Definition

Risk is the possibility that actual outcomes will differ from expected outcomes, resulting in
uncertainty about achieving objectives, particularly financial returns or strategic goals.

Key Points for CMA Part 2

1. Core Idea – Risk reflects the variability or uncertainty of returns, cash flows, or outcomes.

2. Relevance in CMA – Risk is central to capital budgeting, investment decisions, portfolio

management, and financial strategy.

3. Sources of Risk –

o Business Risk – Operational uncertainties (e.g., sales volume, costs).

o Financial Risk – Due to leverage and financing choices.

o Market Risk – Changes in market prices, interest rates, or currency values.

o Credit Risk – Possibility of default by counterparties.

o Liquidity Risk – Inability to meet obligations on time without loss.

4. Measurement – Often measured using standard deviation, beta coefficient, Value at Risk
(VaR), or scenario analysis.

5. Management – Through diversification, hedging, insurance, and strategic planning.

1. Risk

 Meaning: The possibility of outcomes different from what is expected where the probability
of each outcome is known or can be estimated.

 Key Point: Measurable – you can assign probabilities based on data or models.

 Example (Finance): You know a stock has a 60% chance of giving a 10% return and a 40%
chance of giving a 5% loss.

2. Uncertainty

 Meaning: The possibility of outcomes different from what is expected where the probability
of outcomes is unknown or cannot be reliably estimated.

 Key Point: Unmeasurable – no historical data or model to calculate exact probabilities.

 Example (Finance): Launching a completely new product in an untested market—you cannot

predict the chances of success or failure.

CMA Exam Link

  Risk → Can be quantified → Suitable for probabilistic models, sensitivity analysis, Value at
Risk (VaR).

 Uncertainty → Cannot be quantified → Needs judgment, scenario planning, or qualitative

assessment.

Aspect Risk Uncertainty

Probability known? Yes No

Measurable? Yes No

Example Stock price fluctuation Unknown impact of sudden regulation change

CMA Tools Standard deviation, Beta, VaR Scenario analysis, Delphi method

1. Risk Management

 Meaning: The process of identifying, assessing, and controlling risks related to a specific
area, function, or project.

 Scope: Narrow – focuses on individual risks (e.g., market risk, credit risk, operational risk)
separately.

 Approach: Reactive or preventive; often siloed by department.

 Objective: Minimize potential losses in a specific domain.

 Example: A treasury department hedging against currency fluctuations.

2. Enterprise Risk Management (ERM)

 Meaning: An organization-wide, strategic approach to managing all types of risks—financial,

operational, strategic, compliance—in an integrated manner.

 Scope: Broad – considers how different risks interact and affect the organization’s overall
objectives.

 Approach: Proactive, holistic, and aligned with corporate strategy (often follows frameworks
like COSO ERM).

 Objective: Create, protect, and enhance stakeholder value while ensuring long-term
sustainability.

 Example: A company-wide risk committee assessing the combined effect of supply chain
disruption, market volatility, and regulatory changes on profitability.
Aspect Risk Management Enterprise Risk Management (ERM)

Scope Specific risk areas Organization-wide, all risk categories

Integration Limited, silo-based Integrated across functions & strategies

Focus Risk mitigation in specific domains Value creation & strategic resilience

Time Horizon Short- to medium-term Long-term strategic perspective

Example Tool Derivatives for hedging market risk COSO ERM framework

📌 CMA Exam Tip:

 If the question is about holistic, strategy-linked, value-focused risk handling, the answer is
ERM.

 If it’s about isolated, technical, or department-level risk handling, it’s traditional risk
management.

BENEFITS OF RISK MANAGEMENT

Increasing shareholder value through minimizing losses and maximizing opportunities

• Fewer disruptions to operations, and fewer shocks and unwelcome surprises

• Better utilization of resources and better cost control

• Employees, other stakeholders, and relevant governing and regulatory bodies are more confident

in the organization

• More effective strategic planning

• Timelier assessment of and grasp of new opportunities, and improved ability to meet objectives

and take advantage of opportunities

• Better and more complete contingency planning

Contingency Planning is the process of preparing predefined actions and procedures to respond
effectively to unexpected events or emergencies that could disrupt operations or strategic objectives.

Key Points for CMA Exam

1. Purpose – Minimize damage, ensure quick recovery, and maintain business continuity.

2. Nature – Proactive planning for “what-if” scenarios.

3. Link to Risk – Focuses on low-probability but high-impact events (e.g., natural disasters,
major system failures, sudden loss of a key customer).

