FINRA Series 16 – Quiz 24

The number of factors to include in a factor model should be as small as possible, yet still capture the priced sources of nondiversifiable (or systematic) risk. The simplest version of the model consists of just one macro factor: the single-factor model.

According to the Law of One Price, identical assets selling in different locations should
be priced identically in the different locations. For example, assume the common stock of GH Inc. is listed on both the NYSE and NASDAQ.

According to the Law of One Price, there should be no difference in the stock prices of GH’s transactions on the NYSE versus NASDAQ. If there were different prices available, an arbitrage opportunity would exist.

The mean-variance efficient market portfolio is essential to the capital asset pricing model, but is not required in multifactor models.

According to the Basel Committee on Banking Supervision, risk data aggregation means “defining, gathering and processing risk data according to the bank’s risk reporting requirements to enable the bank to measure its performance against its risk tolerance/ appetite.”

During the global financial crisis that began in 2007, many banks were unable to quickly and accurately identify concentrations of risk across business lines and at the bank group level due, in part, to an inability to aggregate risk exposures and report bank-wide risks effectively.

As part of the Basel Committee’s push for greater corporate governance, the committee issued supplemental Pillar 2 guidance regarding capital models and other key risk management models (e.g., value at risk) to improve banks’ capabilities regarding the recognition and management of bank-wide risks.

According to the committee, “a bank should design, build and maintain data architecture and IT infrastructure which fully supports its risk data aggregation capabilities and risk reporting practices not only in normal times but also during times o f stress or crisis, while still meeting the other Principles.”
Principle 2, as referenced in Principle 1, implores the bank to devote financial and human resources to risk data aggregation and reporting, both when the bank is financially sound and when the bank is struggling due to financial stresses. Principle 2 requires that:
• Risk data aggregation and reporting practices should be a part o f the bank’s planning processes and subject to business impact analysis.
• Banks establish integrated data classifications and architecture across the banking group. Multiple data models may be used as long as there are robust automated reconciliation measures in place. Data architecture should include information on data characteristics (metadata) and naming conventions for legal entities, counterparties, customers, and account data.
• Accountability, roles, responsibilities, and ownership should be defined relative to the data. Adequate controls should be in place throughout the lifecycle o f the data for all aspects of the technology infrastructure. Risk managers, business managers, and/or IT functions are responsible for data, ensuring that it is entered correctly, is relevant and current, is aligned with data taxonomies, and is consistent with bank policies.

Banks establish integrated data classifications and architecture across the banking group. Multiple data models may be used as long as there are robust automated reconciliation measures in place. Data architecture should include information on data characteristics (metadata) and naming conventions for legal entities, counterparties, customers, and account data.

According to the committee, “a bank should be able to generate accurate and reliable risk data to meet normal and stress/crisis reporting accuracy requirements. Data should be aggregated on a largely automated basis so as to minimize the probability of errors.”

Principle 3 requires that:
• Data aggregation and reporting should be accurate and reliable.
• Controls applied to risk data should be as robust as those surrounding accounting data.
• To ensure the quality of the data, effective controls should be in place when the bank
relies on manual processes and desktop applications such as spreadsheets and databases.
• Data should be reconciled with other bank data, including accounting data, to ensure its
accuracy.
• A bank should endeavor to have a single authoritative source for risk data for each
specific type of risk.
• Risk personnel should have access to risk data to effectively aggregate, validate, reconcile,
and report the data in risk reports.
• Data should be defined consistently across the bank. The bank may maintain a
dictionary of risk data concepts and terms.
• While data should be aggregated on a largely automated basis to reduce the risk of errors,
human intervention is appropriate when professional judgments are required. There
should be balance between manual and automated risk management systems.
• Bank supervisors expect banks to document manual and automated risk data aggregation
systems and explain when there are manual workarounds, why the workarounds are critical to data accuracy, and propose actions to minimize the impact o f manual workarounds.
• Banks monitor the accuracy of risk data and establish plans to correct poor data quality.

According to the committee, “a bank should be able to capture and aggregate all material risk data across the banking group. Data should be available by business line, legal entity, asset type, industry, region and other groupings, as relevant for the risk in question, that permit identifying and reporting risk exposures, concentrations and emerging risks.”
Principle 4 requires that:
• Both on- and off-balance sheet risks should be aggregated.
• Risk measures and aggregation methods should be clear and specific enough that senior
managers and the board of directors can properly assess risk exposures. However, not all
risks need to be expressed in the same metric.
• Bank risk data should be complete. If risk data is not complete, the bank should identify
and explain areas of incompleteness to bank supervisors.

