8010 Operational Risk Manager (ORM) Exam Questions and Answers

Current replacement values are a very poor measure of the credit exposure from a derivative contract, because the future value of these instruments is unpredictable, ie is stochastic, and the range of values it can take increases the further ahead in the future we look. Therefore it is common for credit exposures for derivatives to be measured using forward looking exposure profiles, which are distributions of the expected value of the derivative at the time horizon for which credit risk is being measured. To be conservative, a high enough quintile of this distribution is taken as the 'loan equivalent value' of the derivative as the exposure.Choice 'c' is the correct answer.

The notional value of derivative contracts generally tends to be quite high and unrelated to their economic value or the counterparty exposure. Therefore notional value is irrelevant.

Choice 'b' is the correct answer. All other answers are incorrect.

Refer to the detailed loss event type classification underBasel II (see Annex 9 of the accord). You should know the exact names of all loss event types, and examples of each.

EDFs are derived from the distance to default. The distance to default isthe number of standard deviations that expected asset values are away from the default point, which itself is defined as short term debt plus half of the long term debt. Therefore debt levels affect the EDF. Similarly, asset values are estimated using equity prices. Therefore market capitalization affects EDF calculations. Asset volatilities are the standard deviation that form a place in the denominator in the distance to default calculations. Therefore asset volatility affects EDF too. The risk free rateis not directly factored in any of these calculations (except of course, one could argue that the level of interest rates may impact equity values or the discounted values of future cash flows, but that is a second order effect). Therefore Choice 'b' is the correct answer.

Once we have a number of distributions in themodel space, the task is to select the "best" distribution that is likely to be a good estimate of true severity. We have a number of distributions to pick from, an empirical dataset (from internal or external losses), and we can estimate the parameters for the different distributions. We then have to decide which distribution to pick, and that generally requires considering both approximation and fitting errors.

There are three methods that are generally used for selecting a model:

1. Thecross-validation method: This method divides the available data into two parts - the training set, and the validation set (the validation set is also called the 'testing set'). Parameter estimation for each distribution is done using the training set, anddifferences are then calculated based on the validation set. Though the temptation may be to use the entire data set to estimate the parameters, that is likely to result in what may appear to be an excellent fit to the data on which it is based, but without any validation. So we estimate the parameters based on one part of the data (the training set), and check the differences we get from the remaining data (the validation set).

2. Complexity penalty method: This is similar to the cross-validation method, but with an additional consideration of the complexity of the model. This is because more complex models are likely to produce a more exact fit than simpler models, this may be a spurious thing - and therefore a 'penalty' is added to the more complex modelsas to favor simplicity over complexity. The 'complexity' of a model may be measured by the number of parameters it has, for example, a log-normal distribution has only two parameters while a body-tail distribution combining two different distributions mayhave many more.

3. The bootstrap method: The bootstrap method estimates fitting error by drawing samples from the empirical loss dataset, or the fit already obtained, and then estimating parameters for each draw which are compared using some statistical technique. If the samples are drawn from the loss dataset, the technique is called a non-parametric bootstrap, and if the sample is drawn from an estimated model distribution, it is called a parametric bootstrap.

4. Using goodness of fit statistics: The candidate fits can be compared using MLE based on the KS distance, for example, and the best one selected. Maximum likelihood estimation is a technique that attempts to maximize the likelihood of the estimate to be as close to the true value of the parameter.It is a general purpose statistical technique that can be used for parameter estimation technique, as well as for deciding which distribution to use from the model space.

All the choices listed are the correct answer.

The credit migration approach to assessing portfolio credit risk involves obtaining a distribution of future portfolio values from the ratings migration matrix. First, the frequencies in the matrix are used as probabilities, and expected future values of the securities belonging to each rating category are calculated. These are then discounted to the present using the discount rate appropriate to the 'future' rating category. This gives us a forward distribution of the value of each security in the portfolio. These are then combined using the default correlations between the issuers. The default correlation between the issuers is often proxied using asset returns, and recognizing that default occurs when asset values fall below a certain threshold. A distribution for the future value of the portfolio is generated using simulation, and from thisdistribution the Credit VaR can be calculated.

Thus, we need the migration matrix, the risk horizon from which the present values need to be calculated, and the forward yield curve or the discount curve for each rating category for the risk horizon. Thus,Choice 'd' is the correct answer.

With the passage of time, the range of possible values the FX contract can take increases. Therefore the maximumvalue of the contract, which is when the credit risk would be maximum, would be at maturity. (Note that this is different than an interest rate swap whose value at maturity approaches zero.) Therefore Choice 'a' is the correct answer and the others are incorrect.

A recap would be in order here: calculating operational risk capital is a multi-step process.

