8010 Operational Risk Manager (ORM) Exam Questions and Answers

According to the Basel II framework, Tier 1 capital, also called core capital or basic equity, includes equity capital and disclosed reserves.

Tier 2 capital, also called supplementary capital, includes undisclosed reserves, revaluation reserves, general provisions/general loan-loss reserves, hybrid debt capital instruments and subordinated term debt.

Tier 3 capital, or shortterm subordinated debt, is intended only to cover market risk but only at the discretion of their national authority.

The major problem with using return onequity as a measure of performance is that return on equity is not adjusted for risk. Therefore, a riskier investment will always come out ahead when compared to a less risky investment when using return on equity as a performance metric.

Return on equitydoes not ignore the effect of leverage (though return on assets does) because it considers the income attributable to equity, including income from leveraged investments.

Return on equity is generally measured after interest and taxes at the company wide level, though at business unit level it may use earnings before interest and taxes. However this does not create a problem so long as all performance being covered is calculated in the same way.

Cash flows being different from accounting earnings can createliquidity issues, but this does not affect the effectiveness of ROE as a measure of performance.

Note that events of default under the ISDA MA are caused by one of the parties that is considered 'atfault'. In contrast, "termination events" are events for which no one is at fault, for example changes in legislation, illegality etc that still justify termination of the transactions under the contract.

The ISDA MA describes the following 8 types of events of default:

1. failure of pay or deliver

2. breach of agreement

credit support default

4. misrepresentation

5. default under specified transaction

6. cross default

7. bankruptcy

8. merger without assumption

All of the options presented in the question are events of default.

Bank B's exposure is measured by the price it paid for the bonds, which in this case is $7m ($10m x 70/100). Hence Choice 'c' represents the correct answer.

(Note that the question is asking for 'exposure' and not the legal claim in the event of default. The legal claim in the event of default would be the full notional of $10m. )

The initial issue price and issue size are irrelevant.

Current replacement values are a very poor measure of the credit exposure from a derivative contract, because the future value of these instruments is unpredictable, ie is stochastic, and the range of values it can take increases the further ahead in the future we look. Therefore it is common for credit exposures for derivatives to be measured using forward looking exposure profiles, which are distributions of the expected value of the derivative at the time horizon for which credit risk is being measured. To be conservative, a high enough quintile of this distribution is taken as the 'loan equivalent value' of the derivative as the exposure.Choice 'c' is the correct answer.

The notional value of derivative contracts generally tends to be quite high and unrelated to their economic value or the counterparty exposure. Therefore notional value is irrelevant.

Losses due to credit risk include the loss of value from credit migration and default events (which can be considered a migration to the 'default' category). Therefore Choice 'd' is the correct answer. Changes in spreads or interest rates are examples of market risk events.

[Discussion: It may be argued that losses from spreads changing could be categorized as credit risk and not market risk. The distinction between credit and market risk is never really watertight.

The reason I have called it market risk in this question is because spreads can change due to two reasons: first, due to the individual issuer going down in their credit rating (whether issued or perceived, as we have witnessed in Europe sovereign debt), and second due to the spread for the overall category changing due to macro fundamentals with nothing changing for the individual issuer. For example the spread between municipal bonds and treasuries may be small during boom times and may expand during recessions - regardless of how the individual issuer has been doing. Clearly, the first case is credit risk and the second is probably market risk.

A changein overall corporate bond spreads is something I would consider akin to a rate change - which is why I have called it as not a part of credit risk. But an alternative perspective may not be incorrect either.]

Economic capitalis often calculated with a view to maintaining the credit ratings for a firm. It is the capital available to absorb unexpected losses, and credit ratings are also based upon a certain probability of default. Economic capital is often calculated at a levelequal to the confidence required for the desired credit rating. For example, if the probability of default for a AA rating is 0.02%, and the firm desires to hold an AA rating, then economic capital maintained at a confidence level of 99.98% would allow for such a rating. In this case, economic capital set at a 99.8% level can be thought of as the level of losses that would not be exceeded with a 99.8% probability, and would help get the firm its desired credit rating.

Choice 'c' is the correct answer. Economic capital does not target minimizing the cost of capital, nor is it a provision for losses arising from market risk. The concept of economic capital is unrelated to where an institution or firm is based, therefore Choice 'a' is incorrect as well.

Statement I is true - capital adequacy indeed is a reference to the ability of the firm to stay a 'going concern'. (Going concern is an accounting term that means the ability of the firm to continue in business without the stress of liquidation.)

