Enterprise risk management connects an organization’s objectives to the risks it takes, the controls it uses and the capital it holds. A CERA candidate needs to do more than name risk categories: the useful work is tracing how an event changes cash flows, how risks interact and whether a response improves the organization’s position after its costs are counted. This guide moves from governance and risk culture through identification, measurement and modeling, then into strategy, controls and capital decisions. Its examples use hypothetical figures so you can practice the calculations and, just as importantly, explain their limits. The same reasoning applies to insurers, other financial firms and nonfinancial organizations, although their exposures and stakeholders differ.
ERM Foundations
1. What enterprise risk management adds
Enterprise risk management starts with the organization’s objectives, then asks how exposures across business units could jointly prevent them. A risk register for each unit can miss a shared supplier, system or funding source. An enterprise view identifies those common causes, measures consequences across affected activities and gives decision-makers a basis for comparing returns with resilience. The unit that receives a cost saving may differ from the units that bear an interruption loss, so both belong in the decision. Risk owners still manage their exposures; coordination makes dependencies and trade-offs visible. The current CERA syllabus expects this reasoning across different organizations and stakeholders. CERA is a global credential with a common syllabus, while each awarding association sets its own assessment route.
Worked example: A retailer saves a hypothetical 2 million annually by using one supplier for three product lines. A plausible outage would remove 8 million of margin across those lines. The 8 million is a scenario loss, not an expected annual loss, so subtracting it directly from the annual saving would be misleading. Map the shared supplier dependency, estimate outage likelihood and duration, and price backup capacity before approving the saving.
Watch the distinction: A supplier decision can look sound within one product line while weakening all three. Add the losses across affected lines and compare them with the saving on a consistent time basis.
2. Drivers and value of ERM
Market change, digital dependence and stakeholder expectations can make risks move together. Expansion into a new channel may increase sales while changing fraud patterns, service demand and customer expectations at the same time. Coordinated ERM helps identify the shared driver, assign owners and monitor indicators that cross functional boundaries. Start by tracing each adverse outcome to systems, processes and third parties; then ask whether separate teams are testing the same failure mode. A useful response may combine platform availability, authentication, transaction exceptions and customer complaints in one review. The value lies in earlier detection and a better choice of controls, not in producing a single risk score. A shared review also lets management see when a control against one risk creates friction or exposure elsewhere.
Worked example: An insurer’s online sales grow while suspicious transactions and failed service requests both rise. Fraud staff propose tighter screening; service staff propose more agents. Both symptoms may come from the same digital platform or identity process. Assign a joint review of authentication errors, fraud alerts and service failures by channel. Test whether screening changes reduce fraud without causing unacceptable service delays.
Watch the distinction: Separate fraud and service plans do not prove the exposures are separate. Their simultaneous rise is a cue to test common systems and controls before funding isolated fixes.
Reference: [2]
3. The risk control cycle
The risk control cycle begins with a measurable objective, because a control is useful only in relation to an outcome. Identify events that could defeat the objective and their causes, assess likelihood and impact, choose a response, then monitor both control operation and the outcome. Comparing performance with the target reveals whether the response is sufficient. Where results disappoint, distinguish a control that was poorly designed from one that was designed well but rarely performed. Reassess the risk after a change in demand, equipment or staffing rather than assuming last year’s assessment still holds. This is an iterative management process: monitoring supplies evidence for revised controls, resources or even objectives. Recording the owner, indicator and review point makes the cycle actionable.
Worked example: A warehouse targets 98% on-time delivery and achieves 92%, a 6 percentage point gap. Records show vehicle failures often cause missed runs, so the fleet owner schedules preventive maintenance and tracks completed checks alongside monthly delivery rates. Delivery improves to 95%, still 3 percentage points below target. Investigate remaining causes and maintenance execution before treating the control as sufficient.
Watch the distinction: Installing preventive maintenance does not complete the cycle. Check whether it operated and improved delivery; a rise to 95% still leaves the stated objective unmet.
Reference: [2]
4. Risk communication
Effective risk communication preserves the same underlying facts while changing the detail to support each audience’s decision. Senior decision-makers need the objective at risk, credible range of consequences, urgency, response options and the decision requested. Operators need affected assets, warning signs, responsibilities and recovery steps. State assumptions and uncertainty clearly, especially when a loss estimate depends on outage duration or a supplier’s recovery claim. Separate what has happened from what might happen, and specify who can update the assessment. A concise escalation should show why action is needed now; a detailed operating brief should let people act without inferring missing tasks. Consistent figures and definitions across both reports prevent contradictory decisions.
Worked example: A key supplier reports a possible five-day outage. The board paper estimates margin at risk using five days of expected production, identifies the uncertainty in that estimate and seeks authority for backup supply. The operations brief lists affected parts, stock cover, the date each line would stop, the backup order trigger and recovery owners. Both describe the same outage assumption.
Watch the distinction: Sending the board a long parts list obscures its decision. Giving operations only an estimated financial loss leaves staff without triggers or tasks.
Reference: [2]
5. Choosing an ERM framework
Choose an ERM framework by identifying the management gaps it must address. ISO 31000 provides a broadly usable structure for setting context, identifying and assessing risks, treating them, and communicating and monitoring throughout. COSO ERM emphasizes how governance, strategy, performance and review connect risk to organizational choices. A firm may use elements of both: a repeatable assessment process for consistent records and strategic reporting that tests whether its plans fit its appetite. Compare the framework with decision speed, complexity, existing governance and available expertise. Then define risk owners, challenge rights, escalation routes and evidence requirements locally. The associate in risk management guide can reinforce general risk process vocabulary, but framework selection depends on the organization’s actual decisions and accountability.
Worked example: A manufacturer’s managers discuss risks informally, and its board sees only past incidents. Introduce a common method to identify, assess and monitor exposures, then require major investment proposals to show strategic risks and performance indicators. Name each operating owner and give the risk function a challenge role. The framework supplies structure; management must assign authority and resources.
Watch the distinction: Adopting a named framework does not itself produce effective governance. If nobody owns a risk or can escalate it, even a consistent assessment template will have little effect.
Reference: [2]
6. Reading risk culture
Risk culture is visible in what people do when targets and controls conflict. Examine incentives, challenge, exception reporting, treatment of bad news and leaders’ responses to escalation. A written policy or completed training shows intent, while observed decisions show whether that intent shapes behavior. Compare leading indicators, such as overrides or delayed exception logs, with outcomes such as complaints and losses. Investigate alternative explanations before attributing a trend to culture: growth, a new channel or a reporting change can alter counts. Interviews and samples of actual decisions can test whether staff feel able to raise concerns. A sound diagnosis connects the incentive to a plausible behavior and then to an outcome, rather than treating one metric as proof of cause.
Worked example: Sales staff receive volume bonuses, exceptions are rarely logged, and monthly complaints rise from 20 to 50. The increase is (50 − 20) ÷ 20 = 150%. Review complaint rates per sale, sales scripts, overrides and whether staff can challenge unsuitable offers. If sales volume also changed, the raw count alone cannot establish the cause. Rebalance incentives and test the result.
Watch the distinction: A 150% complaint increase does not show that training succeeded or failed. It is a warning signal requiring denominator checks and investigation of behavior and incentives.
Reference: [2]
7. Agency conflicts
An agency conflict arises when the person choosing an action receives its benefits on a different schedule or bears different costs from those exposed to its consequences. A manager paid for current revenue may favor guarantees whose losses emerge years later. Customers, owners or future managers may then bear the downside. Diagnose the conflict by tracing who can make the decision, who gains immediately, who pays after adverse outcomes and when those outcomes become visible. Controls can align incentives through deferred compensation, adjustment for later losses and independent review of terms. Limits and approval rights also matter when exposures are hard to reverse. The objective is to improve decisions, not to assume every revenue-seeking action is improper.
Worked example: A manager receives a bonus on this year’s sales of contracts carrying three-year guarantees. Revenue is recognized for the bonus period, while repair or replacement obligations may emerge later. Review guarantee pricing and plausible claim scenarios independently before approval. Defer part of the bonus and adjust it for subsequent guarantee performance so the manager shares the longer-term result.
Watch the distinction: A profitable first year does not establish that the guarantee was well priced. The future obligation belongs in the decision even if its cost has not yet appeared in cash claims.
Reference: [2]
8. Compliance, conduct and audit
Compliance asks whether an activity meets applicable rules and internal requirements. Conduct asks whether customers are treated fairly in practice, including whether information supports an informed decision. Internal audit supplies independent assurance by testing whether governance and controls are designed and operating as intended. These functions address different questions. Approved wording may satisfy a disclosure requirement yet fail to communicate a fee clearly; a clearer document may still need operational checks to ensure staff use it. Start with the customer outcome, identify where misunderstanding arises, change the process and define evidence that would show improvement. The business remains responsible for the process, while risk or compliance challenges it and audit later tests its operation. Legal review may also be needed where wording creates contractual uncertainty.
