Foundations of Risk Management

Introduction and Context

Risk management is the systematic process through which individuals and organizations identify uncertain events, assess their possible consequences, choose appropriate responses, and monitor results. It is central to accounting and finance because financial decisions are made under conditions in which future cash flows, prices, interest rates, exchange rates, credit outcomes, and operating conditions are not known with certainty.

A bank deciding whether to lend, an investor selecting securities, a manufacturer agreeing to sell goods in a foreign currency, and a company purchasing insurance are all making risk-management decisions. Derivatives—including forwards, futures, options, and swaps—are important tools in this process, but they are only tools. Effective risk management begins with understanding the underlying exposure and the organization’s objectives.

Risk management does not mean eliminating every risk. Risk is often the source of return, innovation, and competitive advantage. The purpose is to understand which risks are acceptable, which should be reduced or transferred, which should be retained deliberately, and which opportunities justify taking additional risk.

Learning Objectives

After studying this chapter, you should be able to:

• explain risk, uncertainty, exposure, loss, and opportunity;
• distinguish systematic risk from idiosyncratic risk;
• classify financial and non-financial risks;
• describe the risk management cycle;
• explain the rationale for insurance and financial hedging;
• apply basic risk concepts to an organizational case;
• evaluate the limitations and governance requirements of risk management.

1. Risk, Uncertainty, Exposure, Loss, and Opportunity

Risk

Risk is the possibility that an uncertain event will produce an outcome different from the outcome desired or expected. In finance, risk is often associated with variability in returns or cash flows. In a broader organizational context, risk includes threats to people, assets, reputation, compliance, strategy, and business continuity.

A useful formulation is that risk has three elements:

1. an uncertain event or condition;
2. a possible consequence; and
3. an effect on objectives.

For example, an exporter may face the possibility that a foreign currency will depreciate before payment is received. The event is exchange-rate movement, the consequence may be a lower domestic-currency receipt, and the affected objective is expected profitability.

Risk is not identical to danger. A dangerous event may never occur, whereas risk concerns the possibility and consequences of alternative outcomes. Nor is risk necessarily negative: favorable price movements, successful innovation, and unexpected demand can create gains.

Uncertainty

Uncertainty refers to incomplete knowledge about future events, their probabilities, or their consequences. Frank Knight’s distinction between measurable risk and true uncertainty remains useful. Where probabilities can be estimated from reliable data or defensible models, the situation is often described as risk. Where probabilities are unknown or highly unreliable, the situation is closer to uncertainty in the stronger sense.

The distinction is not absolute. Probability estimates may be based on historical observations, statistical models, expert judgment, or scenario analysis. Each source has limitations. A model can provide precise numerical probabilities while still being unreliable if conditions change or the data do not represent the future.

Exposure

Exposure is the extent to which an entity’s value, income, cash flow, or objectives are affected by a risk factor. Exposure exists before a loss occurs. A company with a foreign-currency receivable has exchange-rate exposure even if the currency ultimately moves favorably.

Common forms include:

• transaction exposure: effect of exchange rates on contracted foreign-currency cash flows;
• economic exposure: longer-term effect of market changes on competitive position and business value;
• translation exposure: accounting effect of converting foreign subsidiaries’ financial statements into the reporting currency;
• interest-rate exposure: sensitivity of borrowing costs, asset values, or cash flows to interest-rate changes;
• commodity-price exposure: sensitivity to input or output prices;
• credit exposure: amount that may be lost if a counterparty fails to perform.

Exposure can be expressed in physical units, monetary units, or sensitivity terms. If a firm must purchase 1,000,000 litres of fuel over three months, its physical fuel exposure is 1,000,000 litres. Its financial exposure depends on the price per litre and the timing of purchases.

Loss

A loss is an adverse consequence that reduces wealth, income, liquidity, productive capacity, or the achievement of an objective. Loss may be immediate, such as a payment default, or indirect, such as reputational damage that reduces future sales. Accounting loss and economic loss are not always identical. An accounting statement may recognize an impairment at a particular time, while the economic decline in value may have begun earlier.

Losses can be:

• direct, such as damage to inventory;
• indirect, such as business interruption after damage;
• known and measurable, such as a contractual penalty;
• contingent, such as a possible legal liability; or
• systemic, where many institutions are affected simultaneously.

Opportunity

Opportunity is a favorable potential outcome associated with uncertainty. A company may accept a risk because it creates a prospect of increased return, market access, innovation, or strategic advantage. For example, entering a new market may expose a firm to political and demand risks but also provide growth opportunities.

