What are the steps in the risk management process cycle, and how do they connect?

Question

AcadiFi · Accepted Answer

The risk management process is a continuous cycle — not a one-time exercise — and understanding this cyclical nature is critical for FRM Part I. The process has five interconnected stages that feed back into each other.

```mermaid
graph TD
  A[1. Risk Identification] --> B[2. Risk Assessment & Measurement]
  B --> C[3. Risk Mitigation & Control]
  C --> D[4. Risk Monitoring & Reporting]
  D --> E[5. Risk Governance & Review]
  E -->|Feedback Loop| A
  A -->|New risks emerge| D
  C -->|Residual risk feeds back| B
  style A fill:#c9a84c,color:#0a0a0f
  style B fill:#1e3a5f,color:#fff
  style C fill:#1a3c2a,color:#fff
  style D fill:#2d1b4e,color:#fff
  style E fill:#8b2020,color:#fff
```

**Stage 1 — Risk Identification**
Catalog all material risks the organization faces. At Ridgeline Financial Group, this includes:
- **Market risk:** $3.2 billion trading book exposed to interest rate and equity movements
- **Credit risk:** $18 billion loan portfolio with concentration in commercial real estate
- **Operational risk:** 12 legacy IT systems processing 400,000 transactions daily
- **Liquidity risk:** $2.1 billion in short-term wholesale funding that must be rolled over quarterly

Tools: risk taxonomy workshops, scenario brainstorming, loss event databases, regulatory gap analysis.

**Stage 2 — Risk Assessment & Measurement**
Quantify each identified risk using appropriate metrics:
- Market risk: 99% 10-day VaR = $47 million
- Credit risk: Expected loss = PD x LGD x EAD = 1.8% x 42% x $18B = **$136 million**
- Operational risk: Annual loss expectation based on internal loss data = $23 million
- Liquidity risk: Liquidity Coverage Ratio (LCR) = 118% (above the 100% minimum)

**Stage 3 — Risk Mitigation & Control**
Implement strategies to bring risks within appetite:
- Hedging: Purchase $500 million in interest rate swaps to reduce duration risk
- Diversification: Cap single-name credit exposure at 3% of Tier 1 capital
- Transfer: Buy $200 million cyber insurance policy
- Limits: Set daily trading loss limit at $5 million per desk
- Avoidance: Exit subprime auto lending after stress test shows 3x expected losses

**Stage 4 — Risk Monitoring & Reporting**
Track risk metrics continuously and report to stakeholders:
- Daily: VaR utilization, P&L attribution, limit breaches
- Weekly: Credit watch list, counterparty exposure report
- Monthly: Board risk dashboard, regulatory ratio compliance (CET1, LCR, NSFR)
- Quarterly: Comprehensive stress testing results

**Stage 5 — Risk Governance & Review**
The board risk committee and senior management review the entire framework:
- Are risk appetite statements still appropriate given market conditions?
- Did any risk events reveal gaps in identification or measurement?
- Are mitigation strategies performing as expected?
- Do models need recalibration based on recent data?

**The Feedback Loop:**
Governance review feeds back to identification. For example, after a $14 million operational loss from a vendor system failure, Ridgeline's review reveals that third-party IT risk was under-identified. This triggers a new risk category in Stage 1, updated measurement models in Stage 2, new vendor due diligence controls in Stage 3, and enhanced vendor monitoring dashboards in Stage 4.

**Exam Tip:** The FRM exam tests whether you understand that risk management is iterative. A question might describe a bank that suffered an unexpected loss and ask which stage of the process failed. If the loss came from an unidentified risk source, Stage 1 failed. If it was identified but underestimated, Stage 2 failed.

For a comprehensive review of risk management frameworks, explore our FRM Part I Foundations course on AcadiFi.

What are the steps in the risk management process cycle, and how do they connect?

Master Part I with our FRM Course

Related Questions

Related Articles

Practice Questions