Worked example: A provider uses approved fee wording, but customers repeatedly say they thought the fee was optional. Review calls and forms to locate the misunderstanding, rewrite the explanation and test comprehension with customers. Train staff and monitor complaints. Later, internal audit samples sales records and calls to check whether the revised explanation was actually given and documented.
Watch the distinction: Approval of the wording does not settle the conduct question. Nor does an audit recommendation fix the customer outcome until the business changes and reliably operates the process.
Reference: [2]
9. Designing the risk function
A risk function needs enough expertise to evaluate material exposures, authority to challenge proposals and access to people who can act on its findings. Independence matters most when a business leader benefits from the position under review. Reporting through that leader alone can discourage escalation or filter unfavorable findings. A workable structure gives risk staff direct access to senior management and an appropriate board committee, clear rights to information and a documented route for unresolved disagreement. It also distinguishes oversight from ownership: business managers choose and operate positions within approved boundaries; the risk function measures, challenges and reports them. Assess effectiveness through actual cases, including whether warnings reached decision-makers in time and whether challenge changed a decision when warranted.
Worked example: A risk officer reviewing trading positions reports only to the trading head. A concentration warning could therefore be delayed or softened before reaching the board. Give the officer direct access to senior management and the board risk committee, with a route to record unresolved challenges. Traders still own position choices and must act within approved limits.
Watch the distinction: Making the risk officer responsible for every trading decision confuses oversight with ownership. The function needs independent challenge and access; traders remain accountable for their positions.
Reference: [2]
10. Roles across the organization
The three lines model separates doing, overseeing and independently assuring risk management. Operating management owns risks and performs controls as part of its decisions. Risk and compliance functions set methods, advise, monitor and challenge, with authority suited to their mandates. Internal audit independently evaluates whether governance and controls work, then reports its findings through an appropriate assurance route. Collaboration is essential: the business needs usable guidance, oversight needs timely data, and audit needs evidence of actual operation. Yet collaboration should not erase accountability or make audit the designer of controls it later tests. When a failure occurs, first assign immediate customer or financial correction to the process owner, then investigate control weaknesses and arrange independent testing.
Worked example: A faulty claims rule causes an incorrect payment. Claims management corrects the payment, contacts affected parties and repairs its approval control. Risk or compliance reviews the rule, advises on policy and challenges the fix. Internal audit later samples claims to test whether the corrected control works consistently. Each group contributes without transferring claims ownership to oversight or audit.
Watch the distinction: Calling risk management the owner of a faulty claims process leaves the business unaccountable. Advice and independent testing support the owner; they do not replace control operation.
Reference: [2]
11. Escalation and risk committees
Escalation should connect a measurable boundary to a decision-maker with authority to respond. Specify the metric, how it is measured, its owner, monitoring frequency and the point at which a forecast or actual breach must be reported. Forecast breaches can warrant action before a limit is crossed. An escalation should describe causes, duration, uncertainty and options, including their costs and residual exposures. A risk committee then decides among actions within its authority, records any exception and its expiry, and assigns follow-up. A limit change is a governance decision, not a way to erase a breach retrospectively. Distinguish a temporary operational deviation from evidence that the organization’s risk appetite or measurement method needs review.
Worked example: A unit’s forecast exposure rises from a hypothetical 18 million to 24 million against a 20 million limit. It was 2 million below the limit and is now forecast 4 million above it. The owner escalates the forecast with its drivers and proposes reducing 4 million, hedging enough exposure or seeking an authorized exception before taking the position.
Watch the distinction: Waiting for the forecast 24 million exposure to become an actual breach wastes the warning. A committee should decide on the projected 4 million excess while options remain available.
Reference: [2]
12. External risk drivers
External scanning becomes useful when a change is traced into a specific objective. Political, economic, social, technological, legal and environmental developments can alter demand, supply, cost or permission to operate. Identify the first affected activity, its dependencies and the stakeholders whose actions may amplify the effect. Then test a plausible scenario against capacity and available responses. A drought, for example, affects water access directly but can also raise input prices, disrupt suppliers and heighten competition with local users. The analysis should avoid treating every external headline as a material risk. Ask what exposure the organization actually has, how soon it could change, which indicators would reveal it and who can decide on contingency action.
Worked example: Assume a plant normally needs 100 units of water each day and drought cuts its allocation by 30%, leaving 70. To maintain output, it needs 30 units per day from conservation, storage or alternative supply. Check whether those options are deliverable, their costs and effects on local community needs. If only 15 units are available, the production target must be revised.
Watch the distinction: Listing drought as an environmental risk is only a starting point. Quantify the operational shortfall and test feasible responses before claiming production can continue.
Reference: [2]
13. Stakeholder perspectives
Stakeholders judge a decision through different objectives and exposures. A board may focus on sustainable returns and resilience; customers on access and service; employees on work and safety; funders on cash generation; supervisors on outcomes within their remit. Map who gains, who bears costs, when effects occur and whether harms can be mitigated. Monetary benefits are important, but a single net figure can hide severe effects concentrated on one group. Use relevant measures for each perspective, such as response times, complaints, staff turnover, liquidity and operating cost. The decision process should show how these measures inform the choice and which assumptions need monitoring. A staged action can preserve part of a saving while allowing evidence to guide the final decision.
Worked example: Closing a service center would save a hypothetical 4 million each year but lengthen response times. Management should estimate how many customers face delays, whether vulnerable customers are disproportionately affected, staff transition costs and any supervisory concern. Trial reduced hours or a phased transfer, track response times and complaints, and retain a reopening trigger if service deteriorates beyond an approved tolerance.
Watch the distinction: The 4 million saving is not the whole decision. It says nothing by itself about customer harm, employee effects or whether the replacement service can meet its objective.
Reference: [2]
14. Adapting to an unforeseen change
An unforeseen change requires a faster cycle than the ordinary planning timetable. First determine which assumptions have failed and map processes that depend on them. Separate immediate continuity decisions from longer-term strategy: an interim supplier may preserve service while a redesign reduces future concentration. Establish a short reporting cadence with indicators tied to actual delivery, quality and remaining stock. Give owners authority to act within defined boundaries and escalate choices that change risk appetite or impose major costs. As evidence improves, update scenarios and retire temporary measures deliberately. Learning from the event should change sourcing criteria, contracts or monitoring, rather than merely documenting the surprise. The key is to keep decisions coherent while information remains incomplete.
Worked example: A technology shift makes a critical vendor unavailable within weeks. Map every dependent service and remaining inventory, then activate a qualified temporary supplier for the most urgent needs. Monitor daily service failures, stock cover and replacement quality. If the temporary route proves unreliable, escalate capacity choices immediately. After stabilization, revise sourcing to avoid relying on the same vulnerable technology.
Watch the distinction: Waiting for the annual risk review leaves a near-term service gap unmanaged. Temporary continuity action and revision of the underlying sourcing assumption should proceed on different time scales.
Reference: [2]
Risk analysis and evaluation
15. Finding risks from objectives
Risk identification works best when it starts with an objective and asks what could prevent, delay or change its achievement. Trace each candidate risk to a source and a pathway to the objective. This reveals distinct exposures that a broad label such as operational risk can hide. Consider resources, processes, people, external parties and changing conditions; then check dependencies and possible opportunities as well as threats. A useful risk statement names an uncertain event and its consequence, so an owner can select indicators and controls. Avoid confusing an existing weakness with the event it may cause: weak refrigeration maintenance is a cause, spoiled meals are a possible event, and missed deliveries are an outcome. The CERA overview practice questions can help rehearse this objective-first framing.
Worked example: A charity targets 10,000 meals each month. A funding shortfall could reduce purchases, refrigeration failure could spoil prepared meals, and volunteer shortages could leave deliveries unstaffed. For each, identify the owner, early indicator and affected meal count under a plausible scenario. A single generic service risk would conceal the different responses: funding reserves, equipment maintenance and staffing cover.
Watch the distinction: Naming three threats without linking them to the 10,000-meal objective gives little basis for prioritization. Trace each through a credible disruption to deliveries.
Reference: [2]
16. Causes, events and consequences
A clear causal chain separates the condition that makes failure more likely, the event itself and the resulting harm. That distinction shows where a control acts. Preventive controls reduce the chance of an event; detective controls identify it quickly; continuity and recovery controls reduce consequences after it occurs. One control may affect more than one stage, but its intended effect should be explicit. For cyber risk, an unpatched system creates vulnerability, an intrusion is an event, and interrupted billing is a business consequence. Test whether the proposed response reaches the relevant stage: a backup does not prevent intrusion, and patching alone does not guarantee service recovery. Include dependencies such as identity systems and data restoration time when assessing residual risk.