Modern risk management therefore considers both threats and opportunities. Excessive risk avoidance may destroy value by preventing worthwhile investment. A sound decision compares expected benefits, downside consequences, risk capacity, and strategic objectives.

2. A Simple Probability-and-Impact Framework

A basic risk assessment considers the likelihood of an event and the magnitude of its consequence. If discrete outcomes are known and probabilities are assigned, the expected value is:

Here, E(X) is the expected value of outcome X, pᵢ is the probability of outcome i, and xᵢ is the value of that outcome. The probabilities must satisfy 0 ≤ pᵢ ≤ 1 and ∑ᵢ pᵢ = 1. Expected value is a probability-weighted average; it is not a prediction that the average outcome will actually occur.

For a two-outcome project with a 40% probability of a $20,000 gain and a 60% probability of a $10,000 loss:

The positive expected value does not remove the possibility of the $10,000 loss. A decision-maker must also consider variability, liquidity, risk aversion, and the organization’s ability to absorb the loss.

For outcomes with probabilities, variance measures dispersion around the expected value:

The standard deviation is σ_X = √Var(X). It has the same units as X, which makes it easier to interpret than variance. These measures are useful for market and portfolio analysis when the probability model is reasonably appropriate. They are less reliable when outcomes are highly non-linear, distributions have extreme tails, or probabilities are poorly estimated.

A qualitative risk matrix may classify likelihood and impact as low, medium, or high. Such matrices support communication and prioritization, but they can conceal important differences. Two risks classified as “high” may have completely different frequencies, timing, reversibility, and financial consequences. Quantitative analysis should therefore be used where the data and decision justify it.

3. Systematic and Idiosyncratic Risk

Systematic risk

Systematic risk is risk arising from broad economic, financial, political, or market factors that affect many assets or organizations. Examples include inflation shocks, economy-wide recessions, major changes in interest rates, widespread financial crises, and global disruptions.

Because systematic risk affects many investments simultaneously, it cannot generally be eliminated through diversification. Investors may demand compensation for bearing systematic risk. In the capital asset pricing model, the expected return on an asset is represented as:

where E(Rᵢ) is the expected return on asset i, R_f is the risk-free rate for the relevant period and currency, βᵢ measures the asset’s sensitivity to market returns, and E(R_M) is the expected market return. The term E(R_M) − R_f is the expected market risk premium.

The model assumes, among other things, a suitable market portfolio, consistent expectations, and a linear relationship between expected return and systematic risk. It is a theoretical model, not a complete description of all observed returns. Beta is an estimate that may vary over time and across markets.

Idiosyncratic risk

Idiosyncratic risk, also called unsystematic, diversifiable, or specific risk, arises from factors particular to an entity or asset. Examples include a factory fire at one company, fraud by a particular employee, a product defect, or the loss of a single major customer.

A diversified portfolio can reduce idiosyncratic risk because unfavorable outcomes affecting one asset may be offset by outcomes affecting others. Diversification does not guarantee protection: assets may become highly correlated during crises, and some risks classified as “specific” may spread through supply chains or financial networks.

Practical distinction

The distinction is useful but not perfect. A cyberattack on one firm is initially idiosyncratic, yet a widespread attack on critical infrastructure can become systemic. Risk classification must therefore consider scale, interconnectedness, and transmission channels.

4. Classification of Risk

No single classification system is universally correct. Organizations use classifications that support accountability and decision-making. The following distinction between financial and non-financial risk is particularly useful in accounting and finance.

Financial risks

Financial risk directly affects prices, financial statements, cash flows, funding, or counterparty performance.

Market risk is the possibility of loss from changes in market prices or rates. It includes equity-price, interest-rate, foreign-exchange, and commodity-price risk.

Credit risk is the possibility that a borrower, issuer, customer, or counterparty fails to meet contractual obligations. It includes default risk, settlement risk, and concentration risk.

Liquidity risk has two related forms. Funding liquidity risk is the inability to meet obligations when due. Market liquidity risk is the inability to sell or offset a position quickly without a substantial price concession.

Solvency or capital risk concerns the possibility that losses reduce capital below the level needed to remain viable or meet regulatory requirements.

Interest-rate risk affects both cash flows and valuations. A floating-rate borrower may face higher interest payments when rates rise, while the market value of a fixed-rate bond generally falls when market yields rise, holding other factors constant.

