems or external events. Examples include erroneous trade booking, cyberattack, model failure, unauthorised trading, settlement errors, vendor disruption and inadequate segregation of duties.

A strong operational-risk system maps critical processes, identifies key controls, records incidents and near misses, performs scenario analysis and tracks remediation. Important controls include maker-checker approval, reconciliations, access management, change control, business continuity, disaster recovery and independent review. Automation can reduce manual error but can also create concentrated failure if data, code or governance is weak.

Legal and regulatory risk

Legal risk includes unenforceable contracts, defective disclosures, invalid security interests, mis-selling claims and litigation. Regulatory risk includes breach of conduct, prudential, market-abuse, reporting, licensing or financial-crime requirements. Legal opinions, approved templates, transaction checklists and regulatory change management reduce exposure, but they do not replace professional judgement.

Documentation is a risk-control mechanism. Definitions of events of default, termination rights, representations, covenants, governing law, disclosure obligations and dispute resolution can determine whether a bank can enforce its rights during stress.

Reputational risk

Reputational risk is the possibility that stakeholder trust declines because of actual, alleged or perceived misconduct or failure. It may arise from market manipulation, aggressive sales practices, a controversial client, greenwashing, data misuse or poor treatment of employees. Reputation is difficult to quantify and can be affected by events outside the firm’s direct control.

Reputational risk should be considered during client onboarding, transaction approval, product design, communications and crisis response. A transaction can be legally permissible yet inconsistent with the firm’s stated values or stakeholder expectations. Reputational review should not become an informal veto without accountability; decisions and rationales should be documented.

3. Risk measurement and integrated assessment

Risk types interact. A leveraged acquisition may create credit exposure to the borrower, market exposure to underwriting inventory, liquidity exposure if distribution fails, legal exposure from documentation and reputational exposure if the target is controversial. Risk committees should therefore examine both individual metrics and aggregate scenarios.

Stress testing asks what happens under severe but plausible conditions. Examples include a parallel interest-rate increase, widening credit spreads, currency devaluation, a 30% equity-market decline, a cyber outage or the simultaneous failure of a major counterparty and a funding market. Reverse stress testing begins with an intolerable outcome—such as insolvency or a regulatory breach—and identifies combinations of events that could produce it.

Model risk deserves separate attention. A model may be wrong because its assumptions are unsuitable, its data are inaccurate, its implementation contains errors or users misunderstand its outputs. Model governance requires approval, validation, documentation, performance monitoring, change control and limits on use. Senior managers remain accountable for decisions; responsibility cannot be transferred to a model.

4. Conflicts of interest and information control

Conflicts of interest

A conflict exists when a firm’s interests, an employee’s interests or the interests of one client could improperly influence duties owed to another client. Investment banking creates structural conflicts because a firm may advise an acquirer, finance a target, underwrite securities and trade related instruments at the same time.

Conflicts may be actual, potential or perceived. Typical examples include:

• advising both sides of a transaction;
• allocating scarce securities among preferred clients;
• research coverage influenced by investment-banking fees;
• proprietary trading around client orders;
• compensation linked exclusively to transaction completion;
• gifts, entertainment or personal investments affecting judgement.

A sound framework identifies conflicts early, assesses whether they can be managed, discloses material conflicts clearly and declines or restricts the activity when controls are insufficient. Disclosure is not a universal cure: a client may not be able to evaluate complex conflicts, and consent may not legitimise abuse of confidential information.

Insider information and information barriers

Material non-public information (MNPI) is confidential information that a reasonable investor would consider important in making an investment decision, or information reasonably likely to affect a security’s price, and that has not been broadly disseminated. Examples include an undisclosed takeover, earnings information, a financing default or a major litigation outcome.

Trading while in possession of MNPI, tipping another person, recommending a transaction on that basis or misusing information may constitute market abuse or insider dealing, depending on applicable law. The precise legal tests differ across jurisdictions, so firms must apply local requirements and obtain legal advice where necessary.

Information barriers—often called Chinese walls—restrict the flow of confidential information between teams. Controls include restricted lists, watch lists, deal teams, need-to-know access, physical and digital segregation, recording of communications, personal-account dealing rules and surveillance. Barriers must be operational, not merely written policies. Senior personnel should understand when information must be escalated to compliance and when a wall-crossing is authorised.

Suitability and client protection

Suitability requires the firm to assess whether a recommendation or product is appropriate for a particular client, considering objectives, risk tolerance, financial capacity, knowledge, experience, time horizon and liquidity needs. Appropriateness assessments may apply where a client makes its own decision but the product is complex or risky. Classification of clients—such as retail, professional or eligible counterparty—can alter the applicable protections, but it does not justify misleading conduct.