Worked example: A software patch is missed, attackers exploit the vulnerability and ransomware halts billing. Set a patch inventory and completion checks to reduce intrusion likelihood; use monitoring to detect unusual activity; maintain tested backups and recovery steps to shorten billing interruption. Measure both patch completion and restoration time. Neither measure alone describes the entire exposure.
Watch the distinction: Treating halted billing as the cause leads to a response aimed only at the symptom. Locate the missed patch, intrusion and interruption separately so controls target each stage.
Reference: [2]
17. Detecting emerging risks
Emerging risks often appear before reliable loss data. Weak signals can include unusual customer questions, supplier behavior, new technology use or expert warnings. Detect them by combining frontline observations with structured challenge and an exposure map: which products, processes and stakeholders could be affected if the signal develops? Look for a plausible causal pathway and potential scale, then gather targeted evidence. Do not require a precise probability before opening an investigation, but do not treat every novel observation as a crisis. Assign an owner, record what would confirm or weaken the concern and decide when to revisit it. This approach is especially valuable for conduct and technology changes, where historical incidents may reflect an older environment.
Worked example: Several customers ask why their information is being used in a way staff cannot clearly explain, although no formal complaints have arrived. Record the questions, identify products and data flows using that practice, and commission a focused review of consent, explanations and customer outcomes. Track whether inquiries spread or become complaints while the review establishes what is actually happening.
Watch the distinction: No past complaints does not establish that the practice is safe. Early questions may reveal a changed exposure, while their significance still needs investigation.
Reference: [2]
18. Monitoring emerging risks
Monitoring an emerging risk requires indicators linked to its causal pathway, a named owner and a trigger for reconsidering action. Use more than one signal when possible: incidents may show observed failures, defect reports may show product performance, and substitution lead time shows how exposed the organization would be if failures spread. Define consistent measurement periods and reporting sources so a trend is interpretable. A trigger should prompt a decision or deeper review, not automatically declare that the risk has become severe. Consider both likelihood and consequences, since a rare defect can matter greatly when replacement takes months. Update indicators as the technology matures; early proxies may later give way to stronger operating data.
Worked example: A manufacturer depends on a new battery chemistry. Supplier incidents rise from one to four per quarter, a fourfold count and an increase of three. The risk owner checks whether reporting volume changed, reviews defect reports and tests how long substitution would take. The agreed trigger starts a design and inventory review; it does not by itself establish a fourfold rise in failure probability.
Watch the distinction: Treating one indicator as a complete risk measure overlooks exposure and consequence. A rise in reported incidents needs validation and a defined management response.
Reference: [2]
19. Risk classifications
Risk categories answer different questions. Source describes where an exposure originates, event describes what happens, impact describes what is harmed, and controllability describes which parts management can influence. A single event can therefore carry several valid labels. Multiple views support different decisions: supplier oversight follows a third-party source, continuity planning follows an operational outage, and financial planning follows lost income. Record a primary event consistently for aggregation, while retaining source and impact tags to reveal concentrations. Avoid double-counting the same loss merely because it has both financial and reputational effects; estimate distinct consequences and their causal relationship. Classification is a tool for assigning analysis and action, not a claim that risks fit exclusive boxes.
Worked example: A cloud provider outage stops a customer portal. Classify the outage event as operational and its source as third-party. Lost transactions create financial impact; prolonged customer frustration may create reputational impact. The firm can influence supplier selection, redundancy and recovery planning but cannot directly repair the provider’s network. Preserve all views in the record and assign a continuity owner.
Watch the distinction: Calling the event only a cloud risk can hide its revenue and customer effects. Giving it four tags also does not justify counting one lost transaction four times.
Reference: [2]
20. Financial statement effects
A risk event can affect the balance sheet, income statement and cash flow at different times. First identify what asset is impaired or what obligation has arisen, then determine the period’s expense or income effect and the resulting change in equity. Recognition follows the applicable accounting basis; a cash payment may occur later. Separate the original loss from a replacement purchase, insurance recovery or tax effect, each of which needs its own facts and timing. For an inventory write-off, the carrying amount leaves assets and becomes an expense, reducing profit and equity. Buying replacement inventory later exchanges cash for a new asset at its purchase cost; it does not reverse the earlier loss. This distinction helps risk managers connect event severity with both reported performance and liquidity needs.
Worked example: Assume uninsured inventory with a carrying value of 12 million is destroyed, with no tax effect. The write-off reduces inventory assets, profit and equity by 12 million; it creates no immediate cash outflow. If identical stock later costs 12 million, purchase reduces cash by 12 million and adds 12 million of new inventory. The original loss remains in profit.
Watch the distinction: Counting the later replacement payment as a second 12 million expense overstates the loss. It is a cash outflow to acquire new inventory, distinct from the earlier write-off.
Reference: [2]
21. Liquidity versus solvency
Solvency concerns whether the value of assets is sufficient to meet liabilities. Liquidity concerns whether usable cash arrives when payments are due. A firm can appear solvent on its balance sheet while most assets are inventory, property or long dated receivables that cannot be converted to cash overnight. Start with a schedule of contractual payments and expected cash receipts, then test which assets can actually be sold or pledged within each period. Account for sale discounts, borrowing capacity and restrictions on cash. A liquidity response might use a committed credit line, earlier collections or assets that mature before obligations fall due. Selling assets under pressure can also turn a cash shortage into a solvency problem if realized values are much lower than recorded values. Keep valuation uncertainty and payment timing visible in the same assessment.
Worked example: A hypothetical firm reports assets of 120 million and liabilities of 100 million, so accounting equity is 20 million. Yet it has only 5 million cash and must pay 15 million tomorrow. Its immediate cash gap is 15 minus 5, or 10 million. It needs a credible source of 10 million by tomorrow, such as available financing or a sale that can settle in time; the accounting surplus alone cannot make the payment.
Watch the distinction: Positive equity does not guarantee timely payment. Check the dates and accessibility of cash flows before concluding that an organization can meet an obligation.
Reference: [2]
22. Value at Risk
Value at Risk, or VaR, is a quantile of a loss distribution over a specified horizon. At confidence level 90%, it marks a loss that the model expects to exceed in 10% of outcomes, assuming a continuous distribution. Define the loss measure, horizon and confidence level before calculating it; a daily trading VaR cannot be read as an annual enterprise loss estimate. VaR describes a boundary, so it gives no direct measure of how large losses become beyond that boundary. The estimated quantile also depends on exposure data, distributional assumptions and dependencies between risks. For an ERM decision, compare the VaR with available resources and examine tail scenarios separately. The CERA 2024 syllabus includes the properties and limitations of risk measures such as VaR.
Worked example: Suppose one year loss, measured in millions, is uniformly distributed from 0 to 10. The 90th percentile is 0 plus 0.90 times the 10 million range, or 9 million. Thus 90% of modeled losses are at or below 9 million, and 10% exceed it. The result says nothing about average loss within that upper 10%; the assumed 10 million maximum comes from this particular model.
Watch the distinction: A 90% VaR of 9 million is not a maximum possible loss. It is a percentile, and decisions sensitive to extreme outcomes need additional tail information.
Reference: [2]
23. Tail Value at Risk
Tail Value at Risk, often called expected shortfall, averages losses in the worst specified fraction of a distribution. At 90% confidence, identify the upper 10% of modeled losses and take their mean. This makes losses beyond the VaR boundary part of the result. For a continuous distribution, the calculation is conceptually straightforward; for a distribution with a large probability mass exactly at VaR, define carefully how much of that mass enters the tail. TVaR is typically at least as large as VaR for the same loss distribution and confidence level. It can therefore reveal whether two portfolios with similar VaR have very different severe outcomes. Yet its numerical value still rests on uncertain tail data, modeled event severity and dependence assumptions. Test those assumptions before using TVaR as a capital or risk appetite measure.
Worked example: Assume the same hypothetical one year loss is uniform from 0 to 10 million. Its 90% VaR is 9 million, and the worst 10% of losses runs uniformly from 9 to 10 million. The mean of that interval is (9 + 10) ÷ 2 = 9.5 million. TVaR exceeds VaR by 0.5 million because it reflects loss severity within the modeled tail.
Watch the distinction: TVaR is not the single worst modeled loss. It averages a defined tail, so specify both the confidence level and the loss distribution.
Reference: [2]
24. Aggregation and diversification
When two variable losses are added, their means add, but their standard deviations generally do not. For standard deviations σ₁ and σ₂ with correlation ρ, combined variance is σ₁² + σ₂² + 2ρσ₁σ₂. Taking its square root gives the standard deviation of total loss. Correlation below one creates a diversification benefit relative to simply adding the two standard deviations. This is a statement about variability, not automatically about capital or tail loss: translating it into either requires further distributional assumptions and an appropriate risk measure. Check that both loss series use the same horizon, units and accounting basis. Examine shared drivers, especially in adverse conditions, because a correlation estimated in ordinary periods may change under stress. A related investment risk guide can reinforce the variance calculation, while ERM applies it across organizational exposures.
