Skip to main content
FRM Part 1 · Worked study notes

Risk Governance and Risk Types

Classify risk by the mechanism that causes a loss, then identify who owns the exposure and who can authorize a response. Market, credit, liquidity and operational risks can occur together in one event.

The method at a glance

  • 01Risk type

    How it works: Trace the cause: price move, default, inability to fund, or process failure.

    Watch for: Assigning just one label to a chain of events.

  • 02Authority

    How it works: Separate taking a position from independent challenge and approval.

    Watch for: Assuming profit grants permission to exceed a limit.

  • 03Escalation

    How it works: Record the breach, exposure, owner and authorized remedy.

    Watch for: Silently changing a limit to erase a breach.

Original worked example

A profitable desk breaches its limit

A desk has an approved DV01 limit of 40,000 per basis point. Its current exposure is 52,000, and the position made money today.

  1. STEP 1

    The excess is 12,000 per basis point, or 30% above the limit.

  2. STEP 2

    Identify the rate exposure as market risk and the unauthorized breach as a governance issue.

  3. STEP 3

    Escalate for an authorized reduction or documented limit decision; retain the breach record.

The gain does not cure the breach. The immediate control question is whether the exposure is authorized and managed.

Illustrative assumptions and calculations for learning. Not observed market data or an official exam item.

Apply the method and check its limits

Before you start: Market, credit, liquidity and operational loss channels.

Build an escalation chain with distinct responsibilities

The desk should measure and manage its position. Independent risk should verify the breach, challenge the proposed response and escalate through authorized channels. Senior management or the relevant committee acts within delegated authority; internal audit assesses whether the framework works. Assigning these functions to the same decision maker can weaken challenge.

Distinguish a limit from a risk measure

A DV01 estimate describes exposure to a rate move. A DV01 limit expresses permitted exposure. Neither says how large a loss must be before reporting begins. Record the time, size and duration of a breach, its cause and the action owner. If the approved limit changes later, retain the original breach record so the control process remains auditable.

One event, several channels

A failed trading system can prevent a hedge, leaving market exposure while also creating an operational incident. A credit downgrade can trigger collateral calls and turn counterparty concerns into funding pressure. Classification should clarify these channels so that the response addresses the root cause and the resulting exposures.

Work through the topic

Classify a loss event by its actual mechanisms, assign distinct control responsibilities, and work through a breach decision that remains auditable after the immediate problem is resolved.

Classify the event without losing the chain of consequences

A useful classification explains how a loss or disruption arises. Market risk concerns adverse price or rate changes; credit risk concerns a counterparty’s failure or deterioration; liquidity risk concerns funding or trading when required; operational risk concerns failures involving processes, people, systems or external events. These categories can describe different stages of the same incident. Choosing one label should not erase the others.

Consider an original case in which a payment-system outage prevents a derivatives desk from delivering collateral. The initiating incident is operational. Missing the settlement deadline can create a funding problem, contractual consequences and concerns for the counterparty. If the firm sells securities urgently to raise cash, transaction costs and market-price movements can add losses. Record the initiating cause and the subsequent channels separately so the control response can address both.

This distinction also prevents misleading loss aggregation. A cash collateral transfer is not automatically a permanent economic loss, and a decline in an asset’s market value is not automatically a same-day payment. Attach an amount, a time and a definition to each consequence. The country-risk lesson handles restrictions on cross-border payment; the operational-resilience lesson develops restoration of the affected service.

Original outage case: cause, consequence and control

Payment platform fails
Risk mechanism: Operational disruption
Control question: Can the critical payment service recover in time?
Collateral deadline approaches
Risk mechanism: Funding liquidity pressure
Control question: Which cash or eligible assets are actually available?
Emergency asset sale
Risk mechanism: Market and execution exposure
Control question: What price and settlement date are achievable?
Obligation remains unpaid
Risk mechanism: Counterparty and contractual exposure
Control question: Who can authorize the response and communicate the exception?

Separate taking risk, challenging it and checking the framework

The business that creates an exposure needs to understand and manage it. An independent risk function challenges measurement, monitors the framework and escalates concerns. Senior management and the board have different delegated and oversight responsibilities. Internal audit assesses whether controls and governance operate effectively. These are distinct purposes, even when the practical organization varies with the institution.

Suppose a trader asks the same person who booked a position to certify its valuation, authorize a limit exception and close the resulting control finding. The concern is not simply that one person is busy. The arrangement can remove independent challenge at the exact points where errors or incentives need examination. A sound review asks who can disagree, what information they receive and whether they have an escalation route.

Independence also does not mean that the risk function takes over every business decision. The risk taker remains responsible for operating within authorized constraints. A governance answer should identify who proposes the action, who challenges it, who approves it and who verifies completion. This is more informative than listing committee names without explaining their authority or the evidence each must consider.

Work a limit breach through to documented closure

Use the opening DV01 case as a sequence. The approved limit is 40,000 per basis point and measured exposure is 52,000. First confirm position completeness, units and the calculation date. If the measurement is correct, the excess is 12,000, or 30% of the limit. The fact that the position made money does not alter either the measured exposure or the approval condition.

Assume an authorized trade reduces exposure by 10,000 per basis point. The resulting 42,000 still exceeds the original limit by 2,000. Reporting “the hedge was executed” is not enough to close the breach. Recalculate the exposure, inspect the hedge’s basis and liquidity effects, and determine whether further reduction or an explicitly authorized temporary exception is required. Record the deadline and owner of any outstanding action.

A later increase in the approved limit does not make the earlier breach disappear. Preserve the original measurement and decision history, then record when the new authority became effective. After closure, distinguish a one-off execution error from a recurring failure in limit design, data or incentives. The point of the record is to make the decision reconstructable, not merely to change a dashboard from red to green.

Is a risk limit the same thing as a risk appetite statement?

A risk appetite statement expresses the institution’s willingness to take risk in pursuit of objectives. A limit makes part of that willingness operational through a constraint. One limit rarely represents the whole appetite. Stress, concentration, capital and funding considerations may require separate measures and escalation conditions.

Can one event belong to several risk categories?

Yes. Classify distinct mechanisms and avoid counting the same economic loss repeatedly. A system failure can prevent a hedge, create funding pressure and leave market exposure. The useful answer explains that sequence and the response needed at each stage, rather than choosing a label and stopping.

Try a changed assumption

A desk’s DV01 falls from 52,000 to 42,000 after a profitable trade. The approved limit is still 40,000. Is the breach resolved?

Show answer and reasoning

No. Exposure remains 2,000 per basis point above the limit, or 5%. The reduction is progress, but the approved constraint is still exceeded.

Original learning check. No email or account needed.

Can the business own risk if risk management is independent?

Yes. The business manages its exposures; independent challenge, oversight and assurance provide distinct checks. Independence does not transfer all responsibility away from the business.

Sources and scope

Links checked 2026-10-10. GARP establishes exam scope; the technical references support the methods identified below. These are selected study notes and original examples, not complete curriculum coverage or official exam questions.

Prepared by MiloPrep editorial team. MiloPrep is independent of GARP. References do not imply endorsement or independent review of these notes.