Skip to learning content
IBBC Capital Academy

Risk management practice

Draft, not validated by a professional instructor · Local self-study · Synthetic cases · Public formative answers, not a secure exam. No accreditation or employment guarantee. Interactive numeric labs run separately.

career-2026-10-24-draft1 · DRAFT_INDEPENDENT_REVIEW_PENDING

Probability, loss and model limitations

basic · 6 estimated hours

Prerequisites

  • Basic spreadsheet arithmetic

Outcomes

  • Explain probability, loss and model limitations
  • Produce a reviewable work sample with assumptions, owner and evidence
  • Defend limitations and respond to reviewer challenge

Reading

Specify event, horizon, exposure and data quality before calculating. Probability is uncertain; historical frequency is not a promise. Separate expected loss from extreme loss and distinguish risk measurement from a decision to accept risk.

Work only on the synthetic case. Record the data version, calculation date, author, reviewer and unresolved assumptions. A polished document without evidence is not a sufficient submission.

Practice

  • Create an assumption table and challenge the comparability of two observation periods.
  • Create the deliverable; ask a peer to identify one unsupported assumption; revise with a dated change log.

Common mistakes

  • Treating a model output as approval
  • Omitting time horizon, units or data version
  • Changing a baseline without an approval record

Worked example

Ten fictional incidents among 1,000 comparable observations give a sample frequency of 1%; changing the population or horizon invalidates a direct comparison. Zero observed events does not prove zero risk.

Deliverable

Data dictionary and model limitation note

Review rubric

  • Technical correctness and reproducibility · 40/100
  • Evidence, assumptions and limitations · 30/100
  • Ownership, escalation and communication · 20/100
  • Response to independent review · 10/100

Self-check

Is zero observed loss proof of no risk?

  • No
  • Yes
Show answer & explanation

No

Ten fictional incidents among 1,000 comparable observations give a sample frequency of 1%; changing the population or horizon invalidates a direct comparison. Zero observed events does not prove zero risk.

What is required for a probability statement?

  • Event and horizon
  • Only a percentage
Show answer & explanation

Event and horizon

Specify event, horizon, exposure and data quality before calculating. Probability is uncertain; historical frequency is not a promise. Separate expected loss from extreme loss and distinguish risk measurement from a decision to accept risk.

Risk register and RCSA

basic · 6 estimated hours

Prerequisites

  • Basic spreadsheet arithmetic
  • risk-foundations

Outcomes

  • Explain risk register and rcsa
  • Produce a reviewable work sample with assumptions, owner and evidence
  • Defend limitations and respond to reviewer challenge

Reading

Describe cause–event–impact, risk owner, inherent risk, controls, evidence and residual risk. An ordinal likelihood×impact score is a prioritisation aid, not a monetary loss estimate. Distinguish control design from evidence of effective operation.

Work only on the synthetic case. Record the data version, calculation date, author, reviewer and unresolved assumptions. A polished document without evidence is not a sufficient submission.

Practice

  • Build five register entries; test one control; assign actions and due dates for failed controls.
  • Create the deliverable; ask a peer to identify one unsupported assumption; revise with a dated change log.

Common mistakes

  • Treating a model output as approval
  • Omitting time horizon, units or data version
  • Changing a baseline without an approval record

Worked example

A synthetic reconciliation can be approved by its own author. A maker–checker rule is designed; three logged rejection tests provide limited operating evidence, not proof the control can never fail.

Deliverable

RCSA register, test sheet and action tracker

Review rubric

  • Technical correctness and reproducibility · 40/100
  • Evidence, assumptions and limitations · 30/100
  • Ownership, escalation and communication · 20/100
  • Response to independent review · 10/100

Self-check

Is a written control automatically effective?

  • No; test operation
  • Yes
Show answer & explanation

No; test operation

A synthetic reconciliation can be approved by its own author. A maker–checker rule is designed; three logged rejection tests provide limited operating evidence, not proof the control can never fail.

Does a score of 12 mean a loss of 12 currency units?

  • No
  • Yes
Show answer & explanation

No

Describe cause–event–impact, risk owner, inherent risk, controls, evidence and residual risk. An ordinal likelihood×impact score is a prioritisation aid, not a monetary loss estimate. Distinguish control design from evidence of effective operation.