Foreign-exchange risk arises when currency movements affect transactions, reported results, or competitive position.

Commodity risk affects organizations exposed to energy, metals, agricultural products, or other raw materials.

Model risk is the possibility that a model is incorrectly specified, poorly implemented, based on unsuitable data, or misinterpreted.

Non-financial risks

Non-financial risks may ultimately produce financial consequences but do not originate primarily from market prices or financing.

• Operational risk: failure of people, processes, systems, or external events.
• Legal and regulatory risk: breach of law, regulation, contract, or professional duty.
• Strategic risk: failure of business choices, implementation, or adaptation.
• Reputational risk: loss of trust among customers, investors, employees, or regulators.
• Conduct and ethical risk: behavior that harms stakeholders or violates professional standards.
• Cyber and information risk: unauthorized access, disruption, manipulation, or loss of data.
• Environmental and social risk: effects associated with climate, pollution, labor practices, communities, and human rights.
• Political and sovereign risk: actions or instability associated with governments and jurisdictions.
• People risk: inadequate skills, misconduct, absence, or succession failure.

These categories overlap. A cyber incident is operational in origin, legal in consequence, reputational in effect, and financial in ultimate impact. Risk registers should record causal relationships rather than treating categories as isolated boxes.

5. The Risk Management Cycle

The risk management cycle is a recurring process rather than a one-time exercise.

1. Establish objectives and context

Management first defines organizational objectives, risk appetite, constraints, time horizon, stakeholders, and decision criteria. Risk cannot be evaluated without knowing what it may affect. A bank, for example, may prioritize solvency and liquidity, whereas a trading desk may prioritize daily market exposure within a defined mandate.

Risk appetite expresses the amount and type of risk an organization is willing to pursue or retain. Risk capacity is the maximum risk the organization can absorb without threatening its survival or essential obligations. Appetite must not exceed capacity.

2. Identify risks and exposures

Identification uses interviews, process mapping, financial analysis, scenario workshops, contract review, incident data, and external intelligence. The analysis should identify sources, affected objectives, timing, dependencies, existing controls, and possible interactions.

A useful exposure statement specifies the risk factor, direction, amount, time horizon, and affected measure. “The company has currency risk” is less useful than “The company expects to receive €5 million in 90 days and loses domestic-currency value if the euro depreciates.”

3. Analyze risk

Analysis estimates likelihood, severity, timing, correlation, persistence, and control effectiveness. Methods range from qualitative judgment to sensitivity analysis, scenario analysis, stress testing, statistical models, and simulation.

Sensitivity analysis changes one or more assumptions to observe the effect on an output. Stress testing examines severe but plausible conditions. Scenario analysis combines several related changes, such as recession, currency depreciation, customer default, and higher funding costs.

4. Evaluate and prioritize

The organization compares analyzed risks with its appetite, capacity, legal obligations, and strategic priorities. High-impact risks may require attention even when their probability is low. A risk that threatens survival cannot be ignored solely because it is infrequent.

5. Treat the risk

Typical responses are:

• avoid: discontinue the activity creating unacceptable exposure;
• reduce: lower likelihood or impact through controls;
• transfer or share: use insurance, contracts, outsourcing, or derivatives;
• retain: accept the risk consciously, often with reserves or limits;
• exploit or increase: accept additional risk to pursue a valuable opportunity.

Treatment should address residual risk—the risk remaining after controls—not merely inherent risk before controls.

6. Monitor, report, and improve

Risk indicators, limits, incidents, near misses, control tests, valuation reports, and exceptions should be monitored. Reporting must reach the people able to act. The cycle should be revised when strategies, markets, regulations, technology, or exposures change.

6. The Rationale for Hedging

Hedging is a risk-reduction strategy that takes a position intended to offset an existing exposure. A firm with a future foreign-currency receipt may sell that currency forward. A borrower with floating-rate debt may use an interest-rate swap to obtain more predictable payments. An airline may use fuel derivatives to reduce exposure to rising fuel prices.

The objective is usually not to profit from forecasting markets. It is to reduce undesirable variability in cash flows, earnings, asset values, or financial ratios. Hedging can support budgeting, investment planning, debt-service capacity, covenant compliance, and organizational survival.

Natural and financial hedges

A natural hedge offsets exposures through normal operations. An exporter earning U.S. dollars may purchase materials priced in U.S. dollars, so dollar inflows and outflows partially offset. A financial hedge uses a contract such as a forward, futures contract, option, or swap.

