Skip to main content
FRM Part 1 · Topic overview

Foundations of Risk Management

Foundations connects risk taking to objectives, diversification, risk appetite and oversight. Start by identifying who bears a loss, how risks interact, and who has authority to approve or limit the exposure.

The topic at a glance

  • 01Risk and return

    How it works: Compare compensation with the relevant risk, not profit in isolation.

    Watch for: Calling a profitable position safe.

  • 02Diversification

    How it works: Portfolio risk depends on covariance as well as individual volatility.

    Watch for: Assuming different asset names imply independent losses.

  • 03Risk appetite

    How it works: Translate objectives into limits, monitoring and escalation responsibilities.

    Watch for: Letting the risk taker approve an unreported exception.

Original worked example

Two risky assets, one portfolio

Two assets each have 20% annual volatility. Hold equal weights and assume zero correlation.

  1. STEP 1

    Portfolio variance = 0.5² × 0.2² + 0.5² × 0.2² = 0.02.

  2. STEP 2

    Take the square root: √0.02 = 14.14%.

  3. STEP 3

    If correlation becomes 1, add 2 × 0.5 × 0.5 × 0.2 × 0.2 = 0.02 to variance.

Volatility becomes 20% at correlation 1. The diversification benefit depends on co-movement, not the number of labels in the portfolio.

Illustrative assumptions and calculations for learning. Not observed market data or an official exam item.

How the ideas fit together

Before you start: Returns, standard deviation and the distinction between an institution and an individual desk.

Connect portfolio risk to compensation

σ²p = w₁²σ₁² + w₂²σ₂² + 2w₁w₂σ₁σ₂ρ

The covariance term explains why asset risk cannot be added as if every position moved together. Diversification changes the portfolio distribution; it does not make every loss disappear. In a market-factor model, beta measures exposure to the market factor, while total volatility also reflects residual risk. Use the measure that fits the question before comparing risk-adjusted performance.

Connect the risk number to responsibility

A risk appetite statement expresses the institution’s willingness to take risk in pursuit of its objectives. Limits translate that statement into constraints on activities. The business takes and manages exposures, independent risk functions challenge them, and the board oversees the framework. A hedge decision must also identify basis, counterparty and funding risks introduced by the hedge.

Connect the number to a decision

A volatility estimate does not decide how much risk an institution should accept. That decision also depends on obligations, available capital, liquidity and governance. When reviewing a hedge, identify the exposure removed and the exposure introduced. A derivative may reduce market risk while creating counterparty exposure and collateral funding needs.

Work through the topic

Connect portfolio mathematics, risk appetite and governance to a defensible decision. This overview explains the relationships; the governance lesson develops breach handling in detail.

Start with the objective, loss bearer and horizon

Risk management starts by identifying what the organization is trying to protect or achieve. A pension fund meeting long-dated liabilities, a bank funding withdrawals and a trading desk controlling daily positions do not have identical objectives. The same asset can create different problems for each. Before selecting a metric, state the decision horizon, the relevant obligations and who absorbs a loss. A daily volatility number alone cannot answer a question about next month’s cash payments.

Suppose two businesses each expect a profit of 3 million. One needs 10 million of committed capital and stable funding; the other needs 30 million and can face large collateral calls. Comparing the profit figures alone hides the resources and risks used to earn them. A risk-adjusted comparison must specify how capital, financing costs and loss uncertainty are measured. There is no universal denominator that makes every business directly comparable.

Keep expected outcomes separate from tolerances. An expected loss is an average under a model, while a limit is an approved constraint. A loss can exceed its expectation without proving misconduct, and a profitable position can violate its limit. The manager needs both a description of possible outcomes and a decision framework for accepting, reducing, transferring or declining the exposure.

Explain what diversification removes and what remains

Portfolio volatility depends on how positions move together. Adding another security helps little if its losses occur in the same states as the existing portfolio’s losses. In the equal-weight example above, changing correlation from zero to one raises volatility from about 14.14% to 20%, despite leaving the holdings’ individual volatilities unchanged. A diversification argument therefore needs a dependence assumption, not just a security count.

Now imagine a portfolio containing loans to a hotel, an airline and a travel platform. The company names and business models differ, but a severe travel disruption can weaken all three. A historical correlation estimated in ordinary conditions may not represent that scenario well. Identify the shared economic driver, then assess what happens when it dominates the ordinary firm-specific variation. The lesson is about dependency, not a claim that every correlation must rise in every crisis.

