8010 Operational Risk Manager (ORM) Exam Question and Answers

High frequency and low severity risks, for example the risks of fraud losses for a credit card issuer, may have high expected losses, but low unexpected losses. In other words, we can generally expect these losses to stay within a small expected and known range. The capital requirement will be the worst case losses at a given confidence level less expected losses, and in such cases this can be expected to below.

On the other hand, medium severity medium frequency risks, such as the risks of unexpected legal claims, 'fat-finger' trading errors, will have low expected losses but a high level of unexpected losses. Thus the capital requirement for suchrisks will be high.

It is also worthwhile mentioning high severity and low frequency risks - for example a rogue trader circumventing all controls and bringing the bank down, or a terrorist strike or natural disaster creating other losses - will probably have zero expected losses & high unexpected losses but only at very high levels of confidence. In other words, operational risk capital is unlikely to provide for such events and these would lie in the part of the tail that is not covered by most levels ofconfidence when calculating operational risk capital.

Note that risk capital is required for only unexpected losses as expected losses are to be borne by P&L reserves. Therefore the operational risk capital requirements for a low severity high frequency risk is likely to be low when compared to other risks that are lower frequency but higher severity.

Thus Choice 'c' is the correct answer.

High frequency and low severity risks, for example the risks of fraud losses for a credit card issuer, may have high expected losses, but low unexpected losses. In other words, we can generally expect these losses tostay within a small expected and known range. The capital requirement will be the worst case losses at a given confidence level less expected losses, and in such cases this can be expected to be low.

On the other hand, medium severity medium frequency risks, such as the risks of unexpected legal claims, 'fat-finger' trading errors, will have low expected losses but a high level of unexpected losses. Thus the capital requirement for such risks will be high.

It is also worthwhile mentioning high severity andlow frequency risks - for example a rogue trader circumventing all controls and bringing the bank down, or a terrorist strike or natural disaster creating other losses - will probably have zero expected losses & high unexpected losses but only at very highlevels of confidence. In other words, operational risk capital is unlikely to provide for such events and these would lie in the part of the tail that is not covered by most levels of confidence when calculating operational risk capital.

Note that risk capital is required for only unexpected losses as expected losses are to be borne by P&L reserves. Therefore the operational risk capital requirements for a low severity high frequency risk is likely to be low when compared to other risks that are lower frequency but higher severity.

Thus Choice 'c' is the correct answer.

Statement I is correct. Economic capital is the capital available to absorbunexpected losses, and credit ratings are also based upon a certain probability of default. Economic capital is often calculated at a level equal to the confidence required for the desired credit rating. For example, if the probability of default for a AArating is 0.02%, then economic capital maintained at a 99.98% would allow for such a rating. Economic capital set at a 99.8% level can be thought of as the level of losses that would not be exceeded with a 99.8% probability.

Loss distributions are the product of the severity and frequency distributions, each of which are estimated separately. The total loss distribution is affected far more by the severity distribution than by the frequency distribution, therefore statement II is correct.

The Loss Distribution Approach (LDA) is one of the ways in which the requirements of the AMA can be satisfied, and not the other way round. Therefore statement III is incorrect.

Statement IV is correct as the total loss distribution is estimated using separate estimatesof loss frequency and distributions.

Statement I is true - component VaR for individual assets in the portfolio add up to the total VaR for the portfolio. This property makes component VaR extremely useful for risk disaggregation and allocation.

Stateent II is incorrect, the incremental VaRs for the positions in a portfolio do not add up to the portfolio VaR, in fact their sum would be greater.

Statement III is correct. Marginal VaR for an asset or position in the portfolio is by definition the change in the VaR as a result of a $1 change in that position. Incremental VaR is the change in the VaR for a portfolio from a new position added to the portfolio - and if that position is $1, it would be identical to the marginal VaR.

Statement IV is correct, VaR is sub-additive due to the diversification effect. Adding up the VaRs for all the positions in a portfolio will add up to more than the VaR for the portfolio as a whole (unless all the positions are 100% correlated, which effectively would mean they are all identical securities which means the portfolio has only one asset).

Statement V is in incorrect. As explained for Statement I above, component VaR adds up to the VaR for the portfolio.

The risk analyst is using the block maxima approach. The data points that result will then be used to fit a GEV distribution.