A product’s complexity, leverage, loss potential and liquidity should be explained in a way the client can understand. Sales incentives, target-based remuneration and standardised risk labels should be reviewed for behavioural effects. A signed disclosure does not prove informed consent if the explanation was unclear or the product was unsuitable.

5. Financial crime compliance

Know your customer and customer due diligence

Know-your-customer (KYC) procedures establish who the client is, who ultimately owns or controls it, what its business is, where its funds originate and what activity is expected. Customer due diligence should be risk-based rather than purely mechanical. Enhanced due diligence may be required for politically exposed persons, high-risk jurisdictions, complex ownership structures, unusual transactions or sectors vulnerable to corruption.

A risk-based approach does not mean high-risk clients are automatically rejected. It means that the firm applies stronger verification, senior approval, monitoring and documentation where risk is higher. Customer information must be refreshed when circumstances change and retained in accordance with applicable law.

Anti-money laundering and counter-terrorist financing

Money laundering generally involves disguising proceeds of crime so they appear legitimate. A traditional description uses placement, layering and integration, although real cases may not follow these stages neatly. Terrorist financing may involve legitimate or illegitimate funds and focuses on their intended use.

An AML programme commonly includes governance, risk assessment, customer identification, beneficial-ownership verification, transaction monitoring, sanctions screening, suspicious-activity reporting, training, recordkeeping and independent testing. Employees should not alert a client that a suspicious-activity report has been or may be filed. Reporting duties, thresholds and terminology vary by jurisdiction; firms must follow local law and regulatory guidance.

AML controls can generate false positives and may unfairly exclude legitimate customers. Effective systems combine technology with trained investigators, quality assurance, escalation and periodic testing. Artificial intelligence may prioritise alerts, but explainability, data quality, bias testing, human review and audit trails remain essential.

6. Fiduciary responsibility, ethics and decision-making

A fiduciary duty requires a person or institution to act with loyalty, care and good faith for another’s benefit where the relationship and law impose such obligations. Not every investment-banking relationship is fiduciary, and duties vary by jurisdiction, contract, service and client category. Nevertheless, loyalty, confidentiality, care and fair dealing are central professional expectations.

Ethics becomes most important where the law is silent or a technically compliant action could still harm clients or markets. A practical ethical decision process is:

1. Identify affected stakeholders and the decision’s consequences.
2. Establish the relevant facts and distinguish facts from assumptions.
3. Identify legal duties, firm policies, professional principles and conflicts.
4. Generate alternatives, including declining or escalating the matter.
5. Test options for legality, fairness, transparency, reversibility and consistency with the firm’s values.
6. Seek independent challenge from compliance, legal, risk or an ethics committee.
7. Decide, document the rationale and monitor outcomes.

This approach combines duty-based reasoning—what obligations apply—with consequence-based reasoning—what harms and benefits may result—and virtue-based reasoning—what a trustworthy professional would do. Ethical culture is strengthened when employees can speak up without retaliation, compensation does not reward misconduct, leaders acknowledge mistakes and disciplinary standards apply consistently.

7. Governance in transaction execution

A transaction should pass through defined gates rather than relying on informal optimism. A typical governance sequence is:

1. Client acceptance: KYC, sanctions, ownership, reputation and conflicts review.
2. Strategic and suitability review: purpose, client objectives, product complexity and capacity.
3. Risk assessment: market, credit, liquidity, operational, legal and reputational analysis.
4. Independent challenge: risk, compliance and legal review with documented conditions.
5. Approval and execution: delegated authorities, segregation of duties and controlled communications.
6. Monitoring: limits, covenants, collateral, complaints, suspicious activity and emerging risks.
7. Closure and lessons learned: settlement, records, post-transaction review and remediation.

Committees should receive complete and decision-useful information. Dashboards should show limit utilisation, breaches, aged exceptions, incidents, stress results, conduct indicators and remediation status. Green indicators are not evidence of safety if data are delayed or controls are poorly designed.

8. Illustrative case: a contested acquisition financing

Background

This illustrative case concerns Meridian Bank, advising Northstar Holdings on a proposed acquisition of Atlas Components. Meridian is also asked to provide bridge financing and to underwrite bonds that will refinance the bridge. A separate Meridian trading desk makes markets in Atlas’s shares.

Problem

During due diligence, the advisory team learns that Atlas may face a material product-liability claim. The information is not public. Northstar wants to proceed quickly, and the financing team argues that delay could cause the mandate to be lost. The trading desk holds Atlas shares for market-making. At the same time, Atlas’s ownership structure includes an offshore entity whose beneficial owner has not been satisfactorily verified.

Analysis

The product-liability information may be MNPI. The advisory team cannot pass it to the trading desk or use it to trade. Compliance should place Atlas on a restricted or watch list as appropriate, wall-cross relevant personnel, control communications and assess whether disclosures are required. The trading desk’s existing inventory must be managed under applicable rules and policies.