A market beta measures sensitivity to a selected market factor; total volatility also includes variation unexplained by that factor. A factor model can help distinguish broad systematic exposure from residual exposure, but residual does not mean harmless. Concentrated residual risk can matter greatly to an institution that is not fully diversified. State the portfolio and benchmark before concluding that a risk is diversified away.

Three different questions about a portfolio

How variable are total returns?
Useful starting point: Portfolio variance and covariance
What it does not establish: The cash available at a payment deadline
How sensitive is the portfolio to a factor?
Useful starting point: Factor exposure or beta
What it does not establish: All nonlinear and omitted-factor risks
What happens in a shared adverse event?
Useful starting point: A coherent stress scenario
What it does not establish: A calibrated probability unless separately modeled

Evaluate a hedge as a change in the risk profile

A hedge changes exposures; it rarely removes every source of uncertainty. An importer buying foreign currency forward reduces uncertainty about a future exchange payment. It also acquires a contract with a counterparty and a settlement date. If the underlying purchase is canceled, the hedge may become an independent speculative exposure. A hedge assessment must connect the derivative to an identified amount, currency and time.

Consider an illustrative manufacturer expecting to buy one million units of a commodity in three months. A futures hedge may protect its purchase price, yet daily margin can require cash before the commodity is delivered. If the available contract tracks a different grade or delivery location, basis risk remains. If expected production changes, the quantity hedged may become too large or too small. These are different mechanisms and call for different controls.

Write the before-and-after exposure in plain language. Then identify the new dependencies, funding needs and monitoring triggers. This makes the decision reviewable: another reader can tell what uncertainty was reduced, what was retained and what was introduced. The detailed derivative mechanics belong in the products and futures lessons; here the aim is to connect risk transfer with the organization’s objectives and capacity.

Translate risk appetite into observable decisions

A statement such as “we accept moderate market risk” is difficult to enforce without measurable constraints and responsibilities. A practical framework connects the statement to position limits, stress tolerances, funding requirements and escalation rules. Different metrics catch different weaknesses. A portfolio might satisfy a volatility limit yet breach a concentration limit, so one green indicator cannot stand in for the entire framework.

For an original example, assume a committee permits a desk to lose at most 2 million under a specified stress and requires same-day reporting of a breach. A new position raises the modeled stress loss from 1.8 million to 2.3 million. The relevant finding is a 0.3 million excess under that approved scenario. A favorable expected return does not change the decision rule. The business must seek an authorized response and preserve the basis for the original measurement.

The framework also needs feedback. If a metric repeatedly misses the institution’s actual vulnerabilities, review its design rather than merely demanding more frequent reports. Distinguish a poor model, a data failure and a decision to ignore a valid warning. Each requires a different remedy. That connection between measurement and responsibility is the foundation for the more detailed risk-type and governance cases.

Does risk management aim to eliminate risk?

An organization often takes risk deliberately to meet its objectives. The task is to understand, price, fund, control and authorize that risk within its capacity. Eliminating one exposure can sacrifice return or create another exposure. Explain the tradeoff and the residual risk rather than assuming every reduction is automatically beneficial.

How is this overview different from the governance lesson?

This page connects objectives, portfolio effects, risk transfer and oversight. The governance lesson focuses on identifying loss channels, assigning responsibilities and handling breaches. Use this overview to understand why the framework exists, then use the narrower case to practice how a particular control decision should be made.

Try a changed assumption

Two assets have different names but identical returns in every scenario. Does an equal-weight portfolio reduce volatility?

Show answer and reasoning

No. With equal individual volatilities and correlation 1, portfolio volatility equals either asset’s volatility. Count independent loss drivers, not product labels.

Original learning check. No email or account needed.

Is Foundations only a definitions topic?

No. Apply definitions to incentives, portfolio effects, risk transfer and control failures. A calculation is useful only when you can explain what decision it supports.

Sources and scope

Links checked 2026-10-10. GARP establishes exam scope; the technical references support the methods identified below. These are selected study notes and original examples, not complete curriculum coverage or official exam questions.

Prepared by MiloPrep editorial team. MiloPrep is independent of GARP. References do not imply endorsement or independent review of these notes.