Expected shortfall refers to the expected losses beyond a specified threshold. The peaks-over-threshold approach is an alternative approach to the block maxima approach, and involves considering exceedances above a threshold. Fourier transformation is not relevant in this context, and is a non-sensical option.

When a default occurs, the proportion of the exposure represented by therecovery rate is recovered. For example, if the recovery rate is 40% for a loan, the actual loss in the event of a default would be $60 for a $100 loan. In other words, the loss given default = 1 - recovery rate. Hence Choice 'd' is the correct answer. Allother choices are incorrect.

CreditRisk+ treats default as a binary event, ignoring downgrade risk, capital structures of individual firms in the portfolio or the causes of default. It uses a single parameter, λ or the mean default rate, and derives credit risk based upon the Poisson distribution. Therefore Choice 'c' is the correct answer.

The peaks-over-threshold model is used when lossesover a given threshold are recorded, as is often the case when using data based on external public sources where only large loss events tend to find a place. The generalized Pareto distribution is also used when attempting to model loss severity using EVT.Lognormal mixtures and generalized hyperbolic distributions are not used as extreme value distributions.

Choice 'd' is the correct answer.

When two bonds that appear identical in every respect trade at different prices, the difference is often due to differences in liquidity between the two bonds (the lessliquid bond will be cheaper and yield higher), and also due to the fact that ratings from the major rating agencies do not generally react to day to day changes in the market. The market's perception of the differences in the two credits will cause a divergence in the prices. This has been an extremely visible phenomenon during the credit crisis of 2007-2009, where fixed income security prices have changed sharply for many securities without any changes in external credit ratings.

Bonds carrying 'differentmarket risk' is meaningless, and so is the difference in convexity (because the calculated convexity would be identical for similar bonds).

Therefore Choice 'c' is the correct answer.

Statutory financial reporting is the responsibility of the Chief Financial Officer, not the Chief Risk Officer. The head of internal audit reports to theaudit committee of the board, not the CRO. Therefore statements I and II are incorect.

The CRO is generally expected to drive risk and compliance with related regulatory standards. Market risk, credit risk and operational risk groups report into the CRO, so statements III and IV are correct.

With the passage of time, the range of possible values the FX contract can take increases. Therefore the maximumvalue of the contract, which is when the credit risk would be maximum, would be at maturity. (Note that this is different than an interest rate swap whose value at maturity approaches zero.) Therefore Choice 'a' is the correct answer and the others are incorrect.

Economic capital is a measure of the level of capital needed to maintain adesired credit rating. Regulatory capital is the amount of capital required to be held by regulation, and this may be quite different from economic capital. Book value is an accounting measure reflecting the assets minus liabilities as measured per accounting rules, this is often expressed per share. Shareholders' equity is a narrow term which is the amount of capital attributable to the shareholders and includes paid up capital and reserves but not long term debt or other non-equity funding.

Therefore Choice 'b' is the correct answer.

The actuarial or CreditRisk+ model considers default as an 'end of game' event modeled by a Poisson distribution. The annual number of defaults is a stochastic variable with a mean of μ and standard deviation equal to √μ.

The probability of n defaults is given by (μ^n e^-μ) /n!, and therefore in this case is equal to (=2^4 * exp(-2))/FACT(4)) = 0.0902.

Note that CreditRisk+ is the same methodology as the actuarial approach, and requires using thePoisson distribution.

Offsetting trades with other counterparties will not reduce credit exposure to a given counterparty. All other choices represent means of reducing credit risk. Therefore Choice 'c' is the correct answer.

When a operational loss frequency distribution (which, for example, may be based upon a Poisson distribution) and a loss severity distribution (for example, based upon a lognormal distribution), it is assumed that the frequency of losses and the severity of the losses are completely independent and do not impact each other. Therefore statement II is correct, and the others are not valid assumptions underlying the operational loss distribution.

Choice 'c' correctly describes Altman's z-score. All other choices are incorrect.

Thedefault correlation between two obligors goes up if the joint probability of default between them increases. This is intuitive. Also consider the formula for the default correlation between two obligors

Default correlation = [P(1,2) - P1 * P2] / √P1*(1-P1)*P2*(1-P2); where P(1,2) is the joint probability of default between the two and P1 and P2 are their individual probabilities of default. Obviously, an increase in P(1,2) will cause the default correlation to increase.