Credit exposure and expected loss

intermediate · 6 estimated hours

Prerequisites

  • Basic spreadsheet arithmetic
  • risk-rcsa

Outcomes

  • Explain credit exposure and expected loss
  • Produce a reviewable work sample with assumptions, owner and evidence
  • Defend limitations and respond to reviewer challenge

Reading

For a simplified single exposure, EL=PD×LGD×EAD with consistent horizon and units. PD is default probability, LGD is loss fraction conditional on default, EAD is exposure at default. Inputs can change together under stress; EL is not regulatory capital, an accounting provision or an approval.

Work only on the synthetic case. Record the data version, calculation date, author, reviewer and unresolved assumptions. A polished document without evidence is not a sufficient submission.

Practice

  • Reproduce EL and stress PD to 0.04 while holding other inputs fixed; explain the artificial assumption and EL=18,000.
  • Create the deliverable; ask a peer to identify one unsupported assumption; revise with a dated change log.

Common mistakes

  • Treating a model output as approval
  • Omitting time horizon, units or data version
  • Changing a baseline without an approval record

Worked example

Hypothetical one-year PD=0.02, LGD=0.45, EAD=1,000,000 synthetic currency units: EL=9,000. No diversification, independence across borrowers or regulatory calibration is assumed.

Deliverable

Credit worksheet, input definitions and limitation memo

Review rubric

  • Technical correctness and reproducibility · 40/100
  • Evidence, assumptions and limitations · 30/100
  • Ownership, escalation and communication · 20/100
  • Response to independent review · 10/100

Self-check

What is base EL?

  • 9,000
  • 90,000
Show answer & explanation

9,000

Hypothetical one-year PD=0.02, LGD=0.45, EAD=1,000,000 synthetic currency units: EL=9,000. No diversification, independence across borrowers or regulatory calibration is assumed.

Can EL be labelled regulatory capital?

  • No
  • Yes
Show answer & explanation

No

For a simplified single exposure, EL=PD×LGD×EAD with consistent horizon and units. PD is default probability, LGD is loss fraction conditional on default, EAD is exposure at default. Inputs can change together under stress; EL is not regulatory capital, an accounting provision or an approval.

Market risk and liquidity ladder

intermediate · 6 estimated hours

Prerequisites

  • Basic spreadsheet arithmetic
  • risk-credit

Outcomes

  • Explain market risk and liquidity ladder
  • Produce a reviewable work sample with assumptions, owner and evidence
  • Defend limitations and respond to reviewer challenge

Reading

Separate market value change from ability to meet cash obligations. Reprice only within a stated simplified model; map dated inflows, outflows, available cash and settlement assumptions. Selling an asset does not guarantee immediate cash, especially under stressed liquidity.

Work only on the synthetic case. Record the data version, calculation date, author, reviewer and unresolved assumptions. A polished document without evidence is not a sufficient submission.

Practice

  • Build a three-day cash ladder and a separate price-shock table; add a delayed settlement scenario.
  • Create the deliverable; ask a peer to identify one unsupported assumption; revise with a dated change log.

Common mistakes

  • Treating a model output as approval
  • Omitting time horizon, units or data version
  • Changing a baseline without an approval record

Worked example

A fictional holding worth 100,000 falls 8% to 92,000 before costs. Cash is 20,000, next-day outflow 30,000, confirmed next-day inflow 5,000: the next-day shortfall is 5,000; do not count an unconfirmed sale.

Deliverable

Market scenario table and dated cash ladder

Review rubric

  • Technical correctness and reproducibility · 40/100
  • Evidence, assumptions and limitations · 30/100
  • Ownership, escalation and communication · 20/100
  • Response to independent review · 10/100

Self-check

What is the next-day cash shortfall?

  • 5,000
  • 8,000
Show answer & explanation

5,000

A fictional holding worth 100,000 falls 8% to 92,000 before costs. Cash is 20,000, next-day outflow 30,000, confirmed next-day inflow 5,000: the next-day shortfall is 5,000; do not count an unconfirmed sale.

Is a market loss identical to a cash outflow?

  • No
  • Always
Show answer & explanation

No

Separate market value change from ability to meet cash obligations. Reprice only within a stated simplified model; map dated inflows, outflows, available cash and settlement assumptions. Selling an asset does not guarantee immediate cash, especially under stressed liquidity.