Statement II is not true because even though the stated objective of regulatory capital requirements is similar to the purposes for which economic capital is calculated, regulatory capital calculations are based upon a large number of ad-hoc estimates and parameters that are 'hard-coded' into regulation, while economic capital is generally calculated for internal purposes and uses an institution's own estimates and models. They are rarely identical.

Statement II is not true as the purpose of economic capital is to provide a buffer against unexpected losses. Expected losses are covered by the P&L (or credit reserves), and not capital.

Statement IV is incorrect as even though economic capital may be calculated at very high confidence levels, that is never 100% which would require running a 'risk-free' business, which would mean there are no profits either. The level of confidence is set at a level which is an acceptable balance between the interests of the equity providers and the debt holders.

The 'middle office' is a term used for the risk management function, thereforeChoice 'd' is the correct answers. The other functions describe what the 'back office' does (IT, accounting). The 'front office' includes the traders.

High frequency and low severity risks, for example the risks of fraud losses for a credit card issuer, may have high expected losses, but low unexpected losses. In other words, we can generally expect these losses to stay within a small expected and known range. The capital requirement will be the worst case losses at a given confidence level less expected losses, and in such cases this can be expected to below.

On the other hand, medium severity medium frequency risks, such as the risks of unexpected legal claims, 'fat-finger' trading errors, will have low expected losses but a high level of unexpected losses. Thus the capital requirement for suchrisks will be high.

It is also worthwhile mentioning high severity and low frequency risks - for example a rogue trader circumventing all controls and bringing the bank down, or a terrorist strike or natural disaster creating other losses - will probably have zero expected losses & high unexpected losses but only at very high levels of confidence. In other words, operational risk capital is unlikely to provide for such events and these would lie in the part of the tail that is not covered by most levels ofconfidence when calculating operational risk capital.

Note that risk capital is required for only unexpected losses as expected losses are to be borne by P&L reserves. Therefore the operational risk capital requirements for a low severity high frequency risk is likely to be low when compared to other risks that are lower frequency but higher severity.

Thus Choice 'c' is the correct answer.

High frequency and low severity risks, for example the risks of fraud losses for a credit card issuer, may have high expected losses, but low unexpected losses. In other words, we can generally expect these losses tostay within a small expected and known range. The capital requirement will be the worst case losses at a given confidence level less expected losses, and in such cases this can be expected to be low.

On the other hand, medium severity medium frequency risks, such as the risks of unexpected legal claims, 'fat-finger' trading errors, will have low expected losses but a high level of unexpected losses. Thus the capital requirement for such risks will be high.

It is also worthwhile mentioning high severity andlow frequency risks - for example a rogue trader circumventing all controls and bringing the bank down, or a terrorist strike or natural disaster creating other losses - will probably have zero expected losses & high unexpected losses but only at very highlevels of confidence. In other words, operational risk capital is unlikely to provide for such events and these would lie in the part of the tail that is not covered by most levels of confidence when calculating operational risk capital.

Note that risk capital is required for only unexpected losses as expected losses are to be borne by P&L reserves. Therefore the operational risk capital requirements for a low severity high frequency risk is likely to be low when compared to other risks that are lower frequency but higher severity.

Thus Choice 'c' is the correct answer.

The current Basel rules for the basic VaR based charge formarket risk capital set market risk capital requirements as the maximum of the following two amounts:

1. 99%/10-day VaR,

2. Regulatory Multiplier x Average 99%/10-day VaR of the past 60 days

The 'regulatory multiplier' is a number between 3 and 4 (inclusive) calculated based on the number of 1% VaR exceedances in the previous 250 days, as determined by backtesting.

- If the number of exceedances is <= 4, then the regulatory multiplier is 3.

- If the number of exceedances is between 5 and 9, then the multiplier = 3 + 0.2*(N-4), where N is the number of exceedances.

- If the number of exceedances is >=10, then the multiplier is 4.

So you can see that in most normal situations the risk capital requirement will be dictated by the multiplier and the prior 60-dayaverage VaR, because the product of these two will almost often be greater than the current 99% VaR.

The correct answer therefore is = max(200mm, 3*250mm) = $750mm.

Interestingly, also note that a 99% VaR should statistically be exceeded 1%*250 days = 2.5times, which means if the bank's VaR model is performing as it should, it will still need to use a reg multiplier of 3.

