8010 Operational Risk Manager (ORM) Exam Questions and Answers

Model risk is the risk that a model built for estimating a variable will produce erroneous estimates. Model risk is caused by a number of factors, including:

a) Misspecifying the model: For example, using a normal distribution when it is not justified.

b) Model misuse: For example, using a model built to estimate bond prices to estimate equity prices

c) Parameter estimation errors: In particular, parameters that are subjectively determined can be subject to significant parameter estimation errors

d) Programming errors: Errors in coding the model as part of computer implementation may not be detected by end users

e) Data errors: Errors in data used for building the model may also introduce model risk

Therefore the correct answer is d, as all the choices are a source of model risk.

When the economy is expanding, firms are less likely to default. Therefore the conditional probability of default, given an economic expansion, is likely to be lower than the unconditional probability of default. Therefore Choice 'a' is the correct answerand the other statements are incorrect.

Unexpected loss for a credit portfolio refers to the excess of the VaR estimate over the average expected loss. Theterm 'unexpected loss' has this specific meaning in the context of credit risk, and not any other intuitive meaning. So if for a portfolio worth $100m expected losses are 4%, and the credit VaR at 99% is $12m, then unexpected losses at that VaR quintile are $8m. This is unrelated to actual realized losses versus expected losses.

Therefore Choice 'd' is the correct answer and the others are not.

Unexpected loss is used to determine the capital reserves to be maintained against a credit portfolio at a certain level of confidence.

If the current level of the S&P 500 is 2000, and a single day volatility is 1%, and the delta (ie change in portfolio value from a one point change) is $100, then the 1 day volatility for the portfolio in dollars is 2000 * 1% * $100 = $2,000.

At the 99% confidence level, the value of the inverse cumulative density function for the normal distribution is 2.33 (=NORMSINV(99%), in Excel). Therefore the 1 day VaR will be 2.33 * $2000 =$4,660. Extending it to 10 days using the square root of time rule, we get the 10 day VaR as equal to SQRT(10)*4660 = $14,736.

Since this method of calculating VaR relies upon a delta approximation of a risk factor (in this case the S&P500), it is the parametric approach to calculating VaR (the other methods being historical simulation, and Monte Carlo simulation).

The 2015 Handbook provides an excellent example of parametric (and other) VaR calculations in Chapter 3 of Volume III of Book 3. The spreadsheet used for the illustration can be downloaded from http://www.prmia.org/prm-exam/handbook-resources.

The probability that only none of the three bonds will default is equal to the probability of all surviving. Since default correlation is zero, we can simply multiply the probabilities of survival. Therefore the correct answer is 94% = (1 - 1%) * (1 - 2%) * (1 - 3%)

Historical Simulation VaR is conceptually very straightforward: actual prices as seen during the observation period (1 year, 2 years, or other) become the 'scenarios' forming the basis of the valuation of the portfolio. For each scenario, full revaluationis performed, and a P&L data set becomes available from which the desired loss quantile can be extracted.

Historical simulation is based upon actually seen prices over a selected historical period, therefore no distributional assumptions are required. Thedata is what the data is, and is the distribution. Statement I is therefore not correct.

It uses full revaluation for each historical scenario, therefore statement II is correct.

Since the prices are taken from actual historical observations, a correlationmatrix is not required at all. Statement III is therefore incorrect (it would be true for Monte Carlo and parametric Var).

Historical simulation VaR suffers from the limitation that if enough representative data points are no available during the historical observation period from which the scenarios are drawn, the results would be inaccurate. This is likely to be the case for new products. Therefore Statement IV is incorrect.

The cumulative probability of default for the security for the 5 years is [1 - (1 - probability of default upto year 4)*(1 - probability of default in year 5)]. An easier way to think about this is that the Probability of survival till year 5 = (Probability of survival till year 4 * Probability of survival during year 5). Using the relationship that probability of default = 1 - probability of survival, we can calculate the required probability in all cases.