Operational resilience and incident response

advanced · 8 estimated hours

Prerequisites

  • Basic spreadsheet arithmetic
  • risk-market-liquidity

Outcomes

  • Explain operational resilience and incident response
  • Produce a reviewable work sample with assumptions, owner and evidence
  • Defend limitations and respond to reviewer challenge

Reading

Map a critical operation to people, process, technology and external dependencies. Set a hypothetical disruption tolerance, exercise severe plausible scenarios, test recovery evidence and record lessons. A recovery target is not evidence that the target has been achieved.

Work only on the synthetic case. Record the data version, calculation date, author, reviewer and unresolved assumptions. A polished document without evidence is not a sufficient submission.

Practice

  • Draw dependency map, write an incident timeline, run a tabletop and distinguish target from measured recovery.
  • Create the deliverable; ask a peer to identify one unsupported assumption; revise with a dated change log.

Common mistakes

  • Treating a model output as approval
  • Omitting time horizon, units or data version
  • Changing a baseline without an approval record

Worked example

A fictional daily report relies on one data feed and one reviewer. A four-hour feed outage plus reviewer absence prevents publication. The team tests a synthetic fallback and records what remains untested.

Deliverable

Service map, tabletop script and incident/lesson report

Review rubric

  • Technical correctness and reproducibility · 40/100
  • Evidence, assumptions and limitations · 30/100
  • Ownership, escalation and communication · 20/100
  • Response to independent review · 10/100

Self-check

Does a recovery target prove resilience?

  • No
  • Yes
Show answer & explanation

No

A fictional daily report relies on one data feed and one reviewer. A four-hour feed outage plus reviewer absence prevents publication. The team tests a synthetic fallback and records what remains untested.

Which dependencies should be mapped?

  • People, process, technology and third parties
  • Servers only
Show answer & explanation

People, process, technology and third parties

Map a critical operation to people, process, technology and external dependencies. Set a hypothetical disruption tolerance, exercise severe plausible scenarios, test recovery evidence and record lessons. A recovery target is not evidence that the target has been achieved.

Stress testing and risk committee capstone

advanced · 8 estimated hours

Prerequisites

  • Basic spreadsheet arithmetic
  • risk-resilience

Outcomes

  • Explain stress testing and risk committee capstone
  • Produce a reviewable work sample with assumptions, owner and evidence
  • Defend limitations and respond to reviewer challenge

Reading

Define purpose, perimeter, horizon, scenario, assumptions, method, validation and decision use before running a stress test. Stress scenarios are not forecasts. Combine financial and operational impacts without double counting; escalate data gaps and limits to the accountable owner.

Work only on the synthetic case. Record the data version, calculation date, author, reviewer and unresolved assumptions. A polished document without evidence is not a sufficient submission.

Practice

  • Submit a versioned committee pack; peer reviewer changes one assumption; rerun and reconcile differences with the original.
  • Create the deliverable; ask a peer to identify one unsupported assumption; revise with a dated change log.

Common mistakes

  • Treating a model output as approval
  • Omitting time horizon, units or data version
  • Changing a baseline without an approval record

Worked example

For the same synthetic portfolio, combine delayed receipts and price falls. Keep market-value loss separate from cash deficit, identify overlaps and state which mitigation remains untested. Recommend a conditional action, not a capital adequacy conclusion.

Deliverable

Register, EL worksheet, market/cash stress, resilience map, committee memo and oral defence

Review rubric

  • Technical correctness and reproducibility · 40/100
  • Evidence, assumptions and limitations · 30/100
  • Ownership, escalation and communication · 20/100
  • Response to independent review · 10/100

Self-check

Are stress results forecasts?

  • No
  • Yes
Show answer & explanation

No

For the same synthetic portfolio, combine delayed receipts and price falls. Keep market-value loss separate from cash deficit, identify overlaps and state which mitigation remains untested. Recommend a conditional action, not a capital adequacy conclusion.

What must a committee see?

  • Assumptions, gaps, owners and conditional actions
  • Only a single risk score
Show answer & explanation

Assumptions, gaps, owners and conditional actions

Define purpose, perimeter, horizon, scenario, assumptions, method, validation and decision use before running a stress test. Stress scenarios are not forecasts. Combine financial and operational impacts without double counting; escalate data gaps and limits to the accountable owner.

References

Local numeric lab guide