A cyber incident can stop payments, create legal costs, trigger deposit withdrawals, and force asset sales. Separate risk reports can each look manageable while missing the combined threat. Enterprise risk management (ERM) joins these exposures to strategy, appetite, and decisions across the firm.
Governance establishes who owns exposures and who challenges them. The board sets appetite; senior management turns it into limits, resources, and accountability. Business managers own the consequences of their activities. Independent risk functions assess cross-business concentrations and escalate breaches. Culture determines whether those arrangements work when revenue or deadlines are at stake.
Integration requires consistent definitions, horizons, and reporting. A daily market-loss estimate cannot simply be added to a one-year operational-loss quantile and called annual capital. Nor should a single event's legal cost be counted independently in two risk categories. Map causal links, reconcile overlapping losses, and test common drivers.
Dependence is especially important in stress. A shared vendor can fail several services at once. A market shock can increase processing volumes just as staff and systems are least able to handle...
Common mistakes
- Calling a stress loss a capital requirement. Losses reduce the resources that must remain above a requirement.
- Assuming actual capital equals two estimates' maximum. Planning also considers buffers, distributions, stress, and eligible capital quality.
- Turning a range-of-practices survey into universal rules. Distinguish observations, recommendations, and jurisdiction-specific obligations.
Bottom line
- ERM links strategy, appetite, governance, and cross-risk dependencies.
- Stress losses reduce held capital; requirements constrain the remaining amount.
- Operational stress models need challenged timing, data, and dependence assumptions.
- The 2018 cyber reading surveys practices across jurisdictions.
Exam shortcut
For capital questions, label each number as a resource, loss, requirement, or internal estimate before using it. For cyber cases, trace the incident from asset identification through protection, detection, containment, and recovery. Check whether a proposed fix actually breaks the failure chain and whether the backup shares the original vulnerability.
The full lesson (about 3,356 words, 22 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
Browse all free FRM Part II lessons or jump into free FRM Part II practice questions.