In this case, the cumulative probability of default for the security for 5 years = 1 - (1 - 11.47%)*(1 - 5%) = 15.8695%, therefore Choice 'c' is the correct answer.

Economic capital is sub-additive, ie, because of the correlation being less than perfect between the risks of thedifferent business units, the total economic capital for the firm will be less than the sum of the EC for the individual business units. Therefore Choice 'b' is the correct answer.

In practice, correlations are difficult to estimate reliably, and banks often use estimates and corroborate their capital calculations with reference to a number of data points.

p = k/N. If there are N observations of which K are upto T, then p = k/N allows us to have a continuous unbroken curve which gets increasingly weighted towards the distribution selected for the tail as we move towards the 'right', ie the higher values of losses.

The other choices are incorrect and mostly nonsensical.

Refer to the detailed loss event type classification under Basel II (see Annex 9 of the accord). You should know the exact names of all loss event types, and examples of each.

This is a tricky question in the sense norisk management professional can be expected to know the answer to this one unless they have read Chapter 2 of the PRMIA handbook. So this question appears purely for the sake of something you would need to know purely for the sake of the exam.

PRMIA's handbook classifies governance sructures as reactive, preventative and active. Reactive structures involve monitoring signals after the event leading to corrective actions. Preventative structures are forward looking and anticipate issues before they arise. Active structures include considerations of operational efficiency and not just governance. All other answers are made up phrases and are incorrect.

In reality, corporations employ all structures together without worrying about the boundary between the three, and these distinctions do not exist except in textbooks.

Altman's Z-score, the Probit and the Logit models can all be used to assess the credit rating of an individual borrower. There is no such model as the 'distance todefault model', and therefore Choice 'a' is the correct answer.

This situation represents one of the paradoxes in estimating severity that one needs to be aware of - the improvement in controls reduces the weight of the body/middle of the distribution and moves it towards the tails (as the total probability under the curve must stay at 100%) and the distribution becomes more heavy tailed. As a result, the 99.9th percentile loss actually increases. instead of decreasing, creating a counterintuitive result. Therefore the correct answer is that the capital required will increase.

If scenario analysis produces such a result, the analyst must question if the 1 in 100 year loss severity is still accurate. If the new control has reduced the severity in the body of the distribution, the question as to why the more extreme losses have not changed should be raised.

Choice 'd' represents a risk that does not arise from its holdings of mortgages. Therefore Choice 'd' is the correct answer.

All the other risks identified are correct - the bank faces interest rate, default and prepayment risks on its mortgages.

All of the properties described are the properties of a 'coherent' risk measure.

Monotonicity means that if a portfolio's future value is expected to be greater than that of another portfolio, its risk should be lower than thatof the other portfolio. For example, if the expected return of an asset (or portfolio) is greater than that of another, the first asset must have a lower risk than the other. Another example: between two options if the first has a strike price lower thanthe second, then the first option will always have a lower risk if all other parameters are the same. VaR satisfies this property.

Homogeneity is easiest explained by an example: if you double the size of a portfolio, the risk doubles. The linear scaling property of a risk measure is called homogeneity. VaR satisfies this property.

Translation invariance means adding riskless assets to a portfolio reduces total risk. So if cash (which has zero standard deviation and zero correlation with other assets) is added to a portfolio, the risk goes down. A risk measure should satisfy this property, and VaR does.

Sub-additivity means that the total risk for a portfolio should be less than the sum of its parts. This is a property that VaR satisfies most of thetime, but not always. As an example, VaR may not be sub-additive for portfolios that have assets with discontinuous payoffs close to the VaR cutoff quantile.

