Fundamental Concepts of 4.
Credit risk
Risk Management and Internal Control System
Risk defined
- Risk is the possibility of something bad happening
- Risk involves uncertainty about the
effects/implications of an activity with respect to
something that humans value, often focusing on
negative, undesirable consequences
- Risk implies future uncertainty about deviation from
expected earnings or expected outcome. Risk
measures the uncertainty that an investor is willing
to take to realize a gain from an investment
9 Types of Investment Risk
1. Market risk
- The risk of investments declining in value
because of economic developments or other
events that affect the entire market. The main types
of market risk are equity risk, interest rate risk and
currency risk
• Equity risk – applies to an investment in shares.
➢ The market price of shares varies all the time
depending on demand and supply. Equity risk
is the risk of loss because of a drop in the market
price of shares.
• Interest rate risk – applies to debt investments
such as bonds
➢ It is the risk of losing money because of a
change in the interest rate. For example, if the
interest rate goes up, the market value of bonds
will drop
• Currency risk – applies when you own foreign
investments
➢ It is the risk of losing money because of a
movement in the exchange rate
2. Liquidity risk
- The risk of being unable to sell your investment at a
fair price and get your money out when you want to.
To sell the investment, you may need to accept a
lower price. In some cases, such as exempt
market investments, it may not be possible to sell
the investment at all.
3. Concentration risk
- The risk of loss because your money is
concentrated in 1 investment or type of investment.
When you diversify your investments, you spread
the risk over different types of investments,
industries and geographic locations
- The risk that the government entity or company that
issued the bond will run into financial difficulties and
won’t be able to pay the interest or repay the
principal at maturity. Credit risk applies to debt
investments such as bonds. You can evaluate credit
risk by looking at the credit rating of the bond. For
example, long-term Canadian government bonds
have a credit rating of AAA, which indicates the
lowest possible credit risk
5. Reinvestment risk
- The risk of loss from reinvesting principal or income
at a lower interest rate. Suppose you buy a bond
paying 5%. Reinvestment risk will affect you if
interest rates drop and you have to reinvest the
regular interest payments at 4%. Reinvestment
risk will also apply if the bond matures and you
have to reinvest the principal at less than 5%.
Reinvestment risk will not apply if you intend to
spend the regular interest payments or the principal
at maturity
6. Inflation risk
- The risk of a loss in your purchasing power because
the value of your investments does not keep up with
inflation. Inflation erodes the purchasing power
of money over time – the same amount of
money will buy fewer goods and services. Inflation
risk is particularly relevant if you own cash or debt
investments like bonds. Shares offer some
protection against inflation because most companies
can increase the prices they charge to their
customers. Share prices should therefore rise in
line with inflation. Real estate also offers some
protection because landlords can increase rents
over time
7. Horizon risk
- The risk that your investment horizon may be
shortened because of an unforeseen event, for
example, the loss of your job. This may force you to
sell investments that you were expecting to hold for
the long term. If you must sell at a time when the
markets are down, you may lose money
8. Longevity risk
- The risk of outliving your savings. This risk is
particularly relevant for people who are retired, or
are nearing retirement
9. Foreign investment risk
- The risk of loss when investing in foreign countries.
When you buy foreign investments, for example, the
shares of companies in emerging markets, you face
 risks that do not exist in Canada, for example, the
risk of nationalization
The 5 Components
- There are at least five crucial components that must
- be considered when creating a risk management
- framework. They include:
1. Risk identification
2. Risk measurement and assessment
3. Risk mitigation
4. Risk reporting and monitoring
5. Risk governance
Risk Identification
- The first step in identifying the risks a company
faces is to define the risk universe. The risk
universe is simply a list of all possible risks.
Examples include IT risk, operational risk,
regulatory risk, legal risk, political risk, strategic
risk, and credit risk
- After listing all possible risks, the company can then
select the risks to which it is exposed and
categorize them into core and non-core risks
• Core risks are those that the company must
take in order to drive performance and long-term
growth.
• Non-core risks are often not essential and can
be minimized or eliminated completely
Risk Measurement
- Risk measurement provides information on the
quantum of either a specific risk exposure or an
aggregate risk exposure, and the probability of
a loss occurring due to those exposures. When
measuring specific risk exposure it is important
to consider the effect of that risk on the overall
risk profile of the organization
- Some risks may provide diversification benefits
while others may not. Another important
consideration is the ability to measure an
exposure. Some risks may be easier to measure
than others. For example, market risk can be
measured using observed market prices, but
measuring operational risk is considered both an
art and a science
Risk Mitigation
- Having categorized and measured its risks, a
company can then decide on which risks to
eliminate or minimize, and how much of its core
risks to retain
- Risk mitigation can be achieved through an outright
sale of assets or liabilities, buying insurance,
hedging with derivatives, or diversification
Risk Reporting and Monitoring
- It is important to report regularly on specific and
aggregate risk measures in order to ensure that risk
levels remain at an optimal level
• Financial institutions that trade daily will produce
daily risk reports.
• Other institutions may require less frequent
reporting.
- Risk reports must be sent to risk personnel
who have that authority to adjust (or instruct others
to adjust) risk exposures
Risk Governance
- Risk governance is the process that ensures all
company employees perform their duties in
accordance with the risk management framework.
- Risk governance involves defining the roles of
all employees, segregating duties and assigning
authority to individuals, committees and the board
for approval of core risks, risk limits, exceptions to
limits and risk reports, and also for general
oversight
Definition of terms
Risk
- The possibility of an event occurring that will have
an impact on the achievement of objectives. Risk is
measured in terms of impact and likelihood
- If realized, would affect the company
- Occurring over a predefined time period
- Factors that define impact rating
• Financial effect
• Reputation
• Ability to achieve key objectives
- Residual Risk – after a risk response
- Opportunity – event will occur and positively affect
the achievement of objectives
- Risk Appetite – amount of risk is willing to accept in
pursuit of value
- Risk Tolerance – specific maximum risk that an
organization is willing to take regarding each
relevant risk
- Risk Management – A process to identify, assess,
manage, and control potential events or situations to
provide reasonable assurance regarding the
achievement of the organization's objectives
COSO ER
- The Committee of Sponsoring Organizations of the
Treadway Commission (COSO) ERM framework is
one of two widely accepted risk management
standards organizations use to help manage risks in
an increasingly turbulent, unpredictable business
landscape

COSO ERM – Integrated Framework

- Enterprise Risk Management (ERM) - Integrated
Framework
- Published by the Committee of Sponsoring
Organizations of the Treadway Commission
(COSO)
- Defines essential components, suggests a common
language, and provides clear direction and guidance
for enterprise risk management