Financial risk management

Financial risk management is the practice of protecting economic value in a firm by managing exposure to financial risk - principally credit risk and market risk, with more specific variants as listed aside - as well as some aspects of operational risk. As for risk management more generally, financial risk management requires identifying the sources of risk, measuring these, and crafting plans to mitigate them. See for an overview.
Financial risk management as a "science" can be said to have been born with modern portfolio theory, particularly as initiated by Professor Harry Markowitz in 1952 with his article, "Portfolio Selection"; see.
The discipline can be qualitative and quantitative; as a specialization of risk management, however, financial risk management focuses more on when and how to hedge, often using financial instruments to manage costly exposures to risk.

In the banking sector worldwide, the Basel Accords are generally adopted by internationally active banks for tracking, reporting and exposing operational, credit and market risks.
Within non-financial corporates, the scope is broadened to overlap enterprise risk management, and financial risk management then addresses risks to the firm's overall strategic objectives.
Insurers manage their own risks with a focus on solvency and the ability to pay claims. Life Insurers are concerned more with longevity and interest rate risk, while short-Term Insurers emphasize catastrophe-risk and claims volatility.
In investment management risk is managed through diversification and related optimization; while further specific techniques are then applied to the portfolio or to individual stocks as appropriate.

In all cases, the last "line of defence" against risk is capital, "as it ensures that a firm can continue as a going concern even if substantial and unexpected losses are incurred".

Economic perspective

prescribes that a firm should take on a project only if it increases shareholder value. Further, the theory suggests that firm managers cannot create value for shareholders or investors by taking on projects that shareholders could do for themselves at the same cost; see Theory of the firm and Fisher separation theorem.
Given these, there is therefore a fundamental debate relating to "Risk Management" and shareholder value. The discussion essentially weighs the value of risk management in a market versus the cost of bankruptcy in that market: per the Modigliani and Miller framework, hedging is irrelevant since diversified shareholders are assumed to not care about firm-specific risks, whereas, on the other hand hedging is seen to create value in that it reduces the probability of financial distress.
When applied to financial risk management, this implies that firm managers should not hedge risks that investors can hedge for themselves at the same cost. This notion is captured in the so-called "hedging irrelevance proposition": "In a perfect market, the firm cannot create value by hedging a risk when the price of bearing that risk within the firm is the same as the price of bearing it outside of the firm."
In practice, however, financial markets are not likely to be perfect markets. This suggests that firm managers likely have many opportunities to create value for shareholders using financial risk management, wherein they are able to determine which risks are cheaper for the firm to manage than for shareholders. Here, market risks that result in unique risks for the firm are commonly the best candidates for financial risk management.

Application

As outlined, businesses are exposed, in the main, to market, credit and operational risk. A broad distinction exists though, between financial institutions and non-financial firms - and correspondingly, the application of risk management will differ. Respectively:
For Banks and Fund Managers, "credit and market risks are taken intentionally with the objective of earning returns, while operational risks are a byproduct to be controlled".
For non-financial firms, the priorities are reversed, as "the focus is on the risks associated with the business" - ie the production and marketing of the services and products in which expertise is held - and their impact on revenue, costs and cash flow, "while market and credit risks are usually of secondary importance as they are a byproduct of the main business agenda".
In all cases, as above, risk capital is the last "line of defence".

Banking

and other wholesale institutions face various financial risks in conducting their business, and how well these risks are managed and understood is a key driver
behind profitability, as well as of the quantum of capital they are required to hold.
Financial risk management in banking has thus grown markedly in importance since the 2008 financial crisis.
The broad distinction between Investment Banks, on the one hand, and Commercial and Retail Banks on the other, carries through to the management of risk at these institutions.
Investment Banks profit from trading - proprietary and flow - and earn fees from structuring and deal making; the latter includes listing securities so as to raise funding in the capital markets, as well as directly providing debt-funding for large corporate "projects".
The major focus for risk managers here is therefore on market- and credit risk.
Commercial and Retail Banks, as deposit taking institutions, profit from the spread between deposit and loan rates.
The focus of risk management is then on loan defaults from individuals or businesses, and on having enough liquid assets to meet withdrawal demands; market risk concerns, mainly, the impact of interest rate changes on net interest margins.
All banks will focus also on operational risk, impacting here through regulatory capital;
banks are also exposed to Macroeconomic systematic risk - risks related to the aggregate economy the bank is operating in
.
The Basel Accords mandate the predominant risk management framework. Under "Pillar I" regulators define the minimum capital requirements for quantifiable risks — principally credit risk, market risk, and operational risk as outlined — using either standardised or approved internal‑model approaches. Under "Pillar II", banks must conduct an internal capital adequacy assessment to capture all material risks, holding sufficient "economic capital" for those. Some jurisdictions complement these with additional buffers, stress testing, and supervisory review.