For a number of processes, including many in finance, while a distribution such as the normal distribution is a good approximation of the distribution near the modal value of the variable, thesame normal distribution may not be a good estimate of the tails. For this reason, the Pareto distribution is one of the distributions that is often used to model the tails of another distribution. Generally, if you have a set of observations, and you discard all observations below a threshold, you are left with what are called 'exceedances'. The threshold needs to be reasonably far out in the tail. If from each value of the exceedances you subtract the threshold value, the resulting dataset is estimated bythe generalized Pareto distribution.

The Pareto distribution has a 'shape parameter'. The average of two Pareto distributions with tail parameters ξ1 and ξ2 (ξ is a Greek character, pronounced as 'sai' (saa-eee)), is the weighted average of ξ1 and ξ2 with weights proportional to the number of observations in the datasets underlying the distributions.

The correct answer is Choice 'c'. The following is a brief description of the major approaches available to model credit risk, and the analysis that underlies them:

1. CreditMetrics: based on the credit migration framework. Considers the probability of migration to other credit ratings and the impact of such migrations on portfolio value.

2. CreditPortfolio View: similar to CreditMetrics, but adds the impact of the business cycle to the evaluation.

3. The contingent claims approach: uses option theory by considering a debt as a put option on the assets of the firm.

4. KMV's EDF (expected default frequency) based approach: relies on EDFs and distance to default as a measure of credit risk.

5. CreditRisk+: Also called the 'actuarial approach', considers default as a binary event that either happens or does not happen. This approach does not consider the loss of value from deterioration in credit quality (unless the deterioration implies default).

Creditreserves are created in respect of expected losses, which are considered the cost of doing business. Unexpected losses are borne by economic credit capital, which is a part of economic capital. This question is a bit nuanced - and 'economic capital' wouldgenerally be a good answer as well. However, taking a rather beady eyed view of the terminology and distinguishing between 'economic credit capital' which is a subset of 'economic capital', we can say that 'economic credit capital' is a more appropriateChoice 'a's the question relates to credit losses.

Operational risk capital estimated using the implied capital model is merely the capital that is not attributable to market or credit risk. Therefore Choice 'b' is the correct answer. All other responses are incorrect.

A default hazard rate is the rate of default in a continuous time setting. This question is asking for probability of survival at the end of 5 years. The formula to calculate the probability of survival at the end of t years where the default hazard rate is λ is e^(-λ *t) (or in Excel,=exp(-λ*t). Therefore the correct answer is Choice 'd'.

(It may be tempting to infer that if the probability of survival at the end of 1 year is 90% (1 - 10%), then the probability of survival in 5 years would be 90%^5. However this reasoning is not correct for the reason that the given rate is not the discrete rate of default, but the hazard rate which is nothing but the continuously compounded rate of default.)

Pre-settlement risk is the risk that one of the counterparties defaults prior to the date for the maturity of the transaction in question. This may be an unrelated default, in fact there may have been no default on that particular contract, but the party may have defaulted on its other obligations, or filed for bankruptcy. To deal with such cases and to protect the interests of both the parties, it is common toprovide for immediate termination of positions and settlement based on the current replacement value of the contracts. Therefore statements I and II are correct.

Statement III is correct as well - the exposure from an OTC derivative contract derives fromits current replacement value, and not the notional. If the current replacement value is negative, then the credit exposure is considered equal to zero.

Statement IV is correct as it is quite common to restate all exposures - those from credit lines, OTC derivatives etc - in loan equivalent terms prior to estimating credit risk.

A break close, also called a 'mutual put', gives either party the right to terminate a transaction at market price at a given date, or dates in the future. These are usually availed of in longer dated transactions, eg 10 years and over. For example, a 15-year swap might have a mutual put in year 5, and every 2 years thereafter.

All other choices are incorrect.

Rating agencies target both accuracy and stability when they assign ratings. These two objectives can sometimes conflict, so a balance needs to be struck between the two. Rating agencies do not target anyparticular 'accuracy ratio' or rankings. Therefore Choice 'c' is the correct answer.