Operational risk as defined in Basel II specifically excludes strategic and reputational risk. Therefore Choice 'd' is the correct answer.

Note that Basel II defines operational risk as follows:

Operational risk is defined as the risk of lossresulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk, but excludes strategic and reputational risk.

In the univariate Gaussian model, each risk factor is modeled separately independent of the others, and the dependence between the risk factors is captured by the covariance matrix (or its equivalent combination of the correlation matrix and the variance matrix). Risk factors could include interest rates of different tenors, different equity market levels etc.

While this is a simple enough model, it has a number of limitations.

First, it fails to fit to the empirical distributions of risk factors, notably their fat tails and skewness. Second, a single covariance matrix is insufficient to describe the fine codependence structure among risk factors as non-linear dependencies or tailcorrelations are not captured. Third, determining the covariance matrix becomes an extremely difficult task as the number of risk factors increases. The number of covariances increases by the square of the number of variables.

But an inability to capture linear relationships between the factors is not one of the limitations of the univariate Gaussian approach - in fact it is able to do that quite nicely with covariances.

A way to address these limitations is to consider joint distributions of the risk factors that capture the dynamic relationships between the risk factors, and that correlation is not a static number across an entire range of outcomes, but the risk factors can behave differently with each other at different intersection points.

Refer to the detailed loss event type classification under Basel II (see Annex 9 of the accord). You should know the exact names of all loss event types, and examples of each.

Recovery rates vary a great deal from year to year, and are difficult to predict. Therefore statement III is true. Similarly, any attempt to predict these is hamstrung by a high standard error, which can be as high as the historical mean itself. The error does not cancel itself out due to the effect of the business cycle making the error directionally biased. Thus statement IV is false.

Statement II is true as these are all factors that make forecasting recovery rates for any credit risk model ratherdifficult. Statement I is false because recovery rates are difficult to predict and assumptions are not easy to make.

When the economy is expanding, firms are less likely to default. Therefore the conditional probability of default, given an economic expansion, is likely to be lower than the unconditional probability of default. Therefore Choice 'a' is the correct answerand the other statements are incorrect.

A situation where a firm has more liabilities than assets does not necessarily implydefault, so long as the firm is able to pay its obligations when they come due. Therefore, short term debts have a greater bearing on a firm's default than longer term debt. However, this is not to say that merely having enough to pay off the short term debts (ie debts due within one year) is enough to avoid default. Over time, the long term debt will also be turning to short term debt, and it may not be possible for the firm to roll over its liabilities without lenders considering the long term debt. The KMV approach considers the entire short term debt and half of the long term debt as the critical value of assets below which default will be triggered. Therefore Choice 'c' is the correct answer.

While conceptually VaR is a fairly straightforward concept, a number of decisions need to be made to select between the different choices available for the exact mechanism to be used for the calculations.

The Basel framework requires banks toestimate VaR at the 99% confidence level over a 10 day horizon. Yet this is a decision that needs to be explicitly made and documented. Therefore 'I' is a correct choice.

At various stages of the calculations, portfolio values need to be determined. The valuation can be done using a 'full valuation', where each position is explicitly valued; or the portfolio(s) can be reduced to a handful of risk factors, and risk sensitivities such as delta, gamma, convexity etc be used to value the portfolio. The decisionbetween the two approaches is generally based on computational efficiency, complexity of the portfolio, and the degree of exactness desired. 'II' therefore is one of the decisions that needs to be made.

The decision as to disclosing the VaR in financial filings comes after the VaR has been calculated, and is unrelated to the VaR calculation system a bank needs to set up. 'III' is therefore not a correct answer.

Though the Basel framework requires a 10-day VaR to be calculated, it also allows the calculation of the 1-day VaR and and scaling it to 10 days using the square root of time rule. The bank needs to decide whether it wishes to scale the VaR based on a 1-day VaR number, or compute VaR for a 10 day period to begin with. 'IV' therefore is a decision tobe made for setting up the VaR system.

Other than Choice 'c', all others represent valid approaches to allocate economic capital to underlying business units. There is no such thing as 'fixed ratioeconomic capital contribution'

The Options Theoretic approach to calculating economic capital is a top-down approach that considers the value of capital as being equivalent to a calloption with a strike price equal to the notional value of the debt - ie, the shareholders have a call option on the assets of the firm which they can acquire by paying the debt holders a value equal to their notional claim (ie the face value of the debt).Therefore Choice 'a' is the correct answer and the other choices are incorrect.