Worked example: Suppose two one year losses have standard deviations of 30 million and 40 million, with correlation 0.25. Combined variance is 30² + 40² + 2(0.25)(30)(40) = 900 + 1,600 + 600 = 3,100 million squared. The square root is about 55.7 million. Adding stand-alone deviations gives 70 million, so the modeled variability benefit is about 14.3 million, subject to the assumed correlation.
Watch the distinction: Do not call the 14.3 million difference a capital saving without specifying a capital measure and loss model. Standard deviation alone does not determine tail capital.
Reference: [2]
25. Dependence in the tail
An ordinary correlation summarizes broad co-movement, often around the center of observed outcomes. It may conceal the chance that two risks fail together during an extreme event. Start by identifying a common cause such as a utility, cloud provider, weather system or funding market. Estimate the probability of each event and the joint event under both an independence assumption and a plausible common-cause scenario. Then compare the consequences, since simultaneous failures may remove the very backup intended to absorb a single failure. Stress tests and conditional probabilities can expose this dependence without claiming a precise statistical estimate where severe events are scarce. The question for a decision maker is whether diversification and continuity plans still work when conditions are worst. Historical correlation should be challenged if the mechanisms producing losses can change under stress.
Worked example: Assume two sites each have a 5% annual outage probability. If failures were independent, the chance of both failing would be 0.05 × 0.05 = 0.0025, or 0.25%. A shared utility could make a hypothetical 3% joint outage probability plausible, twelve times that estimate. Because 3% remains below each site's 5% outage probability, it is logically possible; the firm should test a common-power scenario before relying on either site as backup.
Watch the distinction: Low correlation in routine observations does not prove independence during a crisis. Look for shared causes and test whether the backup fails with the primary operation.
Reference: [2]
26. Scenario analysis
Scenario analysis builds a coherent account of how several conditions change together and what that means for an objective. Begin with a trigger, such as a demand contraction, then specify linked changes in sales volume, prices, costs, funding or service capacity. Use consistent timing and avoid combining assumptions that contradict the narrative. Translate those assumptions into cash flow, earnings and operational effects, then test the decision at stake. A scenario need not carry a precise probability to be useful; it can show which conditions would make a plan unacceptable. Compare it with a base case and vary influential assumptions to identify the main drivers. Finally, choose actions and indicators that would reveal the scenario as it develops. CERA overview practice questions can help you rehearse this sequence with different organizational settings.
Worked example: A hypothetical business has annual revenue of 100 million and costs of 70 million, leaving operating margin of 30 million. In a demand shock, revenue falls to 80 million while costs remain 70 million for that year. Margin becomes 10 million, a 20 million decline. If a proposed expansion requires 15 million of additional annual fixed spending, the stressed operation would have a 5 million shortfall before financing effects; management should revise or stage the plan.
Watch the distinction: Changing one input while leaving linked assumptions unexplained is a weak scenario. State why costs, prices and cash flows do or do not move with the shock.
Reference: [2]
27. Stress and reverse stress tests
A stress test starts with a specified severe condition and calculates its effects. A reverse stress test begins with a defined failure, such as exhausting cash before ten days, and works backward to find conditions that cause it. Both require a clear starting position, time horizon and operational response assumptions. For liquidity, divide usable cash by a constant daily net outflow to estimate survival time, provided no other receipts or facilities are available. Reverse testing can instead divide the buffer by the required survival days to find the largest sustainable outflow. Compare that boundary with plausible stresses and identify actions that would change it, such as securing cash or reducing payments. A useful result names the failure mechanism and early indicators, not merely a dramatic number. Recheck calculations if outflows or available cash change over time.
Worked example: Assume a 50 million cash buffer and no incoming cash or borrowing. At 5 million net outflow per day, it lasts 50 ÷ 5 = 10 days. For a ten-day survival objective, the reverse-test boundary is 50 ÷ 10 = 5 million per day; any higher constant outflow fails it. At 8 million per day, survival is only 50 ÷ 8 = 6.25 days, leaving a 3.75-day shortfall.
Watch the distinction: A reverse stress test does not merely apply a larger arbitrary shock. Define the failure first, then solve for the conditions that produce it.
Reference: [2]
28. Risk accumulation
Risk accumulation occurs when separately recorded exposures can suffer loss from the same event. Policy numbers, customer names or street addresses may differ while the underlying building, supplier, floodplain or counterparty is shared. Identify a common event unit first, then map every contract and operation to that unit. Sum the relevant gross exposures, allow for policy terms and limits, and estimate the loss a single event could generate. Data quality matters: inconsistent location names and incomplete ownership records can hide a concentration. Assess both direct claims and operational consequences, such as a disrupted distribution center affecting several business lines. Compare the accumulated loss with capital, insurance or reinsurance protection and response capacity. Reporting only the largest individual exposure can materially understate the organization's vulnerability.
Worked example: Three hypothetical insurance policies each cover up to 40 million of loss and list different mailing addresses. A location check shows that all three insured operations occupy one building. A fire capable of fully damaging each operation therefore creates 3 × 40 = 120 million of gross policy exposure to one event, subject to each contract's coverage terms. Treating the entries as three independent locations would miss the concentration.
Watch the distinction: Different contracts do not imply different physical risks. Aggregate by the event that can affect them together, then apply each contract's terms.
Reference: [2]
29. Compounding risks
Risks compound when one shock magnifies the effect of another or when several adverse movements strike a thin financial or operational buffer. On a balance sheet, equity equals assets minus liabilities. A percentage change in each side may seem modest, yet the effect on equity can be large when equity is small relative to total assets. Model the shocks together using internally consistent assumptions: an asset fall may occur alongside higher claims, collateral calls or reduced access to funding. Calculate each effect and the combined position, then identify whether the first shock makes the second more likely or harder to absorb. Distinguish such causal feedback from simply adding simultaneous losses. Test whether management actions, including forced asset sales or service cuts, amplify the outcome. The practical issue is how much resilience remains after the combined event.
Worked example: A hypothetical firm starts with 100 million assets and 90 million liabilities, so equity is 10 million. A 10% asset fall reduces assets to 90 million. A separate 5% liability rise increases liabilities to 94.5 million. Together, equity is 90 minus 94.5 = negative 4.5 million, a 14.5 million deterioration. Either shock alone would leave positive equity of zero or 5.5 million, respectively; their combination exhausts the initial cushion.
Watch the distinction: Do not judge combined risk from the size of each percentage alone. Apply both changes to the balance sheet and inspect the remaining equity and cash.
Reference: [2]
30. Rare, severe events
For infrequent severe events, separate how often events occur from how large each loss is. A Poisson frequency model uses an annual expected count λ; pairing it with an independent severity distribution gives expected annual loss equal to λ times mean severity. That average is useful for budgeting or pricing, but it cannot describe the funding needed when a large event actually occurs. Model the severity tail and possible multiple events, and consider whether the event rate varies by season, location or changing exposure. Sparse observations make parameter estimates uncertain, so scenarios and expert challenge are especially valuable. Compare a severe event with both capital and immediate liquidity, because the organization may need cash before recoveries arrive. The objective is a credible range of outcomes and responses, not a false sense of precision from a single average.
Worked example: Assume events follow a Poisson process with mean frequency 0.2 per year, and each event has mean severity of 50 million, independent of frequency. Expected annual loss is 0.2 × 50 = 10 million. That does not make a 50 million payment affordable: one event can require five times the annual expected loss. A capital and liquidity review should test the payment timing and the range of possible severities.
Watch the distinction: Expected annual loss is an average across many possible years. It does not cap a single loss or show whether cash will be available when an event occurs.
Reference: [2]
31. Model risk
Model risk is the possibility of a poor decision because a model's data, assumptions, code or interpretation are wrong or unsuitable for the decision. Review the full chain: how exposures were captured, whether the conceptual mechanism reflects real dependencies, whether implementation matches the specification, and whether users understand the output's limits. Backtesting can reveal discrepancies, but a mismatch needs investigation before one concludes that a specific assumption is the cause. Check sample size, changing exposures and definitions of observed events. Independent validation, sensitivity analysis and simpler benchmark calculations can identify fragile results. If a model materially understates a risk, use a conservative range or scenario while corrections are made. The response should be proportionate to the decision: a major sourcing commitment demands stronger evidence than an exploratory estimate.
Worked example: A hypothetical supplier model assumes independent failures and forecasts a 1% annual joint outage rate. Over a stated observation period, the measured rate is 4%, four times the forecast. Before changing contracts, the risk team checks outage definitions and sample size, then maps shared power and network dependencies. Until the discrepancy is resolved, it tests sourcing plans against the observed rate and a common-cause scenario instead of relying on the 1% estimate.