There are multiple ways to incorporate scenario analysis for modeling operational risk capital - and the exact approach used depends upon thequantity of loss data available, and the quality of scenario assessments. Generally:

- If there is no past loss data available, scenarios are the only practical means to model operational risk loss distributions. Both frequency and severity estimates can be modeled based on scenario data.

- If there is plenty of past data available, scenarios can be used as a modifier for estimates that are based solely on data (for example, consider the MAX of the loss estimates at the desired quantile as provided bythe data, and as indicated by scenarios)

- If high quality scenario data is available, and there is sufficient past data, one could mix scenario assessments with the loss data and fit the combined data set to create the loss distribution. Alternatively, both could be fitted with severity estimates and then the two severities could be parametrically combined.

In short, there is considerable flexibility in how scenarios can be used.

Statement I is therefore correct, and so is statement II as both indicate valid uses of scenarios.

Statement III is not correct because it may be okay to create severity estimates based on scenario data alone.

Statement IV is not correct because while using scenarios as modifiers to other means of estimation is acceptable, that isnot the only use of scenarios.

All the reasons and risks presented above are valid reasons for using scenario analysis, except V and VI - ie, the need to reduce the complexity of calculations is not a valid reason for using scenario analysis. Similarly, making operational risk capital estimates match management's desired capital allocation targets is also not a valid reason. Capital calculations are intended to provide adequate capital for managing the risk from operations, regardless of what management may desire them to be.

Economic capitalis often calculated with a view to maintaining the credit ratings for a firm. It is the capital available to absorb unexpected losses, and credit ratings are also based upon a certain probability of default. Economic capital is often calculated at a levelequal to the confidence required for the desired credit rating. For example, if the probability of default for a AA rating is 0.02%, and the firm desires to hold an AA rating, then economic capital maintained at a confidence level of 99.98% would allow for such a rating. In this case, economic capital set at a 99.8% level can be thought of as the level of losses that would not be exceeded with a 99.8% probability, and would help get the firm its desired credit rating.

Choice 'c' is the correct answer. Economic capital does not target minimizing the cost of capital, nor is it a provision for losses arising from market risk. The concept of economic capital is unrelated to where an institution or firm is based, therefore Choice 'a' is incorrect as well.

Since the business units are perfectly correlated, we can get the combined EC as equal to the sum of the individual EC estimates.Therefore Choice 'a' is the correct answer.

The bank paid $7m for the bonds,and expected recovery is $3m (30% x $10m face). Therefore Bank B's loss is $4m ($7m - $3m). Choice 'b' is the correct answer. All other answers are incorrect.

When a default occurs, the proportion of the exposure represented by therecovery rate is recovered. For example, if the recovery rate is 40% for a loan, the actual loss in the event of a default would be $60 for a $100 loan. In other words, the loss given default = 1 - recovery rate. Hence Choice 'd' is the correct answer. Allother choices are incorrect.

The commercial paper has greater credit risk as the entire notional is outstanding. On the forward contract, only the replacement value of the contract, which normally would be a mere fraction of the notional, would be at risk.

Therefore Choice 'd' is the correct answer.

The probability that only one of thethree bonds will default is equal to the sum of the probabilities of the three scenarios where one bond defaults and the other two survive. This probability is given by 1%*(1 - 2%)*(1 - 3%) + (1 - 1%)*2%*(1 - 3%) + (1 - 1%)*(1 - 2%)*3% = 5.7818%. Choice 'c' is the correct answer.

Probability of the joint default of both A and B =

We know all the numbers except default correlation, and we can solve for it.

DefaultCorrelation*SQRT(0.03*(1 - 0.03)*0.08*(1 - 0.08)) + 0.03*0.08 = 0.014.

Solving, we get default correlation = 25%

Operational risk as defined in Basel II specifically excludes strategic and reputational risk. Therefore Choice 'd' is the correct answer.

Note that Basel II defines operational risk as follows:

Operational risk is defined as the risk of lossresulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk, but excludes strategic and reputational risk.