4. Elements –
 o Identification of potential threats.

o Impact analysis on operations, finances, and reputation.

o Response strategies (alternate suppliers, backup systems, communication plans).

o Testing & updating the plan regularly.

5. Examples in Finance/Strategy –

o Backup funding sources in case of credit market freeze.

o Alternate supply chain routes during geopolitical disruption.

o Emergency IT recovery systems for trading platforms.

CMA Exam Angle

 Contingency planning supports ERM but is more operational and scenario-specific.

 Often tested along with business continuity planning and disaster recovery.

1. Business Risk

 Meaning: The risk that the company’s operations will not generate sufficient revenue to
cover expenses, irrespective of financing.

 Nature: Comes from uncertainty in demand, pricing, competition, and operating costs.

 Example: A clothing retailer facing reduced sales due to a fashion trend shift.

 CMA Angle: Business risk is present even without debt and affects the operating income.

2. Strategic Risk

 Meaning: The risk that long-term business plans fail to achieve objectives due to wrong
strategic decisions or external changes.

 Nature: Linked to positioning, competition, and external environment.

 Example: Entering a foreign market without adequate research, leading to losses.

 CMA Angle: Tested in ERM and strategy sections — requires proactive monitoring of industry
trends.

3. Operational Risk

 Meaning: The risk of loss from failures in internal processes, systems, people, or external
events.

 Nature: Day-to-day execution risk.

 Example: Bank losses due to a system outage or employee fraud.

  CMA Angle: Managed via internal controls, automation, and process improvement.

4. Financial Risk

 Meaning: The risk that a company’s financing structure or financial variables cause earnings
or cash flow volatility.

 Nature: Includes leverage, interest rate, currency, and liquidity risks.

 Example: A company unable to repay loans due to rising interest rates.

 CMA Angle: Heavily tested in investment decisions, capital structure, and risk-return trade-
off.

5. Hazard Risk

 Meaning: The risk from unexpected, extreme events that can cause major damage to
people, assets, or operations.

 Nature: Often insurable; includes both natural and man-made disasters.

 Example: Factory destroyed by a fire or earthquake.

 CMA Angle: Linked to contingency planning, insurance coverage, and business continuity
planning.

Quick Differentiation Table

Type Focus Area Typical Cause Example

Operations & Demand fluctuation, cost Sales drop due to new

Business Risk
revenue changes competitor

Wrong decisions, industry

Strategic Risk Long-term direction Entering unprofitable market
disruption

Operational Day-to-day
Human error, system failure IT system crash
Risk processes

Financial Risk Financing & returns Leverage, market fluctuations Loan default due to rate hike

Hazard Risk Extreme events Natural/man-made disasters Flood destroying inventory

1. Legal Risk

 Definition: The risk of loss due to being sued, fines, penalties, or unenforceable contracts
arising from violations of laws or contractual obligations.

 Focus: Exposure to legal actions, litigation, and contractual disputes.

  Example:

o A company faces a lawsuit for breach of contract.

o Intellectual property theft case against the firm.

2. Compliance Risk

 Definition: The risk of loss due to the company’s failure to follow laws, regulations, codes of
conduct, or internal policies.

 Focus: Day-to-day adherence to regulatory and policy requirements.

 Example:

o A bank failing to meet anti–money laundering (AML) regulations.

o A company not filing required tax returns on time.

Key Difference

Aspect Legal Risk Compliance Risk

Lawsuits, contractual disputes, legal Non-adherence to laws, rules, regulations,

Source
liabilities policies

External enforcement (court/legal Internal + external enforcement (regulators,

Nature
system) audits)

Example Breach of contract → lawsuit Late GST filing → penalties

CMA Angle Broader legal consequences Narrower, regulatory adherence

✅ Exam Line:

 Legal risk = danger of lawsuits or unenforceable contracts.

 Compliance risk = danger of not following laws/regulations.

BOTH ARE UNDER OPERATIONAL RISK

This passage is describing financial risk due to leverage (very relevant in CMA Part 2 capital structure
decisions). Let me break it down step by step:

1. Lack of cash flow → inability to pay obligations

 A company needs regular cash inflows to pay its interest and other fixed obligations.

 If cash inflow is insufficient, the company risks default or insolvency.