Watch the distinction: A failed forecast does not identify its own cause. Check data, definitions, code and changing conditions before replacing one assumption with another.
Reference: [2]
32. Choosing a modeling technique
Choose a technique by the decision it must support, the available evidence and the cost of being wrong. A deterministic scenario can reveal a critical dependency quickly, while a stochastic model is useful when credible frequency, severity and dependence estimates are available and decision makers need a distribution of outcomes. Start with the exposure map and decision horizon. Ask which inputs are observed, which require judgment, and whether model complexity will materially change the choice. Sensitivity ranges can show how recommendations vary as uncertain inputs move. A sophisticated output with poorly supported parameters is less useful than a transparent scenario that identifies a failure point. Retain room to improve the technique as data accumulate. Document assumptions and validate the result against operational knowledge so that the model serves the decision rather than dictating it.
Worked example: A small hypothetical business has little relevant cyber loss history and must select a continuity arrangement this month. It models three outage lengths of 1, 5 and 15 days and, assuming 0.4 million lost margin per day, calculates losses of 0.4, 2 and 6 million. It then tests whether backups can restore service within each case. These ranges support the immediate choice; a probability model can follow when exposure and incident data improve.
Watch the distinction: More simulation is not automatically better analysis. If probabilities are unsupported, thousands of simulated outcomes can still conceal the same uncertain assumptions.
Reference: [2]
33. Quantifying credit exposure
For a simple credit exposure, expected loss equals probability of default times exposure at default times loss given default. Specify a common time horizon and ensure the three inputs refer to the same borrower, facility and conditions. Exposure at default may include expected drawings before default; loss given default reflects recoveries after collateral, costs and timing. For multiple borrowers, sum expected losses only after considering whether individual estimates are compatible. Expected loss is an average across outcomes, so it is distinct from a severe credit loss or the capital needed to absorb unexpected defaults. A concentration in one sector or common collateral can make the tail much worse than a sum of independent averages suggests. The financial analysis study guide offers related credit and portfolio concepts; here the calculation supports an enterprise risk decision.
Worked example: Take a hypothetical one year loan exposure at default of 100 million, a one year default probability of 3%, and loss given default of 60% after expected recoveries. Expected credit loss is 100 × 0.03 × 0.60 = 1.8 million. If default occurs, the modeled loss is 60 million, far above that average. A lender should therefore assess concentration, liquidity and capital alongside the 1.8 million expectation.
Watch the distinction: The expected loss of 1.8 million is not what the lender loses upon default. Conditional on default, the modeled loss is 60 million.
Reference: [2]
34. Assessing hard-to-quantify risks
Some risks lack enough comparable events to support a credible numerical probability. Analyze them through causes, exposed activities and plausible consequences instead of inserting an unsupported percentage. Identify what would fail, what dependencies would transmit the event, how long restoration would take and which losses would accumulate over that time. Build several severity or duration scenarios and test the organization's ability to respond. Indicators such as vendor incidents, replacement lead time or repeated control exceptions can show whether exposure is changing even before a major loss occurs. Assign an owner to collect those signals and define when the assessment must be revisited. Separate an illustrative scenario loss from expected loss: multiplying a plausible consequence by an invented likelihood would add apparent precision without better evidence. The decision can still be concrete if it compares fallback cost with potential interruption.
Worked example: A critical vendor has no recorded failure, but replacement would take 20 days. Assume the dependent service would lose 1 million of margin per day throughout that period, with no partial recovery. A full interruption would therefore cost 20 × 1 = 20 million. Management can test whether a temporary supplier shortens the outage and what that option costs. The 20 million is a scenario consequence, not an expected loss.
Watch the distinction: No historical failures does not establish zero risk. Assess the dependency and the cost of a plausible failure while keeping probability uncertainty explicit.
Reference: [2]
Embedding ERM into decision-making
35. Articulating risk appetite
Risk appetite expresses which kinds and amounts of uncertainty an organization is willing to accept while pursuing its objectives. Begin with the objective and the resources available to absorb loss or disruption, then distinguish risks that can be taken for value from risks that would undermine essential services. A useful statement is specific enough to guide choices: it names the exposure, the intended tolerance and the action when that tolerance is approached. Different activities can have different appetites because their consequences and ability to recover differ. Translate the broad statement into measures, limits and escalation rules, while recognizing that some important outcomes need qualitative indicators. Review appetite when strategy or the external environment changes. The CERA Global syllabus overview identifies risk appetite and limits as part of embedding ERM in decisions.
Worked example: A hypothetical hospital network can absorb moderate swings in elective appointment demand by changing schedules, but an interruption to urgent care threatens an essential objective. Its appetite statement can allow managed elective volume variability while requiring strong continuity for urgent care. The resulting investment priority is backup power and tested access to critical systems. Managers would monitor both demand forecasts and service interruption indicators, with faster escalation for urgent care failures.
Watch the distinction: One organization-wide label such as 'low risk appetite' gives little guidance. Express appetite by objective and exposure so different consequences lead to different controls.
Reference: [2]
36. Limits and escalation
A risk limit turns appetite into a boundary that can be measured before a decision is made. Define the exposure measure, unit, time horizon, owner and data source; otherwise the same number can be interpreted in several ways. Specify who may approve an exception and what happens when a limit is approached or breached. Escalation should present the current position, cause, likely duration, available responses and effect on objectives. A limit breach is a decision point, not proof that an actual loss has occurred. Controls can include reducing exposure, hedging, delaying a transaction or obtaining an authorized exception within the organization's governance arrangements. Monitor headroom as well as breaches, because a proposed transaction may use the remaining capacity. Reassess limits if the underlying capacity or risk profile changes.
Worked example: Assume an organization has set a hypothetical 20 million limit on unhedged currency exposure, measured after each proposed trade. Current exposure is 18 million and a new trade would add 8 million, making 26 million. The proposal exceeds the limit by 6 million. Before execution, the owner could reduce the proposed exposure by at least 6 million, hedge that amount effectively, or seek an authorized exception with its rationale and duration.
Watch the distinction: Do not wait for a realized exchange loss before escalating. The proposed 26 million exposure itself crosses the stated 20 million boundary.
Reference: [2]
37. Risk and opportunity in strategy
Strategic choices create both opportunity and new dependence. Compare options using expected return, plausible downside, ability to adapt and consistency with risk appetite. First identify what must go right for each forecast, including partners, capacity and customer demand. Then test adverse scenarios and whether management can change course without excessive loss. A higher expected profit may be worthwhile if the concentration is controlled, but the forecast alone cannot settle the decision. Ask whether a backup partner, contract protection, staged entry or smaller initial commitment can retain the upside while reducing vulnerability. Consider effects on customers and other stakeholders if an essential distributor fails. Present the choice with assumptions and conditions attached, so decision makers know which uncertainty they are accepting and which indicator would prompt review.
Worked example: A hypothetical firm compares Market A, with 12 million expected annual profit and one distributor, against Market B, with 8 million and three viable distributors. The 4 million profit advantage for A is a forecast, not compensation proven sufficient for distributor failure. Management can price a second distribution route and test an outage scenario. If no workable fallback exists and continuity is central to its appetite, B may be preferable despite its lower forecast profit.
Watch the distinction: Expected profit alone cannot rank strategies when their resilience differs. Identify the dependency behind each forecast and test whether the downside is acceptable.
Reference: [2]
38. Stakeholder effects of decisions
A risk response can reduce one party's cost by moving risk to another. Map who receives the benefit, who bears the extra loss and who can realistically manage it. For insurance deductibles, higher customer retention can reduce small claims handling, but it also changes out-of-pocket costs and may affect access, complaints and renewal behavior. Quantify the known saving separately from uncertain effects; then use customer segments and plausible claim scenarios to test affordability. Examine whether communication lets customers understand the changed protection before they choose it. The decision should reflect the organization's objectives and intended customer outcomes, not just its expense line. Monitor claims, complaints and cancellations after implementation so the organization can detect harm that an initial financial forecast missed.
Worked example: A hypothetical insurer estimates that raising deductibles will save 3 million annually in claims administration. That saving is the insurer's benefit, while customers would pay more on covered small losses. Without claim frequency and customer affordability data, the net customer effect cannot be calculated. The insurer should model deductible payments across customer groups, test whether the 3 million saving survives changed retention, and consider a more targeted change if some groups face disproportionate strain.
Watch the distinction: A 3 million expense saving is not a complete business case. Deductibles transfer costs to customers and may change behavior, complaints and future revenue.