First, we fit curves to estimate the parameters to our chosen distribution types for frequency (eg, Poisson), and severity (eg, lognormal). Note that these curves are fitted at the UoM level - which is the lowest level of granularity at which modeling is carried out. Since there are many UoMs, there are are many frequency and severity distributions. However what we are interested in is the loss distribution for the entire bank from which the 99.9th percentile loss can be calculated. From the multiple frequency and severity distributions we have calculated, this becomes a two step process:

- Step 1: Calculate the aggregate loss distribution for each UoM. Each loss distribution is based upon and underlying frequency and severity distribution.

- Step 2: Combine the multiple loss distributions after considering the dependence between the different UoMs. The 'dependence' recognizes that the various UoMs are not completely independent, ie the loss distributions are not additive, and that there is a sort of diversification benefit in the sense that not all types of losses can occur at onceand the joint probabilities of the different losses make the sum less than the sum of the parts.

Step 1 requires simulating a number, say n, of the number of losses that occur in a given year from a frequency distribution. Then n losses are picked from theseverity distribution, and the total loss for the year is a summation of these losses. This becomes one data point. This process of simulating the number of losses and then identifying that number of losses is carried out a large number of times to get the aggregate loss distribution for a UoM.

Step 2 requires taking the different loss distributions from Step 1 and combining them considering the dependence between the events. The correlations between the losses are described by a 'copula', andcombined together mathematically to get a single loss distribution for the entire bank. This allows the 99.9th percentile loss to be calculated.

Pre-settlement risk is the risk that one of the counterparties defaults prior to the date for the maturity of the transaction in question. This may be an unrelated default, in fact there may have been no default on that particular contract, but the party may have defaulted on its other obligations, or filed for bankruptcy. To deal with such cases and to protect the interests of both the parties, it is common toprovide for immediate termination of positions and settlement based on the current replacement value of the contracts. Therefore statements I and II are correct.

Statement III is correct as well - the exposure from an OTC derivative contract derives fromits current replacement value, and not the notional. If the current replacement value is negative, then the credit exposure is considered equal to zero.

Statement IV is correct as it is quite common to restate all exposures - those from credit lines, OTC derivatives etc - in loan equivalent terms prior to estimating credit risk.

The credit risk horizon for credit VaR is generally one year.Therefore Choice 'b' is the correct answer.

Bank B's exposure is measured by the price it paid for the bonds, which in this case is $7m ($10m x 70/100). Hence Choice 'c' represents the correct answer.

(Note that the question is asking for 'exposure' and not the legal claim in the event of default. The legal claim in the event of default would be the full notional of $10m. )

The initial issue price and issue size are irrelevant.

The point that this question is trying to emphasize is the independence of the risk management function. The risk function should be segregated from the risk taking functions as to maintain independence and objectivity.

Choice 'd', Choice 'c' and Choice 'a' run contrary to this requirement of independence, and are therefore not correct. The risk function should report directly to senior levels, for example directly to the audit committee, and not be a part of the risk taking functions.

The correct answer is Choice 'b'. The following is a brief description of the major approaches available to model credit risk, and the analysis that underlies them:

1. CreditMetrics: based on the credit migration framework. Considers the probability of migration to other credit ratings and the impact of such migrations on portfolio value.

2. CreditPortfolio View: similar to CreditMetrics, but adds the impact of the business cycle to the evaluation.

3. The contingent claims approach: uses option theory by considering a debt as a put option on the assets of the firm.

4. KMV's EDF (expected default frequency) based approach: relies on EDFs and distance to default as a measure of credit risk.

5. CreditRisk+: Also called the 'actuarial approach', considers default as a binary event that either happens or does not happen. This approach does not consider the loss of value from deterioration in credit quality (unless the deterioration implies default).

Other than Choice 'c', all others represent valid approaches to allocate economic capital to underlying business units. There is no such thing as 'fixed ratioeconomic capital contribution'

A recap would be in order here: calculating operational risk capital is a multi-step process.

First, we fit curves to estimate the parameters to our chosen distribution types for frequency (eg, Poisson), and severity (eg, lognormal). Note that these curves are fitted at the UoM level - which is the lowest level of granularity at which modeling is carried out. Since there are many UoMs, there are are many frequency and severity distributions. However what we are interested in is the loss distribution for the entire bank from which the 99.9th percentile loss can be calculated. From the multiple frequency and severity distributions we have calculated, this becomes a two step process:

- Step 1: Calculate the aggregate loss distribution for each UoM. Each loss distribution is based upon and underlying frequency and severity distribution.

- Step 2: Combine the multiple loss distributions after considering the dependence between the different UoMs. The 'dependence' recognizes that the various UoMs are not completely independent, ie the loss distributions are not additive, and that there is a sortof diversification benefit in the sense that not all types of losses can occur at once and the joint probabilities of the different losses make the sum less than the sum of the parts.