👉 This is called liquidity/insolvency risk.

2. Effect of higher debt in capital structure

 A company’s financing comes from equity (shares) and debt (borrowings).

 Debt financing brings fixed cost = interest expense.

 If the proportion of debt increases (i.e., higher financial leverage), then:

o Fixed interest payments increase.

o More pressure is placed on cash flows.

o Insolvency risk rises if earnings are not stable.

👉 High debt = high financial risk.

3. Interest expense increases variability in EPS

 Without debt: profits (EBT) fluctuate only with business performance.

 With debt: profits (EBT) fluctuate more sharply, because interest is fixed.

 When operating income (EBIT) rises → shareholders benefit more (EPS grows faster).

 But when EBIT falls → shareholders lose more (EPS drops faster).

👉 This is the financial leverage effect:

 It magnifies both gains and losses for equity holders.

Simple Example

 Company A (no debt): EBIT = ₹1,000; interest = ₹0 → EBT = ₹1,000.

 Company B (with debt): EBIT = ₹1,000; interest = ₹400 → EBT = ₹600.

If EBIT falls by 50% (₹500):

 Company A → EBT = ₹500 (drop of 50%).

 Company B → EBT = ₹100 (drop of 83%).

👉 Debt amplifies volatility in EPS.

✅ In summary:

 More debt → higher fixed interest → greater risk of insolvency.

 Debt magnifies EPS fluctuations → higher potential reward but also higher risk.

1. Risk Identification
  Meaning: Detecting risks that could affect objectives (internal & external).

 Tools: Brainstorming, risk registers, scenario analysis, SWOT.

 Example: Identifying FX risk for an exporter.

2. Risk Assessment (Qualitative/Quantitative)

 Qualitative: Ranking risks as High/Medium/Low based on judgment.

 Quantitative: Assigning probabilities & potential financial impact (e.g., VaR, sensitivity
analysis).

 Example: Estimating 30% chance that oil price volatility reduces profit by ₹5M.

3. Risk Prioritization

 Meaning: Deciding which risks matter most and the order to address them.

 Basis: Usually a risk matrix (likelihood vs. impact).

 Example: Prioritizing cyberattack risk (high probability, high impact) over natural disaster risk
(low probability, high impact).

4. Response Planning

 Options:

o Avoid → eliminate activity causing risk.

o Mitigate/Reduce → internal controls, hedging, diversification.

o Transfer → insurance, outsourcing, derivatives.

o Accept → tolerate when cost > benefit.

 Example: Buying an option to hedge against FX risk.

5. Risk Monitoring

 Meaning: Ongoing tracking of risks and effectiveness of responses.

 Tools: KPIs, dashboards, audits, ERM systems.

 Example: Regular review of debt ratios to ensure covenant compliance.

It deals with recognizing events (both risks and opportunities) that could affect achievement of
objectives.
Event Identification Techniques

1. Brainstorming

 Group sessions with managers/experts to list possible risk events.

 Encourages creativity and wide participation.

2. Interviews / Workshops

 Structured discussions with key stakeholders, employees, or subject-matter experts.

 Helps identify risks that may not be obvious.

3. Questionnaires & Surveys

 Distributing structured forms to collect perceptions of risks from employees across

departments.

 Useful for large organizations.

4. SWOT Analysis

 Analyzing Strengths, Weaknesses, Opportunities, Threats.

 Helps identify external opportunities/threats and internal weaknesses.

5. Historical Data / Loss Event Analysis

 Reviewing past incidents, near misses, industry trends, or competitor failures.

 Example: analyzing previous IT system outages to anticipate future ones.

6. Process Flow Analysis

 Mapping critical processes to identify failure points.

 Example: mapping supply chain to spot disruption risk.

7. Risk Checklists / Libraries

 Using standard industry checklists or databases of known risks.

 Ensures coverage of common risk categories.

8. Scenario Analysis

 Developing “what if” scenarios for potential external shocks.

 Example: “What if interest rates rise 2%?”

9. External Source Analysis

 Monitoring regulators, industry associations, competitors, media, and economic reports.

 Helps spot emerging risks.

CMA Exam Tip

  Event Identification ≠ Risk Assessment.

 It is about recognizing events, not yet analyzing probability or impact.

✅ One-liner for exam:

“Event identification uses tools like brainstorming, SWOT, historical analysis, checklists, and
scenario analysis to detect internal and external events that may affect objectives.”