Reference: [2]
39. Risk and return trade-offs
A decision's headline profit can conceal how much risk capacity it consumes. Return on risk capital divides the relevant expected profit by the capital attributed to the option, using a consistent time period and measurement basis. This ratio can compare capital efficiency, but it does not replace assessment of absolute value, downside, liquidity or strategic fit. Check whether the capital figures are stand-alone or incremental to the existing portfolio; diversification can make marginal capital very different. Confirm that expected profit includes the costs of controls, financing and any capital charge being used in the comparison. A smaller option can have a higher percentage return while contributing less total profit. Where the organization faces a binding capital constraint, the efficient use of scarce capital may be decisive; otherwise both total contribution and risk should remain visible.
Worked example: Assume Option A earns 12 million expected annual profit and uses 100 million of risk capital; its return is 12 ÷ 100 = 12%. Option B earns 9 million using 50 million, giving 9 ÷ 50 = 18%. B is more capital efficient by this measure, while A offers 3 million more expected profit. Before choosing, compare the options' downside, diversification with existing business and whether capital is actually scarce.
Watch the distinction: The higher 18% ratio does not automatically make B the best strategy. Check absolute profit, marginal capital, tail risk and other constraints.
Reference: [2]
40. ERM in strategic planning
Embed ERM in strategic planning by making risk analysis part of approval and later review. State the proposed objective, map its key dependencies, and compare a base case with coherent adverse scenarios. Challenge assumptions before funds are committed, including whether controls and contingency options can operate under the same stress. Test the plan against appetite and limits, then quantify the cost of mitigation and the residual exposure. Approval can include conditions such as a backup supplier, staged investment or a monitoring trigger. Assign an owner who can respond when indicators cross that trigger. After implementation, compare actual outcomes with the assumptions used at approval and revise the plan if the environment changes. This sequence makes risk information actionable: it connects uncertainty to a specific investment choice, an accountable response and a point for reconsideration.
Worked example: Before approving a hypothetical factory, management models normal water supply and a drought that reduces supply by 30%. It checks whether reduced output would breach its water-risk limit, then obtains a price and delivery terms for backup water. Approval can be conditioned on securing that supply and monitoring reservoir levels. If a defined availability trigger is reached, the owner activates the backup or slows production; the investment decision thus includes a workable response.
Watch the distinction: A risk register completed after investment approval cannot shape the original choice. Test dependencies and response costs before approval, then attach monitoring and actions.
Reference: [2]
41. Selecting a risk response
Start with the objective at risk, then compare avoidance, acceptance, reduction and transfer on the same basis. For each option, estimate the loss that remains, the cost of implementing it, the time needed and any new dependency it creates. Expected loss helps compare recurring costs, but a low probability interruption can still exceed available cash or threaten a critical service. A backup line reduces downtime only if it can handle the required volume and its own dependencies differ from the primary line. A transfer contract may reimburse specified losses without restoring production; exclusions, deductibles, claim delays and counterparty strength therefore matter. Test the options against appetite and continuity objectives before recommending one. Where probabilities are unreliable, compare coherent disruption scenarios and identify which assumptions would change the choice.
Worked example: Suppose a possible interruption would cost 10 million if no action is taken. A backup line costs 0.8 million and halves the interruption loss to 5 million, giving a 5.8 million combined cost in that event. A transfer contract costs 1.4 million; if it pays 8 million on this event, retained loss plus cost is 3.4 million. That looks better for the specified event, but an exclusion could leave 11.4 million. Check coverage and recovery speed before choosing.
Watch the distinction: Choosing the lowest premium or control cost ignores retained losses and continuity. A payment after an outage may protect earnings while failing to keep customers supplied.
Reference: [2]
42. Avoidance and acceptance
Avoidance removes an activity or exposure, such as declining a product or leaving a market. It can remove both its downside and its expected return, so assess the opportunity surrendered as well as the loss prevented. Acceptance means the organization knows the exposure and retains its consequences within available resources. It requires a defined owner, a reason for retaining it and monitoring for changes in frequency or severity. A reserve can finance a loss but cannot prevent it; its adequacy depends on the range of plausible losses and competing calls on cash. Compare each decision with risk appetite, loss-bearing capacity, strategic value and the effect on stakeholders. If a severe outcome could undermine solvency or an essential service, a favorable average return alone does not make acceptance defensible.
Worked example: A proposed product earns an expected 2 million annually but has a plausible severe loss that could exhaust the firm's available capital. Declining it is avoidance, with 2 million of expected annual profit forgone. Separately, a 50,000 equipment repair risk fits within a designated 500,000 reserve, leaving 450,000 after one such repair. Retaining that repair risk may be reasonable if its frequency and competing reserve uses are monitored.
Watch the distinction: Holding a reserve does not eliminate the underlying risk. Nor does accepting a small loss imply that a much larger, strategically attractive exposure also fits the firm's capacity.
Reference: [2]
43. Reduction and transfer
Reduction changes the chance of an event, its severity, or both. Sprinklers, for example, may limit fire spread even if they cannot prevent ignition. Transfer shifts specified financial consequences to another party through insurance or a similar contract. The event can still happen, and the organization retains deductibles, exclusions, uncovered harm, claim timing and counterparty exposure. Compare options by calculating retained loss under each relevant scenario, then add control costs and premiums. Expected loss is probability multiplied by severity when a simple one-event model is appropriate; it does not describe the full tail or cash needed during a claim. Combining reduction and transfer can be useful because a control protects operations while cover helps finance remaining damage. Check whether the contract rewards or requires the control before assuming their benefits simply add.
Worked example: Assume a 10 million fire loss, a hypothetical annual probability of 4% without sprinklers, and 1% with them. Insurance pays 80% of a covered loss, leaving 2 million. With both measures, retained expected annual loss is 0.01 × 2 million = 20,000, before sprinkler and premium costs. Sprinklers alone give 0.01 × 10 million = 100,000; insurance alone gives 0.04 × 2 million = 80,000.
Watch the distinction: Calling an insured risk eliminated confuses financial reimbursement with prevention. Fire can still interrupt operations, and exclusions or payment delays can leave material losses with the insured.
Reference: [2]
44. Designing process controls
Map the process from authorization through payment and reconciliation before placing controls. A preventive control blocks an error before money leaves, such as matching an invoice to a purchase order and receipt. A detective control identifies an error that passed earlier checks, such as an exception report for repeated invoice numbers, suppliers or amounts. A corrective control resolves the error and its cause, such as recovery, ledger adjustment and repair of the matching rule. Give each control an owner, required evidence and a clear response to exceptions. Independence matters when one person can create a supplier, approve an invoice and release payment. The risk management guide offers related control practice, but the process map should determine where a particular control belongs.
Worked example: A company receives two invoices for the same 12,000 purchase. Matching invoice number, supplier and purchase order before release should block the duplicate. If a changed invoice number lets it through, a daily report comparing supplier, amount and date should flag both payments. Accounts payable then seeks 12,000 recovery, corrects the ledger and investigates why matching failed. The payment owner, report reviewer and recovery owner each need assigned responsibility.
Watch the distinction: Adding an exception report alone does not prevent duplicate cash outflow. Detection needs prompt review and recovery, while prevention must address the route that let the duplicate through.
Reference: [2]
45. Testing control effectiveness
Control design asks whether a control, if performed as specified, would address the relevant failure. Operating effectiveness asks whether people actually performed it consistently, at the right time, with reliable evidence. Define the population, sample selection, test period and what counts as an exception before testing. For dual approval, evidence must show two authorized approvals before release, rather than two names added afterward. An observed exception rate describes the tested sample; it is not automatically the rate for every transaction, especially if sampling was targeted. Investigate whether failures cluster by team, system, transaction size or date. Then assess whether compensating checks detected harm, correct the cause and retest after the change. A well-written procedure does not demonstrate that the control operated.
Worked example: Dual approval is required before each transfer. In a sample of 100, 92 records show both timely approvals and eight do not, so the observed exception rate is 8 ÷ 100 = 8%. Four exceptions occurred during a system outage and four had no documented reason. Examine the outage workaround and unexplained cases separately, assess any unauthorized transfers, repair the process and retest a later sample.
Watch the distinction: Treating 92 compliant records as proof of an effective control overlooks eight failures. Conversely, calling the true organization-wide failure rate exactly 8% exceeds what one sample establishes.
Reference: [2]
46. Hedging with derivatives
A derivative hedge should offset a defined exposure in amount, currency and settlement date. An importer owing foreign currency loses when that currency strengthens against its domestic currency. A forward purchase of the foreign currency fixes the domestic amount payable, provided the hedge matches the actual obligation and the contract performs. The forward does not remove supplier default, quantity changes or settlement risk. It also exchanges uncertain future cost for certainty: if the foreign currency weakens, the importer cannot benefit from the cheaper spot purchase on the hedged amount. Compare the hedge with risk appetite and cash planning, including any collateral requirements. A financial analysis guide can support the market mechanics, while the ERM decision still depends on the underlying business exposure.