The financing creates credit, market and liquidity risks. Credit analysis must consider the claim, leverage, cash-flow resilience and covenant headroom. Underwriting risk arises if bond-market conditions deteriorate before distribution. Stress testing should examine a larger-than-expected legal settlement, wider spreads, lower earnings and a failed syndication.

The unresolved beneficial ownership issue creates AML and sanctions risk. Meridian should not rely on commercial urgency to bypass verification. The relationship should be escalated to financial-crime compliance, and the bank should decline or pause the transaction if ownership cannot be established satisfactorily.

Conflicts also exist because Meridian advises Northstar, finances the acquisition, underwrites securities and operates a trading desk. These conflicts require disclosure, structural separation, independent review and fair allocation procedures. If the conflicts cannot be managed without undermining client protection or market integrity, Meridian should refuse one or more roles.

Approach and outcome

Meridian pauses execution, completes enhanced due diligence, establishes an information barrier and obtains independent legal and compliance advice. The product-liability exposure is disclosed in transaction materials, the financing is resized to preserve covenant headroom, and underwriting authority is conditioned on market and liquidity limits. The trading desk is restricted from activity based on the confidential information, with surveillance enhanced.

The transaction proceeds only after senior approval confirms that the AML issue is resolved, disclosures are accurate and risk-adjusted returns justify the residual exposure. The post-transaction review identifies a need for faster escalation of beneficial-ownership concerns and clearer compensation measures that do not reward speed over control quality.

Learning points

The case demonstrates that risk categories overlap. MNPI is simultaneously a conduct, legal, reputational and market-integrity concern. Commercial pressure is not a control framework. A transaction should be delayed or rejected where critical facts cannot be verified, conflicts cannot be managed or the firm cannot explain its decision to clients, regulators and its own board.

9. Challenges, limitations and contemporary developments

Risk measurement is constrained by incomplete data, unstable correlations, model assumptions and behavioural responses. Historical data may not represent a new crisis. Quantitative limits can encourage employees to manage to the metric rather than the underlying risk. Compliance systems can become checklist exercises, while excessive controls may slow legitimate business and encourage workarounds.

Digital platforms, cloud providers, algorithmic trading, cyber threats and generative AI create new control questions. Firms should define permitted uses of AI, protect confidential information, validate outputs, monitor bias and hallucination, preserve records and ensure human accountability. AI-generated client communications or analytical outputs should be reviewed according to their risk and materiality.

Climate, biodiversity, geopolitical fragmentation and supply-chain disruption increasingly affect credit, market, operational and reputational risk. Scenario analysis should consider transition risk, physical risk and uncertainty rather than presenting long-term estimates as precise forecasts. Regulatory expectations continue to evolve, so policies must be jurisdiction-sensitive and regularly updated.

Best practice includes a strong tone from the top, clear ownership, independent challenge, risk-adjusted remuneration, reliable data, tested controls, transparent escalation, documented exceptions, regular training and a learning-oriented incident culture. Good governance is demonstrated not when no problems are reported, but when problems are detected early, communicated honestly and corrected effectively.

Chapter Summary

Investment banking risk management is an integrated discipline covering market, credit, liquidity, operational, legal, regulatory and reputational risk. Risk appetite translates strategy into limits, while the three-lines model allocates ownership, challenge and independent assurance. VaR, expected shortfall, expected loss and stress testing support decisions but depend on data, assumptions and judgement.

Conflicts of interest must be identified, managed, disclosed and, where necessary, avoided. MNPI requires strict information control, surveillance and restrictions on trading and tipping. Suitability and client-protection duties require firms to understand client objectives, capacity and experience. KYC, beneficial-ownership checks, transaction monitoring and suspicious-activity reporting are central to AML compliance.

Ethical conduct extends beyond technical legal compliance. Fiduciary and professional responsibilities require loyalty, care, confidentiality, fair dealing and willingness to escalate concerns. Effective governance combines accountable leadership, independent challenge, documented decisions, tested controls and a culture in which commercial success never overrides market integrity or client protection.

Key Terms

Risk appetite: The amount and type of risk an institution is willing to accept.

Inherent risk: Risk present before controls are applied.

Residual risk: Risk remaining after controls are applied.

Market risk: Potential loss from changes in market prices, rates, spreads, currencies or volatility.

Credit risk: Potential loss when a borrower or counterparty fails to perform.

Liquidity risk: Risk of being unable to meet obligations or transact without material price impact.

Operational risk: Loss arising from failed processes, people, systems or external events.

Reputational risk: Potential loss of stakeholder trust caused by actual or perceived misconduct or failure.

Value at Risk: A model-based loss threshold at a specified confidence level and horizon.

Expected loss: Average credit loss estimated using probability of default, loss given default and exposure at default.

Stress testing: Analysis of outcomes under severe but plausible conditions.

Model risk: Risk that a model or its use produces unreliable conclusions.