Systems should be in place to produce aggregated risk data quickly in stress/crisis situations for all critical risks. Critical risks include, but are not limited to:
– Aggregated credit exposures to large corporate borrowers.
– Counterparty credit risk exposures, including derivatives.
– Trading exposures, positions, and operating limits.
– Market concentrations by region and sector.
– Liquidity risk indicators.
– Time-critical operational risk indicators.

According to the committee, “a bank should be able to generate aggregate and up-to-date risk data in a timely manner while also meeting the principles relating to accuracy and integrity, completeness and adaptability. The precise timing will depend upon the nature and potential volatility of the risk being measured as well as its criticality to the overall risk profile of the bank. The precise timing will also depend on the bank specific frequency requirements for risk management reporting, under both normal and stress/crisis situations, set based on the characteristics and overall risk profile of the bank.”
– Risk data aggregation should be timely and should meet all requirements for risk management reporting. Bank supervisors will review the timeliness and specific frequency requirements of bank risk data in normal and stress/crisis periods.
– Systems should be in place to produce aggregated risk data quickly in stress/crisis situations for all critical risks.

Clearly, misleading reporting was used by Drysdale in order to obtain the borrowed funds. However, Chase Manhattan was partially to blame for assuming that it was simply the middleman in the transactions and the positions taken had a low level of risk. The inexperienced managers at Chase failed to realize that the contract wording with Drysdale indicated that Chase would be held responsible for any payments due.

Data aggregation capabilities should be adaptable and flexible. Adaptable data makes it easier for managers and the board of directors to conduct stress tests and scenario analysis. Data should be available for ad hoc data requests to assess emerging risks. Adaptability includes:
– Aggregation processes should be flexible and should allow bank managers to assess risks quickly for decision-making purposes.
– Data should be customizable (e.g., anomalies, dashboards, and key takeaways) and should allow the user to investigate specific risks in greater detail.
– It should be possible to include new aspects of the business or outside factors that influence overall bank risk in the risk data aggregation process.
– Regulatory changes should be incorporated in risk data aggregation.

To ensure the accuracy of risk reports the bank should:
– Define the processes used to create risk reports.
– Create reasonableness checks o f the data.
– Include descriptions of mathematical and logical relationships in the data that
should be verified.
– Create error reports that identify, report, and explain weaknesses or errors in the
data.

According to the committee, “risk management reports should accurately and precisely convey aggregated risk data and reflect risk in an exact manner. Reports should be reconciled and validated. ”

Principle 7 requires that:
• Risk reports should be accurate and precise. Senior managers and board members should be able to use the reports to make critical decisions about bank risks.
• The bank should ensure the reliability, accuracy, and timeliness of risk approximations
(e.g., scenario analysis, sensitivity analysis, stress testing, and other risk modeling
approaches).
• The board of directors and senior managers should establish precision and accuracy
requirements for regular and stress/crisis risk reports. The reports should include information on positions and exposures in the market. The criticality of decisions made using the data should be clearly stated.
• Bank supervisors expect banks to impose accuracy requirements on risk data (both regular and stress/crisis) commensurate with and analogous to accounting materiality. For example, if an omission influences risk decision-making, then it is deemed material.

According to the committee “risk management reports should cover all material risk areas within the organization. The depth and scope of these reports should be consistent with the size and complexity of the bank’s operations and risk profile, as well as the requirements of the recipients.”

Principle 8 requires that:
• Reports should contain position and risk exposure information for all relevant risks, such as credit risk, liquidity risk, market risk, and operational risk. The report should also include detailed information for specific risks. For example, credit risk reports should include information on the country, region, sector, industry, and/or single name exposures. Risk related measures such as the bank’s regulatory capital should also be included in risk reports.
• Risk reports should be forward-looking and should include forecasts and stress tests. The bank’s risk appetite/tolerance should be discussed in the context of emerging risks. Recommendations for reducing risk should be included where appropriate. Senior managers and the board of the directors should gain a sense of the bank’s future capital and risk profiles from reports.
• Bank supervisors should be satisfied that the bank’s risk reporting is sufficient in terms of coverage, analysis, and comparability across institutions.

Bank supervisors should be satisfied that the bank’s risk reporting is sufficient in terms of coverage, analysis, and comparability across institutions. A risk report should include, but not be limited to, information regarding:
– Credit risk.
– Market risk.
– Liquidity risk.
– Operational risk.
– Results o f stress tests.
– Capital adequacy.
– Regulatory capital.
– Liquidity projections.
– Capital projections.
– Risk concentrations.
– Funding plans.

According to the committee “risk management reports should communicate information in a clear and concise manner. Reports should be easy to understand yet comprehensive enough to facilitate informed decision-making. Reports should include meaningful information tailored to the needs of the recipients.”