Basic forward example

Assume a company will receive €1,000,000 in 90 days. The current spot rate is $1.08 per euro, but the 90-day forward rate is $1.07 per euro. Ignoring transaction costs, credit risk, and accounting effects, the company can sell euros forward and lock in:

Without hedging, the dollar receipt would be:

where S_T is the spot price in dollars per euro at maturity. If S_T = $1.00/€, the unhedged receipt is $1,000,000, below the forward-locked amount. If S_T = $1.15/€, the unhedged receipt is $1,150,000, above the locked amount. The forward removes much of the uncertainty but also removes the benefit of a favorable currency movement.

This example illustrates the central trade-off: hedging reduces downside variability at the cost of surrendering some upside. A hedge may also introduce basis risk, which occurs when the hedging instrument does not move exactly opposite to the underlying exposure. Other risks include counterparty, liquidity, rollover, operational, legal, and model risk.

Derivatives are not automatically hedges

A derivative is a contract whose value depends on an underlying variable, such as an exchange rate, interest rate, commodity price, equity price, or credit spread. A derivative used to offset an existing exposure can be a hedge. A derivative entered into without a corresponding exposure may instead be a speculative position. Both can be legitimate, but they have different purposes, risk profiles, controls, and reporting implications.

Options differ from forwards because an option provides a right rather than an obligation. The buyer pays a premium for protection while retaining the possibility of benefiting from favorable movements. This flexibility can be valuable, but the premium may be substantial.

7. Illustrative Case: Meridian Components Ltd.

Background

Meridian Components Ltd., a fictional manufacturer, imports electronic components from Japan and sells finished products in its domestic market. It has committed to pay ¥600 million in 90 days. Its sales revenue is mainly in domestic currency. The company’s budget assumes an exchange rate of $0.0068 per yen.

Problem

A stronger yen would increase the domestic-currency cost of the components and reduce the expected gross margin. Management is uncertain whether to hedge the full amount, hedge part of it, or remain unhedged because the yen might weaken.

Analysis

The company has a transaction exposure of ¥600 million. At the budget rate, the expected domestic-currency cost is:

The treasury team identifies several relevant issues:

• the payment amount and date are contractually specified;
• the company has limited capacity to absorb a large margin reduction;
• the purchase is not an attempt to profit from currency movements;
• a forward could lock the cost, while an option would preserve favorable upside but require a premium;
• a partial hedge may be appropriate if the purchase quantity or timing is uncertain;
• counterparty limits, documentation, valuation, and accounting treatment must be addressed.

Suppose a 90-day forward is quoted at $0.0069 per yen. A full forward hedge would create a locked cost of:

The additional certainty costs $60,000 relative to the budget rate, but it protects the margin from an adverse appreciation of the yen. If management instead buys a call option on yen, it pays a premium. The option protects against a rising yen while allowing Meridian to benefit if the yen falls, but the premium reduces the benefit.

Approach and solution

The board approves a policy under which committed foreign-currency purchases are hedged between 75% and 100%, depending on certainty of amount and timing. Meridian hedges 100% of the confirmed ¥600 million payable with a forward. It separately monitors forecast purchases that are not yet committed and does not hedge them automatically.

The policy also requires segregation of duties: the operating department forecasts the exposure, treasury executes approved hedges, risk control independently confirms positions, and accounting records the transaction under applicable reporting requirements.

Outcome

Meridian achieves predictable domestic-currency procurement cost for the confirmed purchase. It does not profit if the yen weakens, but it avoids allowing an exchange-rate movement to undermine a planned operating margin. The company retains flexibility for uncertain future purchases and limits speculation.

Learning points

1. The exposure must be identified before selecting a derivative.
2. Hedge size should reflect the certainty of the underlying cash flow.
3. A hedge is assessed by how well it supports objectives, not by whether it produces a trading profit.
4. Governance, documentation, valuation, and counterparty controls are essential.
5. Operational and accounting consequences can be as important as the contract’s market value.

8. Governance, Ethics, and Regulation

Risk management is also a governance responsibility. The board should approve risk appetite, receive reliable reporting, and ensure that risk management is independent enough to challenge business decisions. Senior management should assign accountability and ensure adequate resources.

Important controls include authorization limits, segregation of duties, independent confirmation, collateral and margin monitoring, valuation controls, model validation, access controls, staff competence, and documented escalation procedures. Internal audit provides independent assurance but does not replace management responsibility.