Worked example: An importer owes 10 million foreign currency units in six months and agrees to buy them forward at 1.20 domestic units each. Its payment is 10 million × 1.20 = 12 million domestic units. If spot is 1.30 at settlement, an unhedged payment would be 13 million, so the hedge saves 1 million. If spot is 1.10, the unhedged cost would be 11 million, and the hedge forgoes that 1 million benefit.
Watch the distinction: A forward that fixes one exchange rate does not make the whole transaction risk free. The invoice amount may change, and the hedge can create settlement or collateral needs.
Reference: [2]
47. Basis and collateral risk
Basis risk arises when the hedging instrument and the actual exposure do not move together. A crude oil contract may offset some jet fuel price movement, yet refining margins, transport costs and local supply conditions can change the spread. Measure the residual exposure using the purchased product, hedge index, volumes and dates, rather than assuming identical percentage moves. The hedge ratio may need adjustment if historical relationships shift under stress. Collateral creates another pathway: a derivative can produce variation margin payments before the physical purchase or operating benefit occurs. Those payments are a liquidity risk even if the hedge reduces eventual economic loss. Stress both the price mismatch and the cash timing. Check contract terms, eligible collateral and available liquidity alongside the expected hedge benefit.
Worked example: Assume a firm needs jet fuel costing 10 million at today's prices and hedges an equal price exposure with crude oil. Jet fuel rises 20%, adding 2 million to its purchase cost. Crude rises 12%, producing an assumed 1.2 million hedge gain on matching notional. The residual price increase is 800,000, equivalent to an 8 percentage point mismatch on the stated base. Interim margin calls could still require cash before that gain is realized.
Watch the distinction: Matching notional amounts does not guarantee a complete hedge. Different products and settlement dates can leave basis exposure, while collateral payments can strain cash despite a sound long-run offset.
Reference: [2]
48. Reinsurance mechanics
In quota share reinsurance, the insurer and reinsurer divide covered premiums and claims by an agreed percentage. This reduces the insurer's net claim severity and usually cedes the same share of the relevant premium, subject to contract terms and any commission. It is proportional protection across covered business, unlike an excess arrangement that pays only above an attachment point. Calculate gross, ceded and retained amounts separately, then examine exclusions, claims handling, settlement timing and reinsurer creditworthiness. The ceded share is a receivable when a claim is due; it is not instant cash. Also consider whether the insurer retains enough premium to cover expenses and its retained risk. Reinsurance can support capacity and stabilize results, but the contract determines which losses actually qualify.
Worked example: Under a 40% quota share, a covered claim of 50 million produces a 20 million reinsurance recovery and a 30 million net claim: 50 × 0.40 = 20 and 50 − 20 = 30 million. If the relevant gross premium is hypothetically 10 million, 4 million is ceded before any commission terms. The insurer must weigh that premium ceded and reinsurer credit exposure against the lower net claim.
Watch the distinction: A 40% quota share does not mean the reinsurer pays only after the insurer has lost 40%. It divides covered losses proportionally from the first unit of loss.
Reference: [2]
49. Retention and cover exhaustion
An excess cover has an attachment point and a maximum layer payment. The buyer retains losses below attachment; the cover pays the part above attachment until its limit is exhausted. For loss L, attachment A and layer limit M, payment is the smaller of M and the greater of zero and L minus A, assuming the event is covered. Retained loss is L minus that payment. Apply the formula separately to each relevant event or aggregate period according to the contract, because reinstatements, annual limits and exclusions can change the result. A limit of 20 million above 5 million protects only the interval from 5 million to 25 million. Losses beyond 25 million return to the buyer, so a large event can create two retained portions.
Worked example: A covered loss is 30 million. The excess layer attaches at 5 million and pays at most a further 20 million. Its payment is min(20, 30 − 5) = 20 million. The buyer retains 30 − 20 = 10 million: 5 million below attachment and 5 million above the 25 million exhaustion point. A 4 million covered loss would receive no layer payment.
Watch the distinction: Reading a 20 million limit as 20 million of protection for every loss misses attachment and exhaustion. The first layer and any amount above the covered interval remain with the buyer.
Reference: [2]
50. Asset and liability duration
Modified duration approximates the percentage change in present value for a small parallel yield change: percentage change is about negative duration times the rate change. Apply it to assets and liabilities separately, then subtract the liability value change from the asset value change to estimate the effect on equity. A duration gap indicates sensitivity, but the sign depends on values as well as durations. Matching durations can reduce first-order rate sensitivity; it does not necessarily match cash flows or remove credit, inflation and nonparallel yield-curve risks. Larger rate changes also make convexity more important. An asset-liability response might change bond holdings, liability terms or hedges, with attention to liquidity and basis risk. Use consistent valuation dates and rate assumptions when comparing the two sides.
Worked example: Assets are 100 million with modified duration 4; liabilities are 90 million with modified duration 7. For a hypothetical 1 percentage point parallel rate rise, assets change by about −4 × 0.01 × 100 = −4 million. Liabilities change by about −7 × 0.01 × 90 = −6.3 million. Equity therefore changes by approximately −4 − (−6.3) = +2.3 million, before convexity and other effects.
Watch the distinction: Longer liability duration does not automatically mean equity falls when rates rise. Revalue both sides and subtract liabilities; the liability decrease can exceed the asset decrease.
Reference: [2]
51. Cash-flow matching
Present-value matching compares amounts discounted to today, while cash-flow matching checks whether inflows arrive when obligations must be paid. A long bond may have enough current value to cover a near-term liability on paper but cannot pay it at maturity next year if it matures in five years. Selling early introduces market-price risk; borrowing against it introduces funding and collateral risk. Build a dated schedule of expected benefit payments, asset coupons, maturities and reliable liquidity sources. Test delays, adverse rates and unusually large payments, rather than relying only on an annual total. Assets maturing near liability dates, a ladder of short-term instruments or committed liquidity can close timing gaps. Assess reinvestment and issuer risk as well, since a scheduled asset payment is only useful if it arrives.
Worked example: A fund must pay 40 million in one year and holds a bond worth 42 million today that matures in five years. The 2 million excess in current value does not provide a one-year cash inflow. If the fund sells the bond after a hypothetical 10% price fall, proceeds are 42 × 0.90 = 37.8 million, leaving a 2.2 million payment gap. One-year maturing assets or dependable liquidity would address that timing risk.
Watch the distinction: An asset worth more than a liability today is not necessarily available on the liability date. Early sale value and funding access can change precisely when cash is needed.
Reference: [2]
52. Managing nonfinancial risk
Manage nonfinancial risk by tracing how harm can occur, then place controls along that pathway. For a loading bay, separate people from moving vehicles to reduce contact, use speed and access rules to lower event likelihood, and prepare response procedures to limit injury severity. Incident and near-miss reporting supplies information about hazards before severe outcomes occur. Interpret trends carefully: an increase may reflect more exposure, worse conditions or better reporting. Compare counts with vehicle movements or hours worked where possible, inspect the circumstances and ask workers about unreported events. Assign supervisors to review findings and verify that corrective actions actually change the work pattern. Environmental, operational and people risks can share a cause, such as rushed schedules, so incentives and staffing belong in the analysis.
Worked example: A plant records six loading-bay near misses in a month across 3,000 vehicle movements, or two per 1,000 movements. After marked pedestrian routes and traffic separation, it records three across 3,000, or one per 1,000. The rate has halved, but supervisors should inspect reporting consistency and actual route use before attributing all improvement to the barrier. Each new near miss still warrants review.
Watch the distinction: Waiting for an injury treats the absence of past harm as proof of safety. Near misses reveal exposure, though their counts need context about activity levels and reporting.
Reference: [2]
53. Cyber and third-party contagion
A third-party failure spreads when several services depend on one component, supplier or credential path. Draw the dependency chain from each customer service through its application, identity provider, network and recovery tools. A common provider can create correlated outages even if the services appear operationally separate. Assess blast radius by counting affected services and identifying which customer functions stop, then estimate recovery time under realistic access constraints. A fallback should avoid the same provider and should be tested without weakening security. Contracts may promise availability, but service credits rarely restore customer access or cover all consequential losses. Track provider incidents, concentration, change notices and time to switch. Include internal dependencies, because a single shared configuration error can produce the same pattern as a supplier outage.
Worked example: Three customer services authenticate through one identity provider. A four-hour provider outage blocks all three, so one event affects three services, not one isolated application. If each service normally handles 500 transactions per hour, up to 3 × 500 × 4 = 6,000 transactions may be delayed, assuming demand continues and no fallback works. Test independent access for essential functions and a recovery queue for delayed transactions.
