A treasurer hedges FX, an insurance manager buys liability cover, and the COO drafts a business continuity plan. Three people, three risk silos, one CEO who cannot see how the pieces interact. Enterprise risk management replaces those silos with a single portfolio view.
Every exposure a firm faces sorts into one of five buckets.
- Business risk is the variability of operating results from competitive position, demand, and pricing.
- Hazard risk is pure loss risk from fires, storms, accidents, and similar events that cannot produce a gain.
- Financial risk covers market, credit, liquidity, interest-rate, and FX exposure.
- Operational risk arises from failed people, processes, systems, or external disruptions.
- Strategic risk comes from the choices the firm makes about markets, M&A, technology bets, and capital allocation.
KEY: Hazard risk is the only family that is purely downside. The other four families can produce upside as well as loss, which is why ERM treats risk as uncertainty around objectives, not just bad outcomes.
Common mistakes
- Confusing inherent and residual risk. Inherent is gross, before controls. Residual is net, after the chosen response. Reporting inherent risk against risk appetite ignores the entire mitigation program.
- Treating VaR as a worst-case. VaR at 99% / 10 days is a threshold, not a ceiling. The tail beyond VaR can be several times larger. Use stress tests and MPL analysis for the catastrophic question.
- Funding expected loss with capital. Expected loss belongs in reserves and pricing. Capital is for unexpected loss. Mixing the two understates required capital and overstates earnings.
Bottom line
- The five risk families are business, hazard, financial, operational, and strategic; only hazard is purely downside. Operational risk covers people, process, systems, and external events, managed with controls, training, BCP, KRIs, and RCSAs.
- The five risk responses are avoid, retain, reduce (mitigate), transfer (share), and exploit (accept), matched to the likelihood-impact quadrant.
- Expected loss = Σ probability × loss, funded by reserves. Unexpected loss is the volatility, funded by capital. Maximum possible loss is the catastrophic tail that drives insurance limits.
- Inherent risk is the gross exposure before controls. Residual risk is what remains after the response and is the figure compared against risk appetite.
Exam shortcut
When the stem gives probabilities and losses and asks for "expected exposure," compute Σ p × L directly. The answer choices will tempt you with the largest single loss; that is maximum possible, not expected. When the stem describes low-probability, high-impact (lawsuits, catastrophic property loss, product recall), the response is transfer via insurance. When it describes high-probability, low-impact (small processing errors, minor variances), the response is reduce via controls.
The full lesson (about 3,342 words, 22 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 2D1
Browse all free CMA Part 2 lessons or jump into free CMA Part 2 practice questions.