Ethical risk arises when employees conceal losses, manipulate valuations, exceed mandates, misrepresent hedges, or prioritize bonuses over the organization’s long-term interests. Transparent reporting should communicate uncertainty, assumptions, concentrations, stress results, and residual exposures rather than presenting false precision.

Financial institutions and public companies may face extensive regulatory requirements concerning capital, liquidity, derivatives reporting, clearing, margin, disclosure, and accounting. Requirements differ by jurisdiction and product. Students and practitioners must consult current standards and regulations rather than relying on a general description.

9. Technology and Contemporary Developments

Technology supports risk identification and monitoring through automated data collection, dashboards, real-time limits, anomaly detection, and scenario analysis. Artificial intelligence can assist with fraud detection, text analysis, forecasting, and early-warning indicators. However, AI introduces model risk, data-quality risk, privacy concerns, explainability problems, cyber risk, and the danger of overreliance on historical patterns.

Climate change, geopolitical fragmentation, supply-chain concentration, cyber dependence, and rapid digitalization have increased attention to interconnected and non-financial risks. A risk that appears remote in ordinary statistical data may become severe under changing conditions. Consequently, organizations increasingly combine historical analysis with forward-looking scenarios, reverse stress tests, expert judgment, and resilience planning.

Technology should improve judgment rather than replace accountability. Automated alerts are useful only when exposures are correctly measured and someone has authority and competence to respond.

10. Limitations and Best Practices

Risk models are simplifications. Historical data may not represent structural breaks; correlations may change; rare events are difficult to estimate; liquidity may disappear during stress; and accounting measures may lag economic reality. Expected value and standard deviation alone cannot describe skewed or fat-tailed outcomes. A low-probability event may still require preparation if its impact is catastrophic.

Best practice includes:

• link risk assessment to explicit objectives;
• distinguish inherent, controlled, and residual risk;
• measure both financial and non-financial consequences;
• combine quantitative models with expert judgment;
• test severe but plausible scenarios;
• identify concentrations and dependencies;
• hedge only understood exposures;
• avoid confusing risk reduction with risk elimination;
• document assumptions, limits, approvals, and exceptions;
• review models and controls after incidents and market changes;
• align incentives with long-term, risk-adjusted performance.

A mature organization treats risk management as part of decision-making, not as a compliance exercise performed after decisions have been made.

Chapter Summary

Risk is the possibility that uncertain events will affect objectives. Uncertainty concerns incomplete knowledge; exposure is the sensitivity of value or objectives to a risk factor; loss is an adverse consequence; and opportunity is a favorable potential outcome. Risk can be measured through probabilities and impacts, but numerical precision does not guarantee reliable knowledge.

Systematic risk arises from broad forces and generally cannot be eliminated through diversification, whereas idiosyncratic risk is specific to an asset or organization and can often be reduced through diversification and controls. Financial risks include market, credit, liquidity, interest-rate, foreign-exchange, commodity, capital, and model risk. Non-financial risks include operational, legal, strategic, reputational, cyber, environmental, political, and people risks.

The risk management cycle involves establishing context, identifying exposures, analyzing and evaluating risk, selecting treatment, and monitoring outcomes. Responses include avoidance, reduction, transfer, retention, and deliberate acceptance of opportunity. Hedging uses natural or financial offsets to reduce unwanted variability. Derivatives can support hedging, but they introduce their own risks and require governance.

Effective risk management is objective-driven, forward-looking, ethically governed, and continuously revised. It seeks an appropriate balance between protection and opportunity rather than the impossible goal of eliminating all uncertainty.

Key Terms

Risk: Possibility that uncertainty affects objectives.

Uncertainty: Incomplete or imperfect knowledge about future events and outcomes.

Exposure: Sensitivity of value, cash flow, or objectives to a risk factor.

Loss: An adverse reduction in wealth, income, capacity, or objective achievement.

Opportunity: A favorable potential outcome arising from uncertainty.

Systematic risk: Broad market or economy-wide risk that generally cannot be diversified away.

Idiosyncratic risk: Entity- or asset-specific risk that can often be reduced through diversification.

Market risk: Risk from changes in prices, rates, or market variables.

Credit risk: Risk that a counterparty fails to perform its obligation.

Liquidity risk: Risk of being unable to meet obligations or transact without substantial price impact.

Operational risk: Risk arising from failed people, processes, systems, or external events.

Risk appetite: Amount and type of risk an organization is willing to pursue or retain.

Risk capacity: Maximum risk an organization can absorb without threatening viability.

Inherent risk: Risk before considering controls or treatments.