Parametric VaR relies upon reducing a portfolio's positions to risk factors, and estimating the first order changes in portfolio values from each of the risk factors. This is called the delta approximation approach. Riskfactors include stock index values, or the PV01 for interest rate products, or volatility for options. This approach can be quite accurate and computationally efficient if the portfolio comprises products whose value behaves linearly to changes in risk factors. This includes long and short positions in equities, commodities and the like.

However, where non-linear products such as options are involved and large moves in the risk factors are anticipated, a delta approximation based valuation may not give accurate results, and the VaR may be misstated. Therefore in such situations parametric VaR is not advised (unless it is extended to include second and third level sensitivities which can bring its own share of problems).

Parametric VaR also assumes that the returns of risk factors are normally distributed - an assumption that is violated in times of market stress. So if it is known that the risk factor returns are not normally distributed, it is not advisable to use parametric VaR.

EVT, when used in the context of operational risk measurement, focuses on tail events and attempts to build a distribution of losses beyond what is covered by VaR. Statements I, II and II are correct. Statement IV describes conditional VaR (CVAR) andnot EVT.

Choice 'c' is the correct answer.

Risks such as abrupt changes to a firm's businessmodel caused by legislation, or the introduction of capital controls in foreign countries where a firm in invested, geo-political risks etc are not modelable in the traditional sense. These risks cannot be modeled using VaR. Therefore statement I is correct.

VaR indeed does not consider liquidity risk, it is only concerned with the standard deviation of portfolio returns. Statement II is a valid criticism.

Statement III is not correct, as VaR can consider historical price movements.

Statement IV is correct,as VaR does not consider systemic risk or the risk of contagion.

A bullet bond is a bond that pays coupons covering interest during the life of the bond and theprincipal at maturity. An amortizing loan pays the interest as well as a part of the principal with every payment. Therefore, the exposure of the amortizing loan continually reduces, and approaches zero towards the end of its life. The bullet bond will always have a higher exposure at any time during its life when compared to an equivalent amortizing loan. Hence Choice 'd' is the correct answer.

Statement I is correct. Retail Risk Based Pricing (RRBP) involves the use of borrower specific data (such as FICO scores, average balances etc) to arrive at credit decisions. These 'retail' credit decisions may include decisions on whether to grant a line of credit, a mortgage, issue a credit card, or any of the various other retail activities abank may be dealing with. At the same time, this data can also be used to price the product, in addition to providing a yes or no credit decision so that risky borrowers are charged more than less risky borrowers.

Statement II is not correct, because an integrated Risk Information Management Environment includes three elements - people, processes and technology (and not just people and processes).

Statement III is correct. An LDM is a blue print of an organization's data, and describes the relationships between the various data elements.

Statement IV is not correct because reference data and metadata are not the same thing. Reference data refers to relatively static data, such as customer name (while actual transactions may not be so static). Metadata refers to data about data, and is stored in a data dictionary.

Therefore Choice 'b' is the correct answer and the rest are incorrect.

Extreme value theory focuses on the extreme and rare events, and in the case of VaR calculations, it is focused on the right tail of the lossdistribution. In very simple and non-technical terms, EVT says the following:

1. Pull a number of large iid random samples from the population,

2. For each sample, find the maximum,

3. Then the distribution of these maximum values will follow a GeneralizedExtreme Value distribution.

(In some ways, it is parallel to the central limit theorem which says that the the mean of a large number of random samples pulled from any population follows a normal distribution, regardless of the distribution of the underlying population.)

Generalized Extreme Value (GEV) distributions have three parameters: ξ (shape parameter), μ (location parameter) and σ (scale parameter). Based upon the value of ξ, a GEV distribution may either be a Frechet, Weibull or a Gumbel. These arethe only three types of extreme value distributions.

Operational risk as defined in Basel II specifically excludes strategic and reputational risk. Therefore Choice 'd' is the correct answer.

Note that Basel II defines operational risk as follows:

Operational risk is defined as the risk of lossresulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk, but excludes strategic and reputational risk.

One may use separate UoMs for frequency and severity modeling, for example, a combined UoM may be used for estimating thefrequency of cyber attacks in a scenario, while the severity may be modeled using a more granular line-of-business UoM. Therefore statement I is false, while statement IV is true.Statement II is correct, UoMs can be grouped together into larger units based on the facts relating to the business, controls and the business environment. Similarly, UoMs can be grouped together based on statistical clustering techniques using the 'distance' between the units of measure and combining UoMs that are closer to eachother. In addition, it is also possible to combine both business knowledge and statistical algorithms to combine UoMs.