Principle 9 requires that:
– Reports be tailored to the end user (e.g., the board, senior managers, and risk committee members) and should assist them with sound risk management and decision-making.
– The board of directors should ensure the bank is operating within its risk tolerance/ appetite, and should therefore make sure that it is asking for and receiving relevant risk information to make the determination. The board should tell senior management if the amount/type of data it is receiving is insufficient or redundant. The mix of quantitative data versus qualitative data is important. Senior management should also ensure that it is getting the right mix o f information to foster good risk decisions.
– Risk data should be classified, and the bank should develop an inventory of terms used in risk reports.
– Bank supervisors will confirm periodically that the risk data is clear, relevant, and useful for decision-making.

Different members of the organization have different needs in terms of reporting. For example, information relevant to the risk committee may not be specifically relevant to the board of directors. Aggregation increases as the report moves up the organizational hierarchy (i.e., to senior managers and to the board). There is a greater need for qualitative interpretation and explanation as aggregation increases.

Reports will include:
– Risk data.
– Risk analysis.
– Interpretation of risks.
– Qualitative explanations of risks.

One misuse of VaR is choosing a time period (e.g., daily or weekly) that does not correspond to the liquidity of the assets in the portfolio. Using daily VaR on a portfolio where the assets cannot be effectively traded within a day is clearly not appropriate. Taking a longer term horizon to account for liquidity of the assets may not be sufficient either. VaR assumes the distributions of losses are not correlated over time, so Statement I is incorrect. A crisis can change the nature of a return distribution for a given period as well as across periods.

Record level consistency is consistency between one set of data values and another set within the same record. Temporal level consistency is consistency between one set of data values and another set within the same record at different points in time.

Professional Integrity and Ethical Conduct

GARP Members:

1.1. shall act professionally, ethically and with integrity in all dealings with employers, existing or potential clients, the public, and other practitioners in the financial services industry.
1.2. shall exercise reasonable judgment in the provision of risk services while maintaining independence of thought and direction. GARP Members must not offer, solicit, or accept any gift, benefit, compensation, or consideration that could be reasonably expected to compromise their own or another’s independence and objectivity.
1.3. must take reasonable precautions to ensure that the Member’s services are not used for improper, fraudulent or illegal purposes.
1.4. shall not knowingly misrepresent details relating to analysis, recommendations, actions, or other professional activities.
1.5. shall not engage in any professional conduct involving dishonesty or deception or engage in any act that reflects negatively on their integrity, character, trustworthiness, or professional ability or on the risk management profession.
1.6. shall not engage in any conduct or commit any act that compromises the integrity of GARP, the FRM® designation, or the integrity or validity of the examinations leading to the award of the right to use the FRM designation or any other credentials that may be offered by GARP.
1.7. shall be mindful of cultural differences regarding ethical behavior and customs, and avoid any actions that are, or may have the appearance of being unethical according to local customs. If there appears to be a conflict or overlap of standards, the GARP Member should always seek to apply the highest standard.

Shall not engage in any professional conduct involving dishonesty or deception or engage in any act that reflects negatively on their integrity, character, trustworthiness, or professional ability or on the risk management profession.

Conflict of Interest

GARP Members shall:
2.1. act fairly in all situations and must fully disclose any actual or potential conflict to all affected parties.
2.2. make full and fair disclosure of all matters that could reasonably be expected to impair independence and objectivity or interfere with respective duties to their employer, clients, and prospective clients.

Confidentiality
GARP Members:
3.1. shall not make use of confidential information for inappropriate purposes and unless having received prior consent shall maintain the confidentiality of their work, their employer or client.
3.2. must not use confidential information for personal benefit.

Fundamental Responsibilities
GARP Members shall:
4.1. comply with all applicable laws, rules, and regulations (including this Code) governing the GARP Members’ professional activities and shall not knowingly participate or assist in any violation o f such laws, rules, or regulations.
4.2. have ethical responsibilities and cannot outsource or delegate those responsibilities to others.
4.3. understand the needs and complexity of their employer or client, and should provide appropriate and suitable risk management services and advice.
4.4. be diligent about not overstating the accuracy or certainty of results or conclusions.
4.5. clearly disclose the relevant limits of their specific knowledge and expertise concerning risk assessment, industry practices, and applicable laws and regulations.

clearly disclose the relevant limits of their specific knowledge and expertise concerning risk assessment, industry practices, and applicable laws and regulations.

Best Practices

GARP Members shall:
5.1. execute all services with diligence and perform all work in a manner that is independent from interested parties. GARP Members should collect, analyze and distribute risk information with the highest level of professional objectivity.
5.2. be familiar with current generally accepted risk management practices and shall clearly indicate any departure from their use.
5.3. ensure that communications include factual data and do not contain false information.
5.4. make a distinction between fact and opinion in the presentation of analysis and recommendations.