Investment banking

For investment banks - as outlined - the major focus is on credit and market risk.
Credit risk is inherent in the business of banking, but additionally, these institutions are exposed to counterparty credit risk. Both are to some extent offset by margining and collateral; and the management is of the net-position.
Risk management here
is, as discussed, simultaneously concerned with
managing, and as necessary hedging, the various positions held by the institution - both trading positions and long term exposures;
and
calculating and monitoring the resultant economic capital, as well as the regulatory capital under Basel III — which, importantly, covers also leverage and liquidity — with regulatory capital as a floor.
Correspondingly, and broadly, the analytics are based as follows:
For on the "Greeks", the sensitivity of the price of a derivative to a change in its underlying factors; as well as on the various other measures of sensitivity, such as DV01 for the sensitivity of a bond or swap to interest rates, and CS01 or JTD for exposure to credit spread.
For on value at risk, or "VaR", an estimate of how much the investment or area in question might lose as market and credit conditions deteriorate, with a given probability over a set time period, and with the bank then holding "economic"- or "risk capital" correspondingly; common parameters are 99% and 95% worst-case losses - i.e. 1% and 5% - and one day and two week horizons.
These calculations are mathematically sophisticated, and within the domain of quantitative finance.
The regulatory capital quantum is calculated via specified formulae: risk weighting the exposures per highly standardized asset-categorizations, applying the aside frameworks, and the resultant capital — at least 12.9% of these Risk-weighted assets — must then be held in specific "tiers" and is measured correspondingly via the various capital ratios.
In certain cases, banks are allowed to use their own estimated risk parameters here; these "internal ratings-based models" typically result in less required capital, but at the same time are subject to strict minimum conditions and disclosure requirements.
As mentioned, additional to the capital covering RWA, the aggregate balance sheet will require capital for leverage and liquidity; this is monitored via the LR, LCR, and NSFR ratios.
The 2008 financial crisis exposed holes in the mechanisms used for hedging
.
As such, the methodologies employed have had to evolve, both from a modelling point of view, and in parallel, from a regulatory point of view.
Regarding the modelling, changes corresponding to the above are:
For the daily direct analysis of the positions at the desk level, as a standard, measurement of the Greeks now inheres the volatility surface — through local- or stochastic volatility models — while re interest rates, discounting and analytics are under a "multi-curve framework". Derivative pricing now embeds considerations re counterparty risk and funding risk, amongst others, through the CVA and XVA "valuation adjustments"; these also carry regulatory capital.
For Value at Risk, the traditional parametric and "Historical" approaches, are now supplemented with the more sophisticated Conditional value at risk / expected shortfall, Tail value at risk, and Extreme value theory. For the underlying mathematics, these may utilize mixture models, PCA, volatility clustering, copulas, and other techniques.
Extensions to VaR include Margin-, Liquidity-, Earnings- and Cash flow at risk, as well as Liquidity-adjusted VaR.
For both and, model risk is addressed through regular validation of the models used by the bank's various divisions; for VaR models, backtesting is especially employed.
Regulatory changes, are also twofold.
The first change, entails an increased emphasis on bank stress tests.
These tests, essentially a simulation of the balance sheet for a given scenario, are typically linked to the macroeconomics, and provide an indicator of how sensitive the bank is to changes in economic conditions, whether it is sufficiently capitalized, and of its ability to respond to market events.
The second set of changes, sometimes called "Basel IV", entails the modification of several regulatory capital standards. In particular FRTB addresses market risk, and SA-CCR addresses counterparty risk;
other modifications are being phased in from 2023.
To operationalize the above, Investment banks, particularly, employ dedicated "Risk Groups", i.e. Middle Office teams monitoring the firm's risk-exposure to, and the profitability and structure of, its various business units, products, asset classes, desks, and / or geographies.
By increasing order of aggregation and time-horizon:

Financial institutions will set limit values for each of the Greeks, or other sensitivities, that their traders must not exceed, and traders will then hedge, offset, or reduce periodically if not daily; see the techniques [|listed below]. These limits are set given a range of plausible changes in prices and rates, coupled with the board-specified risk appetite re overnight-losses.
Desks, or areas, will similarly be limited as to their VaR quantum, corresponding to their allocated economic capital; a loss which exceeds the VaR threshold is termed a "VaR breach".
RWA - the key Pillar I result - is correspondingly monitored from desk level and upward. Market-risk RWA will be monitored more frequently, with credit-risk RWA less so. While VaR is a risk-taking constraint RWA is a capital supply constraint ; it does provide the denominator for the [|below] ratios and feeds into other planning.
Each area's concentration risk will be checked against thresholds set for various types of risk, and / or re a single counterparty, sector or geography.
Leverage will be monitored, at very least re regulatory requirements via LR, the Leverage Ratio, as leveraged positions could lose large amounts for a relatively small move in the price of the underlying.
Relatedly, liquidity risk is monitored: LCR, the Liquidity Coverage Ratio, measures the ability of the bank to survive a short-term stress, covering its total net cash outflows over the next 30 days with "high quality liquid assets"; NSFR, the Net Stable Funding Ratio, assesses its ability to finance assets and commitments within a year. Any "gaps", also, must be managed.
Systemically Important Banks hold additional capital such that their total loss absorbency capacity, TLAC, is sufficient given both RWA and leverage.

Periodically,
these all are estimated under a given stress scenario — regulatory and,
often, internal —
and risk capital, together with these limits if indicated, is correspondingly revisited.
The approaches taken center either on a hypothetical or historical scenario,
and may apply increasingly sophisticated mathematics to the analysis.
More generally, these tests provide estimates for scenarios beyond the VaR thresholds, thus “preparing for anything that might happen, rather than worrying about precise likelihoods".
A reverse stress test, in fact, starts from the point at which "the institution can be considered as failing or likely to fail... and then explores scenarios and circumstances that might cause this to occur".
Economic Capital reflects the total risk capital that the bank requires to cover "all" its risks as a going concern assessed on a realistic basis, including survival in a worst-case scenario. The modelling - at least once annually - must be such that any material risks are adequately and conservatively quantified; banks typically deploy detailed simulations and coupled stress testing. The balance-sheet composition is naturally revisited as part of the assessment. Although essentially an internal measure, EC will be viewed by the Regulator under Pillar II and, as above, is governed by ICAAP, the framework for the bank's "internal capital adequacy assessment process".
A key practice, incorporating and assimilating the above, is to assess the Risk-adjusted return on capital, RAROC, of each area. Here, "economic profit" is divided by allocated-capital; and this result is then compared to the target-return for the area — usually, at least the equity holders' expected returns on the bank stock — and identified under-performance can then be addressed.
The numerator, risk-adjusted return, is realized trading-return less a term and risk appropriate funding cost as charged by Treasury to the business-unit under the bank's funds transfer pricing framework;
direct costs are also subtracted.
The denominator is the area's allocated capital, as above, increasing as a function of position risk; several allocation techniques exist.
RAROC is calculated both ex post as discussed, used for performance evaluation,
and ex ante - i.e. expected return less expected loss - to decide whether a particular business unit should be expanded or contracted.
Other teams, overlapping the above Groups, are then also involved in risk management.
Corporate Treasury is responsible for monitoring overall funding and capital structure; it shares responsibility for monitoring liquidity risk, and for maintaining the FTP framework.
Middle Office maintains the following functions also:
Product Control is primarily responsible for insuring traders mark their books to fair value — a key protection against rogue traders — and for "explaining" the daily P&L; with the "unexplained" component, of particular interest to risk managers.
Credit Risk monitors the bank's debt-clients on an ongoing basis, re both exposure and performance; while exposures are initially approved by an "investment committee".
In the Front Office — since counterparty and funding-risks span assets, products, and desks — specialized XVA-desks are tasked with centrally monitoring and managing overall CVA and XVA exposure and capital, typically with oversight from the appropriate Group.
"Stress Testing" is similarly centralized.
Performing the above tasks — while simultaneously ensuring that computations are consistent over the various areas, products, teams, and measures — requires that banks maintain a significant investment in sophisticated infrastructure, finance / risk software, and dedicated staff. Risk software often deployed is from FIS, Kamakura, Murex, Numerix and Refinitiv.
Large institutions may prefer systems developed entirely "in house"
- notably Goldman Sachs, JP Morgan, Jane Street, Barclays, BofA -
while, more commonly, the pricing library will be developed internally, especially as this allows for currency re new products or market features.