Step 1 requires simulating a number, say n, of the number of losses that occur in a given year from a frequency distribution. Then n losses are picked from the severity distribution, and the total loss for the year is a summation of these losses. This becomes one data point. This process of simulating the number of losses andthen identifying that number of losses is carried out a large number of times to get the aggregate loss distribution for a UoM.

Step 2 requires taking the different loss distributions from Step 1 and combining them considering the dependence between the events. The correlations between the losses are described by a 'copula', and combined together mathematically to get a single loss distribution for the entire bank. This allows the 99.9th percentile loss to be calculated.

High frequency and low severity risks, for example the risks of fraud losses for a credit card issuer, may have high expected losses, but low unexpected losses. In other words, we can generally expect these losses to stay within a small expected and known range. The capital requirement will be the worst case losses at a given confidence level less expected losses, and in such cases this can be expected to below.

On the other hand, medium severity medium frequency risks, such as the risks of unexpected legal claims, 'fat-finger' trading errors, will have low expected losses but a high level of unexpected losses. Thus the capital requirement for suchrisks will be high.

It is also worthwhile mentioning high severity and low frequency risks - for example a rogue trader circumventing all controls and bringing the bank down, or a terrorist strike or natural disaster creating other losses - will probably have zero expected losses & high unexpected losses but only at very high levels of confidence. In other words, operational risk capital is unlikely to provide for such events and these would lie in the part of the tail that is not covered by most levels ofconfidence when calculating operational risk capital.

Note that risk capital is required for only unexpected losses as expected losses are to be borne by P&L reserves. Therefore the operational risk capital requirements for a low severity high frequency risk is likely to be low when compared to other risks that are lower frequency but higher severity.

Thus Choice 'c' is the correct answer.

Choice 'd' is the correct answer. Settlement risk, as the name suggests, arises upon settlement when one of the parties delivers its obligation under the transaction and the other does not. Consider a EUR/USD FX forward contract maturing in a month. At maturity, one of the parties will deliver EURs and the other USDs. If one party fails to deliver, then it constitutes a very large risk to the other party. This risk is much larger than pre-settlement risk, because the amount at risk is the entire notional and not just the replacement value. Of course, settlement risk exists for a very short period of time, no more than a number or hours or a day.

There is no such thing as 'replacement risk', and credit risk is a larger category of which settlement risks is one component. Settlement risk is the most appropriate answer.

Transition matrices are used for building distributions of the value of credit portfolios, and are the realized frequencies of migration from one credit rating to another over a period, generally one year. Therefore Choice 'd' is the correct answer.

Since they represent an actually observed set of values, they are not probabilities nor are they forward looking ex-ante estimates, though they are often used as proxies for probabilities. Choice 'a' and Choice 'c' are not correct. They include more than information on just defaults, therefore Choice 'b' is not correct.

Refer to the detailed loss event type classification under Basel II (see Annex 9 of the accord). You should know the exact names of all loss event types, and examples of each.

Choice 'c' is the correct answer. The Markov property is the assumption that there is no ratings momentum, and that transition probabilities are dependent only upon where the rating currently is and where it is going to. Where it has come from, or what the past changes in ratings have been, have no effect on the transition probabilities. ('Herstatt risk' refers to settlement risk, and is irrelevant.)

According to Basel II, in any given year, negative capital charges(resulting from negative gross income) in any business line may offset positive capital charges in other business lines without limit. Therefore Choice 'b' is the correct answer.

Statement I is correct. Data is often divided into two sets - a 'training set' that is used to create and fine-tune the model while the 'control set' is used to prove that the model works on sample data. Back testing is then perfomed using actual data that becomes available over time, or may already be available as historical data.

Statement II is incorrect. A risk manager often spends a great deal of time in managing data,and ensuring that the data being used is accurate enough for the purpose it is being used for. A risk manager can expect to spend a good part of his or her team's time in cleansing data. While he or she can try to get the IT processes and systems to produce correct data in the first place so it requires minimal subsequent cleansing or validation, this task is likely to remain a key part of a risk manager's role for quite some time in the future given the challenges nearly all organizations face in managingrisk data.

Statement III is correct. There was not enough granular data available on the underlying components of some of the derivative debt securities whose markets dried up during the crisis that began in 2007. This was because investors became increasingly unsure of what the value of these securities, such as CDOs was, leading to market seizure and firesale prices.

Statement IV is not correct. There is no easy solution to the lack of enough historical data, which is used to create as well as test models, and construct stress scenarios. Analytical approaches are not a good enough substitute for real market data. During the recent crisis, many instruments had rather short histories and there was not enough data available, and risk managers and portfolio managers relied upon analytical approaches to value and price them. Many of the assumptions that underpinned these approaches were untested in the real world and turned out to be incorrect.

Therefore Choice 'c' is the correct answer and the rest are incorrect.