Residual risk: Risk remaining after controls or treatments.

Hedging: Taking an offsetting position to reduce an existing exposure.

Natural hedge: Operational offset between related inflows and outflows.

Derivative: Contract whose value depends on an underlying asset, rate, price, or index.

Basis risk: Risk that a hedge and the underlying exposure do not move together exactly.

Model risk: Risk of loss from incorrect, unsuitable, or misused models.

Review Questions

Short Answer Questions

1. Distinguish risk from uncertainty.
2. What is meant by an organization’s exposure?
3. Give two examples of systematic risk and two examples of idiosyncratic risk.
4. Explain the difference between risk appetite and risk capacity.
5. Why does a forward contract reduce currency uncertainty but also remove favorable upside?

Long Answer Questions

1. Explain the risk management cycle and show how each stage contributes to organizational decision-making.
2. Compare financial and non-financial risks, using examples of how one event can belong to several categories.
3. Discuss the role of diversification in managing idiosyncratic risk and explain why it does not eliminate systematic risk.
4. Explain the rationale for hedging and evaluate the advantages and disadvantages of forwards and options.
5. Discuss the governance and ethical requirements for effective derivatives risk management.

Analytical / Application Questions

1. A company will receive €2 million in 120 days and is concerned about a fall in the euro. Identify the exposure, describe two possible hedging strategies, and explain the trade-off involved in each.
2. A bank reports strong profitability but has concentrated lending to one industry, relies heavily on short-term funding, and uses an unvalidated credit model. Classify the risks and recommend priorities for management.
3. An organization’s risk matrix rates a rare cyberattack as “medium” because its probability is low. Explain why this assessment may be inadequate and propose a more complete analysis using scenarios, impact assessment, controls, and governance.

Multiple Choice Questions with Answers

Question 1

Which statement best defines exposure?

A. The amount of profit earned from a successful transaction

B. The sensitivity of value or objectives to a risk factor

C. The legal penalty imposed after a loss

D. The probability that every possible event will occur

Correct Answer: B. The sensitivity of value or objectives to a risk factor

Question 2

Which risk is generally not eliminated through diversification?

A. A product defect affecting one company

B. Fraud by one employee

C. A broad recession affecting many assets

D. A fire at one warehouse

Correct Answer: C. A broad recession affecting many assets

Question 3

A company’s inability to meet an obligation when it falls due is primarily an example of:

A. Funding liquidity risk

B. Translation risk

C. Reputational risk

D. Idiosyncratic market risk

Correct Answer: A. Funding liquidity risk

Question 4

What is the first substantive step in the risk management cycle after setting objectives and context?

A. Execute a derivative trade

B. Identify risks and exposures

C. Report the final loss

D. Eliminate all uncertainty

Correct Answer: B. Identify risks and exposures

Question 5

A natural hedge occurs when:

A. A company buys a derivative without an underlying exposure

B. Related operating inflows and outflows offset one another

C. An auditor independently confirms a trade

D. A company avoids recording a contingent liability

Correct Answer: B. Related operating inflows and outflows offset one another

Question 6

A firm will receive €1,000,000 and sells euros forward at $1.07 per euro. Ignoring costs, what dollar amount is locked in?

A. $930,000

B. $1,000,000

C. $1,070,000

D. $1,700,000

Correct Answer: C. $1,070,000

Question 7

Which statement about an option buyer is correct?

A. The buyer always has an obligation to exercise

B. The buyer pays a premium for a right and may retain favorable upside

C. The buyer eliminates counterparty risk automatically

D. The buyer receives protection without any cost

Correct Answer: B. The buyer pays a premium for a right and may retain favorable upside

Question 8

Residual risk is:

A. Risk before any controls are applied

B. Risk remaining after controls or treatments

C. Risk that is always systematic

D. Risk that has already produced a realized accounting gain

Correct Answer: B. Risk remaining after controls or treatments

Question 9

Which situation is most clearly model risk?

A. A borrower pays interest on schedule

B. A model uses unsuitable data and materially misstates exposure

C. A company diversifies its suppliers

D. A customer pays an invoice early

Correct Answer: B. A model uses unsuitable data and materially misstates exposure

Question 10

The primary purpose of a hedge is usually to:

A. Guarantee a trading profit

B. Increase every form of risk-taking

C. Reduce unwanted variability in an existing exposure

D. Remove the need for governance and monitoring

Correct Answer: C. Reduce unwanted variability in an existing exposure