What goes in a risk register, and how do the three stress-testing methods differ?

The exam material follows CySEC's 2012 ICAAP guidelines, Circular C026, which CySEC still publishes. Most CIFs have been under the IFR since 26 June 2021. Since 5 November 2021, Class 2 CIFs have assessed their internal capital and liquid assets together under section 18 of Law 165(I)/2021, and Class 3 CIFs only if CySEC asks. This does not replace the ICAAP but widens it: the joint EBA and ESMA guidelines call the whole process the ICARAP, made up of an ICAAP for capital and an ILAAP for liquidity, and CySEC's January 2022 practical guide to the IFR and IFD calls it the ICAAP and ILAAP.

A risk register is where a CIF records and classifies every risk it is exposed to now or could be exposed to in future. For each risk it shows how severe the harm would be. C026 measures that harm as if the risk crystallised; the exam material puts it as the damage the risk could have done had it gone unidentified. The impact may be expressed in figures or in words, for example as a financial loss, a loss of capital, damage to reputation or even harm to people. The outcome is a risk profile that sorts risks into levels of severity. The register feeds the ICAAP by showing which Pillar 1, partly covered and Pillar 2 risks are material; see What are the Pillar 2 risks a CIF must assess in its ICAAP?.

Stress testing covers quantitative and qualitative techniques that show how vulnerable a firm is to rare but plausible events with severe consequences. Its importance grew after the global financial crisis, and it must be built into each CIF's ICAAP and risk management framework. In the ICAAP its purpose is to assess all material risks comprehensively, in an integrated way and looking ahead, taking in market, economic, institutional and political factors that could substantially affect the firm's prudent and solvent operation. CySEC accepts that no single methodology is correct: the right approach depends on the firm's size, activities, risk appetite and quality of risk management, but it must be sophisticated enough for the firm and meet the rules.

Sensitivity analysis is the simplest method. It shows how the firm's position changes when one relevant risk factor moves and all others stay the same. Its strength is that the size of losses from that factor is easy to measure; its weakness is that in reality factors do not move in isolation. Scenario analysis changes several risk factors at the same time and measures their combined effect, using hypothetical and historical scenarios; the exam material adds expected ones. It captures the links between factors, which gives an integrated view of risk, but those links may break down in a crisis. C026 adds that they can be unstable even in normal conditions. Reverse stress testing is mainly a tool for finding weaknesses in the business model. It starts from the outcome, a business that is no longer viable, and identifies the circumstances that could produce it. Senior management then decides whether to take mitigating action now, or to set triggers for action if such a scenario starts to develop.

Stress tests must be designed around the firm's portfolio and the risks it takes, and in line with its external environment. They must suit its specific circumstances, risk profile and operating model. They must be forward-looking, taking in both the current position and planned strategic developments, and they must show how adverse scenarios would affect future profitability and capital adequacy. They are reviewed at least annually, and whenever the underlying factors change or are expected to change, and revised as needed. C026 also expects the tests themselves to be run more often than once a year. In the ICAAP, the risk management function applies them.

A stress test is not finished when the report is written. Management defines actions, assigns them to responsible people and departments, and implements them. The same stress test is then run again to see how the actions have changed the impact. For the wider organisational rules on risk management, see What organisation, risk management and internal audit must an investment firm have?.