Conflict of interest: A situation in which competing interests may improperly influence duties or decisions.

Material non-public information: Important confidential information not broadly available to the market.

Information barrier: A control restricting confidential information between business areas.

Suitability: Assessment of whether a product or recommendation fits a client’s circumstances and objectives.

Know your customer: Processes for identifying and understanding a client and its activities.

Beneficial owner: The natural person who ultimately owns or controls an entity.

Fiduciary duty: A legally or professionally imposed duty of loyalty, care and good faith toward another party.

Three lines model: Allocation of risk ownership, oversight and independent assurance across business, control functions and internal audit.

Review Questions

Short Answer Questions

1. Distinguish inherent risk from residual risk.
2. What does a one-day 99% VaR estimate communicate, and what does it not communicate?
3. Identify three controls used to manage material non-public information.
4. Why is beneficial-ownership verification important in AML compliance?
5. Explain the difference between funding liquidity risk and market liquidity risk.

Long Answer Questions

1. Explain how the three-lines model supports investment-bank governance, including its limitations.
2. Discuss how conflicts of interest arise when a bank advises, finances and underwrites the same transaction.
3. Compare expected loss, VaR, expected shortfall and stress testing as risk-management tools.
4. Analyse the relationship between compliance, ethical culture and fiduciary responsibility.
5. Describe a risk-based AML programme and explain why a purely checklist-driven approach is inadequate.

Analytical / Application Questions

1. A bank estimates probability of default at 3%, loss given default at 40% and exposure at default at $50 million. Calculate expected loss and explain two limitations of the result.
2. An advisory team receives confidential information about a possible takeover while the firm’s market-making desk holds shares in the target. Design an immediate control response and identify the principal legal, conduct and reputational risks.
3. Evaluate whether a bank should proceed with a profitable financing for a client whose beneficial ownership remains unresolved and whose proposed leverage fails the bank’s stress tests. Justify your recommendation using risk, compliance and ethical reasoning.

Multiple Choice Questions with Answers

Question 1

Which risk is most directly associated with changes in interest rates, foreign-exchange rates and security prices?

A. Market risk

B. Operational risk

C. Legal risk

D. AML risk

Correct Answer: A. Market risk

Question 2

If probability of default is 2%, loss given default is 45% and exposure at default is $20 million, what is expected loss?

A. $18,000

B. $180,000

C. $900,000

D. $2 million

Correct Answer: B. $180,000

Question 3

What is the principal limitation of VaR identified in the chapter?

A. It cannot be expressed in currency units

B. It always overstates tail losses

C. It does not describe the severity of losses beyond its threshold

D. It applies only to credit portfolios

Correct Answer: C. It does not describe the severity of losses beyond its threshold

Question 4

Which function represents the third line in the three-lines model?

A. Front-office business

B. Compliance

C. Risk management

D. Internal audit

Correct Answer: D. Internal audit

Question 5

Which action is most appropriate when an employee receives material non-public information?

A. Share it with preferred clients

B. Trade before the information becomes public

C. Escalate it and follow information-barrier controls

D. Post an informal summary online

Correct Answer: C. Escalate it and follow information-barrier controls

Question 6

What is the main purpose of beneficial-ownership verification?

A. To improve marketing segmentation

B. To identify the natural persons who ultimately own or control an entity

C. To guarantee the client’s profitability

D. To eliminate all credit risk

Correct Answer: B. To identify the natural persons who ultimately own or control an entity

Question 7

Which statement best describes market liquidity risk?

A. The risk that a borrower defaults

B. The risk that a firm cannot sell or hedge a position without materially affecting its price

C. The risk that a contract is legally unenforceable

D. The risk that a model contains a coding error

Correct Answer: B. The risk that a firm cannot sell or hedge a position without materially affecting its price

Question 8

Why may disclosure alone fail to manage a conflict of interest?

A. Disclosure is prohibited in all transactions

B. Clients may not understand complex conflicts, and consent may not legitimise abuse

C. Disclosure automatically creates insider information

D. Disclosure eliminates the need for supervision

Correct Answer: B. Clients may not understand complex conflicts, and consent may not legitimise abuse

Question 9

Which practice is most consistent with a risk-based AML programme?

A. Applying identical review procedures to every client

B. Rejecting every client from a foreign jurisdiction

C. Applying enhanced due diligence where risk factors are higher

D. Relying only on an automated alert system

Correct Answer: C. Applying enhanced due diligence where risk factors are higher

Question 10

What is the strongest reason for using stress testing alongside quantitative risk metrics?

A. Stress testing removes the need for governance

B. Stress testing explores severe scenarios that historical metrics may not capture well

C. Stress testing guarantees that losses will not occur

D. Stress testing measures only reputational risk

Correct Answer: B. Stress testing explores severe scenarios that historical metrics may not capture well