All the factors listed above contributed to systemic failure. Liquidity risk was not on the radar of regulators, and was a second priority for risk managers, and most of the focus was oncapital adequacy as liquidity was thought to be an unlikely problem. Liquidity, regardless of capital adequacy, was the primary cause of failure of a number of institutions during the crisis.

Similarly, stress tests proved to be much milder than the shocks that were actually experienced, and the strategy of 'originate and distribute' implied that the mortgage and other debt originators had no interest in any due diligence as they intended to package and sell the debt to other investors.

Therefore Choice 'd' is the correct answer.

Conditional default probabilitiesare modeled as a logit function under CreditPortfolio view. That ensures the resulting probabilities are 'well behaved', ie take a value between 0 and 1. The probability may be expressed as = 1/ (1 + exp(I)), where I is a country specific index taking various macro economic factors into account.

Since the business units are perfectly correlated, we can get the combined EC as equal to the sum of the individual EC estimates.Therefore Choice 'a' is the correct answer.

The question is asking for the probability of default over a 6 month period when the probability of annual default is known. If we let the 6 month probability of defaut be 'd', then the probability of survival at the end of 1 year would be (1 - d)^2. This we know is equal to 1 - 3% = 0.97. Therefore we can calculate 'd' to be equal to 1.51%. Choice 'c' is the correct answer, the others are incorrect.

Note that an exam question may ask for probability of the security having survived after 6 months, in which case the answer might be 1 - 1.51%. Also note that such questions will always require you to use the probability of survival (1 - probability of default) for doing the calculations. That isbecause the probabilities of survival can be multiplied over periods of time, but not probabilities of default as the first default in any period is the 'game-over' event after which neither survival nor defaults mean anything. Therefore you generally always have to get the probability of survival till a point in time, and use that for any other calculations.

Probability of the joint default of both A and B =

We know all the numbers except default correlation, and we can solve for it.

DefaultCorrelation*SQRT(0.03*(1 - 0.03)*0.08*(1 - 0.08)) + 0.03*0.08 = 0.014.

Solving, we get default correlation = 25%

In a bankruptcy, equity ranks last. Preferred equity is one level above equity. Senior debt gets paid outfirst compared to junior debt, and secured debt is paid out first to the extent of the asset securing it (after which it counts as unsecured debt). Accounts payable and other short term liabilities are treated like unsecured creditors. Debtor-in-possession(DIP) financing ranks higher than any other asset as it is financing secured after the bankruptcy to continue the business.

Based on the above, statement I does not represent a correct ordering of seniority as equity is paid last. Similarly, DIP financingreceives higher priority than even secured debt, and therefore statement IV is incorrect. Therefore the only correct statements are II and III and Choice 'a' is the correct answer.

The probability that only one of thethree bonds will default is equal to the sum of the probabilities of the three scenarios where one bond defaults and the other two survive. This probability is given by 1%*(1 - 2%)*(1 - 3%) + (1 - 1%)*2%*(1 - 3%) + (1 - 1%)*(1 - 2%)*3% = 5.7818%. Choice 'c' is the correct answer.

Unexpected loss for a credit portfolio refers to the excess of the VaR estimate over the average expected loss. Theterm 'unexpected loss' has this specific meaning in the context of credit risk, and not any other intuitive meaning. So if for a portfolio worth $100m expected losses are 4%, and the credit VaR at 99% is $12m, then unexpected losses at that VaR quintile are $8m. This is unrelated to actual realized losses versus expected losses.

Therefore Choice 'd' is the correct answer and the others are not.

Unexpected loss is used to determine the capital reserves to be maintained against a credit portfolio at a certain level of confidence.

Some risk experts have suggested the use of extreme value theory to model tail risk or extreme events for operational risk. The generalized Pareto model or the Peaks-over-Threshold (POT) model are often used to model extreme value distributions, and therefore Choice 'a' is the correct answer.

Performance measurement at a very basic level involves comparing the return earned to the capital invested to earn that return. Risk adjusted performance measures (RAPMs) come in various varieties - and the key difference between RAPMs and traditional measures such as return on equity, return on assets etc is that RAPMs account for the risk undertaken. They may do so by either adjusting the return, or the capital, or both. They are classified as RAROCs (risk adjusted return on capital), RORACs (return on risk adjusted capital) and RARORACs (risk adjusted return on risk adjusted capital).

The capital adequacy ratio, also called the minimum capital requirement for credit risk per Basel II is 8% of riskweighted assets. The other choices are incorrect.

The credit worthiness of the retail customer is certainly a factor for thebank to consider as it will need to price the loan to cover the expectation of default. At the same time, it will need to look at other loans in its portfolio as to avoid unacceptable concentration risk. A corollary of the same theme is that the bank willneed to take a portfolio view of the loan request and consider its contribution to total portfolio risk. Therefore all the choices are appropriate considerations for the bank and Choice 'd' is the correct answer.