Watch the distinction: Separate applications do not imply separate risk if they share authentication or recovery infrastructure. Counting only the failed supplier understates the number of customer services affected.
Reference: [2]
54. Managing an event after it occurs
Once an event occurs, first stop ongoing harm and preserve enough evidence to identify affected transactions. Stabilize essential service, establish a reliable population of affected customers and calculate individual remediation. Communicate clearly about the error, the remedy and when it will arrive. Reconcile refunds against source records so omissions and duplicates are found. Investigate the initiating change, failed controls and any similar products or periods before closing the incident. A corrected rule should pass targeted tests, including the original failure case and boundary cases, before production use. Monitor results afterward because a technically corrected process can still leave backlogs or customer harm. Assign incident leadership and decision rights so containment, operations, finance and customer teams work from the same facts.
Worked example: A billing error charges 2,000 customers 15 each. Disable the faulty rule and identify the exact affected accounts. Total refunds are 2,000 × 15 = 30,000, assuming one excess charge per customer. Reconcile 2,000 refund records to the charge list, notify customers and test the corrected rule against the original case and nearby fee conditions. Check later bills for recurrence and investigate how the error passed release controls.
Watch the distinction: Refunding an estimated total without reconciling customer records can miss people or pay twice. Remediation also remains incomplete if the faulty rule can charge customers again.
Reference: [2]
55. Building a capital model
Define what the capital model must decide before choosing distributions. Specify the organization, risks covered, horizon, valuation basis and whether the output measures total loss or loss beyond amounts already provided for. Build separate market, claims and operational loss components, then model their dependence, including common shocks. Simulate or otherwise estimate the aggregate loss distribution at the chosen horizon and apply a tail measure suited to the decision. Compare the result with eligible available resources on a consistent basis. Validate inputs, implementation and outputs against experience and plausible stress scenarios; document uncertainty where data are thin. The current CERA syllabus includes capital-model development as an ERM application. A model's precise number is less useful than a transparent result that decision-makers can challenge.
Worked example: Suppose a hypothetical one-year insurer model includes market, claims and operational losses with shared economic shocks. Its simulated 99th-percentile aggregate loss is 34 million, expected loss is 8 million, and available capital is 30 million on the same basis. If expected loss is already funded, modeled unexpected loss is 34 − 8 = 26 million, leaving 30 − 26 = 4 million headroom. Recheck whether common shocks and available capital are measured consistently.
Watch the distinction: Adding three standalone tail losses assumes they occur together at those levels. Ignoring dependence can also understate a common shock, so aggregate the joint distribution explicitly.
Reference: [2]
56. Different views of capital
Accounting equity is assets less liabilities under the applicable reporting basis. Economic capital estimates resources needed to withstand specified unexpected losses over a defined horizon and risk measure. A regulatory requirement is set under an applicable supervisory framework, with its own valuation and eligible-capital rules. These figures answer different questions and may use different asset values, liability measures and permitted resources. Compare each need with resources measured on the corresponding basis; do not assume reported equity is automatically eligible regulatory capital. An organization may also hold a management buffer above a formal minimum for rating, funding or strategic reasons. When assessing a decision, identify which constraint binds and how the transaction changes both required capital and available resources. Avoid presenting a single surplus number unless the bases have been reconciled.
Worked example: A hypothetical firm reports 90 million accounting equity, estimates a 75 million economic capital need and faces an 80 million regulatory requirement. If, solely for this example, all 90 million qualifies on both capital bases, economic headroom is 90 − 75 = 15 million and regulatory headroom is 90 − 80 = 10 million. The regulatory comparison is tighter. In practice, reconcile eligible resources and valuations before using either headroom.
Watch the distinction: Accounting equity is not automatically the capital available under every assessment. Subtracting an economic need from reported equity without reconciling measurement bases can create a misleading surplus.
Reference: [2]
57. Economic value and capital cost
Economic value added asks whether earnings exceed the charge for capital tied up in a business. Subtract an appropriate capital charge from profit measured on a consistent basis; a positive result indicates value after that charge, subject to the quality of both inputs. This is useful for comparing units that earn different headline profits while consuming different amounts of risk capital. Embedded value addresses a different question for long-term insurance business: broadly, it combines adjusted net assets with the present value of future profits from existing business, allowing for capital costs and other relevant adjustments. Assumptions about claims, expenses, lapses, discounting and guarantees can materially change it. Avoid counting the same future cash flow in both net assets and projected profits. The management accounting guide provides related performance-measure context.
Worked example: A unit earns 14 million after operating costs and uses 100 million of capital. At a hypothetical 10% annual capital charge, the charge is 100 × 0.10 = 10 million and economic value added is 14 − 10 = 4 million. That positive result does not establish embedded value: projecting in-force future profits requires assumptions about future claims, expenses and discounting, plus adjustments for capital costs and obligations.
Watch the distinction: Positive accounting profit does not prove value creation after capital cost. Nor is embedded value simply current profit multiplied by years remaining; future cash flows and obligations need valuation.
Reference: [2]
58. Risk measures in capital assessment
A loss quantile such as Value at Risk identifies a level exceeded with a stated model probability over a specified horizon. Tail Value at Risk averages losses beyond a chosen quantile, so it reflects severity within the tail as well as its starting point. Neither measure is meaningful without the portfolio, horizon, confidence level and model assumptions. For capital planning, distinguish total tail loss from unexpected loss if expected losses are already funded through pricing, provisions or reserves. Subtracting expected loss can avoid funding the same component twice, but only when the expected amount is genuinely provided for on a compatible basis. TVaR can respond more strongly to extreme losses; both measures remain vulnerable to data gaps, dependence assumptions and changes in exposure. Use stress scenarios to challenge the modeled tail.
Worked example: A hypothetical one-year portfolio has expected loss of 3 million, 99% VaR of 12 million and 99% TVaR of 16 million. If the expected 3 million is separately funded, VaR-based unexpected loss is 12 − 3 = 9 million, while TVaR-based unexpected loss is 16 − 3 = 13 million. The 4 million difference reflects greater weight on losses beyond the quantile, not a change in the underlying portfolio.
Watch the distinction: A 99% VaR of 12 million does not cap losses at 12 million. It identifies a quantile; losses in the remaining tail can be much larger.
Reference: [2]
59. Allocating aggregated risk
Aggregated risk can be below the sum of standalone risks because losses do not always peak together. An allocation distributes that diversified total to business units for pricing, performance or limits, and the allocated amounts should sum to the total being assigned. A proportional allocation uses standalone risk shares and is simple to explain. It does not necessarily reflect each unit's marginal effect on the portfolio: a unit strongly correlated with existing exposures may consume more incremental capital than its standalone share suggests. A marginal or Euler-style method can better connect allocation to contributions when the risk measure and model support it. Choose a method for the decision it must inform, keep its assumptions visible and examine how allocations change under stress. Diversification benefits are model dependent and may shrink when common shocks dominate.
Worked example: Unit A has 60 million standalone risk and Unit B has 40 million; together they require 80 million. Proportional allocation assigns A: 80 × 60 ÷ 100 = 48 million, and B: 80 × 40 ÷ 100 = 32 million. The allocations total 80 million, and the 20 million diversification benefit is shared as 12 million and 8 million. If A drives common-stress losses, a contribution-based allocation could assign it more.
Watch the distinction: Standalone risk amounts cannot both be charged in full while claiming a diversified total of 80 million. Any allocation must reconcile to the total and match its intended use.
Reference: [2]
60. Charging capital to business units
Capital charges help a unit see the cost of risk capacity used by its decisions. For a new product, incremental capital is the change in the organization's required capital with and without the product, not necessarily the product's standalone risk. Multiply that increment by a consistent capital charge rate and compare it with incremental profit measured over the same period. A positive residual suggests economic value under those assumptions, but it does not override appetite, liquidity, customer outcomes or strategic fit. Shared diversification can make marginal capital lower than standalone capital; concentration can make it higher. For continuing performance reviews, specify how shared capital, costs and benefits are attributed so units cannot improve reported returns by shifting risks elsewhere. Recalculate as the portfolio changes because marginal contributions are not fixed properties of a product.
Worked example: A proposed product adds 6 million annual profit and raises total required capital from 100 million to 140 million. Incremental capital is 140 − 100 = 40 million. At a hypothetical 10% annual charge, its capital cost is 40 × 0.10 = 4 million, leaving incremental value of 6 − 4 = 2 million annually. Approve only if the profit forecast, capital model, appetite and strategic effects withstand challenge.
Watch the distinction: Charging the product on its standalone capital can misstate its effect on the whole firm. The decision should use the change in aggregate capital, with consistent profit assumptions.
Reference: [2]
Official references and further reading
- Syllabus – CERA Global Association
- CERA Global 2024 syllabus currently linked by the issuer
- Chartered Enterprise Risk Analyst (CERA)