Some risk experts have suggested the use of extreme value theory to model tail risk or extreme events for operational risk. The generalized Pareto model or the Peaks-over-Threshold (POT) model are often used to model extreme value distributions, and therefore Choice 'a' is the correct answer.

The correct answer is Choice 'b'. The following is a brief description of the major approaches available to model credit risk, and the analysis that underlies them:

1. CreditMetrics: based on the credit migration framework. Considers the probability of migration to other credit ratings and the impact of such migrations on portfolio value.

2. CreditPortfolio View: similar to CreditMetrics, but adds the impact of the business cycle to the evaluation.

3. The contingent claims approach: uses option theory by considering a debt as a put option on the assets of the firm.

4. KMV's EDF (expected default frequency) based approach: relies on EDFs and distance to default as a measure of credit risk.

5. CreditRisk+: Also called the 'actuarial approach', considers default as a binary event that either happens or does not happen. This approach does not consider the loss of value from deterioration in credit quality (unless the deterioration implies default).

With the passage of time, the range of possible values the FX contract can take increases. Therefore the maximumvalue of the contract, which is when the credit risk would be maximum, would be at maturity. (Note that this is different than an interest rate swap whose value at maturity approaches zero.) Therefore Choice 'a' is the correct answer and the others are incorrect.

The Options Theoretic approach to calculating economic capital is a top-down approach that considers the value of capital as being equivalent to a calloption with a strike price equal to the notional value of the debt - ie, the shareholders have a call option on the assets of the firm which they can acquire by paying the debt holders a value equal to their notional claim (ie the face value of the debt).Therefore Choice 'a' is the correct answer and the other choices are incorrect.

Top down approaches do not consider event frequency and severity, on the otherhand they focus on high level available data such as total capital, income volatility, peer group information on risk capital etc. Bottom up approaches focus on severity and frequency distributions for events. Statement I is therefore not correct.

Top downapproaches do indeed rely upon high level aggregate data and tend to infer operational risk capital requirements from these. Bottom up approaches look at more detailed firm specific information. Statement II is correct.

Scenario analysis requires estimating losses from risk scenarios, and allows incorporating the judgment and views of managers in addition to any data that might be available from internal or external loss databases. Statement III is correct. Therefore Choice 'b' is the correct answer.

Transition matrices are used for building distributions of the value of credit portfolios, and are the realized frequencies of migration from one credit rating to another over a period, generally one year. Therefore Choice 'd' is the correct answer.

Since they represent an actually observed set of values, they are not probabilities nor are they forward looking ex-ante estimates, though they are often used as proxies for probabilities. Choice 'a' and Choice 'c' are not correct. They include more than information on just defaults, therefore Choice 'b' is not correct.

A computation of Altman's Z-score considers the following ratios:

- Working capital to total assets

- Retained earnings to total assets

- EBIT to total assets

- Market cap to debt

- Sales to total assets

It does not consider Net Income to total assets, therefore Choice 'c' is the correct answer. This makes sense as net income is after interest and taxes, both of which are not relevant for considering the cash flows for debt servicing.

Other than Choice 'c', all others represent valid approaches to allocate economic capital to underlying business units. There is no such thing as 'fixed ratioeconomic capital contribution'

Choice 'b' is the correct answer. All other answers areincorrect.

Refer to the detailed loss event type classification under Basel II (see Annex 9 of the accord). You should know the exact names of all loss event types, and examples of each.

If capital calculations are done in a standard way regardless of risk (as reflected by credit ratings), then it creates a perverse incentive for the lenders' employees to lend to the riskiest borrowers that offer the highest expected returns as there is no incentive to 'save' on economic capital requirements that are equal for both safe and unsafe borrowers. Therefore statement I is correct.

Given that the portfolio of suchan institution is likely to then comprise poor quality borrowers, and economic capital would be based upon 'average' expected ratings, it is likely to carry lower economic capital given its exposures. Therefore any such economic risk capital model is likely to understate economic capital requirements. Therefore statement IV is correct.

Statements II and III are incorrect and Choice 'b' is the correct answer.

KMV Moody's uses a proprietary database to convert the distance to default to expected default probabilities.

The recovery rate, the default hazard rate (also called the average default intensity) and the spread on debt arelinked by the equation Hazard Rate = Spread/(1 - Recovery Rate). Therefore, the recovery rate implicit in the given data is = 1 - 8%/10% = 20%.

Choice 'a' is the correct answer. Refer to the detailed loss event type classification under Basel II (see Annex 9 of the accord). You should know the exact names of all loss event types, and examples of each.