A cumulative accuracy plot measures the accuracy of credit ratings assigned by rating agencies by considering the relative rankings of obligors according to the ratings given. Choice 'd' is the correct answer.

The credit spread is equal to thedefault rate times the loss given default, or stated another way, default rate times (1 - recovery rate). It is not equal to the default rate times the recovery rate. Therefore statement I is not correct.

When ratings are upgraded by rating agencies, the spread contracts and not widen. Therefore statement II is not correct.

Both recovery rates and probabilities of default are related to the business cycle, and they move in opposite directions. Economic recessions witness an increase in the default rate anda decrease in the recovery rate, and economic expansions result in a decrease in the default rate and an increase in the recovery rates when default does happen. Therefore statement III is correct.

Bond spreads incorporate both the risk of default, but also considerations of liquidity in the case of corporate bonds. Hence statement IV is correct.

Under the contingent claims approach, credit risk is evaluated as the value of the put on the firm's assets with a strike price equal to the face value of the debt and maturity equal to the maturity of the obligation. The Black Scholes model can then be used to value the put, and therefore an increase in volatility and the time to expiry (ie maturity) will increase the value of the debt. An increase in the risk free rate will actually reduce the value of the put, therefore statements I and III are correct and Choice 'b' is the correct answer.

The correct definition of CVA is LGD * EPE * PD. All other answers areincorrect.

CVA reflects the adjustment for counterparty default on derivative and other trading book transactions. This reflects the credit charge, that neeeds to be reduced from the expected value of the transaction to determine its true value. It is calculated as a product of the loss given default, the probability of default and the average weighted exposure of future EPEs across the time horizon for the transaction.

The future exposures need to be discounted to the present, and occasionally the equations for CVA will state that explicitly. Similarly, in some more advanced dynamic models the correlation between EPE and PD is also accounted for. The conceptual ideal though remains the same: CVA=LGD*EPE*PD.

Right after inception' is incorrect as the interest rate swap (IRS) would be valued at close to zero right after inception and the credit risk would be minimum. Choice 'a' (ie 10 years, at maturity) is incorrect as at maturity there would be no more cash flows to exchange, and the replacement value of the contract would again be close to zero.

Therefore the worst time for the counterparty to default is somewhere between inception and maturity - in fact the range of possible outcomes for the contract increases with the passage of time, and we should find the worst time to default to be a later date. However, towards maturity, the value of the contract starts to go towards zero again, and the maximum value is reached around 7 years. 2 years is too early for the maximum to be reached for the10 year IRS, and therefore choice a is the correct answer.

The probability of default would make the expected value of the future cash flows from both the corporate bond and the risk free bond identical. If p be the probability of default, the cash flows from the risky corporate bond would be

= (cash flows in the event of default x probability of default) + (cash flows without default x (1 - probability of default))

=> 5%*0 + (1 - 5%)*(1 + 12%) = (1 + Rf).

therefore Rf = 6.4%

(In reality investors would demand a 'credit risk premium' over and above the expected default loss rate. They are unlikely to be happy with just being compensated with exactly the expected default loss rate plus the risk-fre rate because the expected default loss rate itself is uncertain. They would demand some premium over and above what the default rate alone might mathematically imply above the risk free rate. In this question, this credit risk premium is ignored.)

The term 'data quality' has multiple elements, ie, data in order to be considered of a high quality must have multiple attributes such ascompleteness, timeliness, auditability etc. Because this is not an exact science, every expert or text book will have a different view of what goes into data quality. For our purposes however, we will stick to what the PRMIA study material specifies, and according to the study material the following are the elements that can be considered attributes that make for quality data:

1. Integration

2. Integrity

3. Completeness

4. Accessibility

5. Flexibility

6. Extensibility

7. Timeliness

8. Auditability

I am notgoing to describe each of these here as that would be repetitive of the study material, but suffice it to say that the break-down of a number into its constituents should tie to the aggregate total. If that is not true, then the data lacks integrity - andtherefore Choice 'b' is the correct answer. The other choices address other aspects of data quality but not this, and therefore are not correct.