Financial risk management

Application

As outlined, businesses are exposed, in the main, to market, credit and operational risk. A broad distinction exists though, between financial institutions and non-financial firms - and correspondingly, the application of risk management will differ. Respectively: For Banks and Fund Managers, "credit and market risks are taken intentionally with the objective of earning returns, while operational risks are a byproduct to be controlled". For non-financial firms, the priorities are reversed, as "the focus is on the risks associated with the business" - ie the production and marketing of the services and products in which expertise is held - and their impact on revenue, costs and cash flow, "while market and credit risks are usually of secondary importance as they are a byproduct of the main business agenda". (See related discussion re valuing financial services firms as compared to other firms.) In all cases, as above, risk capital is the last "line of defence".

Banking

Banks and other wholesale institutions face various financial risks in conducting their business, and how well these risks are managed and understood is a key driver behind profitability, as well as of the quantum of capital they are required to hold. Financial risk management in banking has thus grown markedly in importance since the 2008 financial crisis. (This has given rise to various dedicated degrees and several professional certifications.)

The broad distinction between Investment Banks, on the one hand, and Commercial and Retail Banks on the other, carries through to the management of risk at these institutions. Investment Banks profit from trading - proprietary and flow - and earn fees from structuring and deal making; the latter includes listing securities so as to raise funding in the capital markets (and supporting these thereafter), as well as directly providing debt-funding for large corporate "projects". The major focus for risk managers here is therefore on market- and (corporate) credit risk. Commercial and Retail Banks, as deposit taking institutions, profit from the spread between deposit and loan rates. The focus of risk management is then on loan defaults from individuals or businesses (SMEs), and on having enough liquid assets to meet withdrawal demands; market risk concerns, mainly, the impact of interest rate changes on net interest margins. All banks will focus also on operational risk, impacting here (at least) through regulatory capital; (large) banks are also exposed to Macroeconomic systematic risk - risks related to the aggregate economy the bank is operating in (see Too big to fail).

Central to both commercial and investment banking is the function of maturity transformation, where institutions fund long-term assets using short-term liabilities. Commercial banks typify this by issuing demand deposits (which can be withdrawn at any time) to fund long-dated assets like mortgages, while investment banks often finance longer-term trading inventory or structured products through short-term repurchase agreements (repos). While this "borrowing short and lending long" strategy is profitable — normally capturing the spread between lower short-term rates and higher long-term rates — it creates an inherent mismatch on the balance sheet. This structural mismatch generates the primary risks that banks must manage - outlined in the preceding paragraph - but here especially: liquidity risk (the inability to meet short-term obligations without selling assets) and interest rate risk (changes in the yield curve affecting asset and liability values differently), making Asset and liability management (ALM) a critical discipline.

The Basel Accords mandate the predominant risk management framework. Under "Pillar I" regulators define the minimum regulatory capital requirements for quantifiable risks — principally credit risk, market risk, and operational risk as outlined — using either standardised or approved internal‑model approaches. Under "Pillar II", banks must conduct an internal capital adequacy assessment (ICAAP) to capture all material risks, holding sufficient "economic capital" for those. Some jurisdictions (or banks) complement these with additional buffers, stress testing, and supervisory review.

Investment banking

For investment banks - as outlined - the major focus is on credit and market risk. Credit risk is inherent in the business of banking, but additionally, these institutions are exposed to counterparty credit risk. Both are to some extent offset by margining and collateral; and the management is of the net-position.

Risk management here is, as discussed, simultaneously concerned with (i) managing, and as necessary hedging, the various positions held by the institution - both trading positions and long term exposures; and (ii) calculating and monitoring the resultant economic capital, as well as the regulatory capital under Basel III — which, importantly, covers also leverage and liquidity — with regulatory capital as a floor.

Correspondingly, and broadly, the analytics are based as follows: For (i) on the "Greeks", the sensitivity of the price of a derivative to a change in its underlying factors; as well as on the various other measures of sensitivity, such as DV01 for the sensitivity of a bond or swap to interest rates, and CS01 or JTD for exposure to credit spread. For (ii) on value at risk, or "VaR", an estimate of how much the investment or area in question might lose as market and credit conditions deteriorate, with a given probability over a set time period, and with the bank then holding "economic"- or "risk capital" correspondingly; common parameters are 99% and 95% worst-case losses - i.e. 1% and 5% - and one day and two week (10 day) horizons. These calculations are mathematically sophisticated, and within the domain of quantitative finance.

The regulatory capital quantum is calculated via specified formulae: risk weighting the exposures per highly standardized asset-categorizations, applying the aside frameworks, and the resultant capital — at least 12.9% of these Risk-weighted assets (RWA) — must then be held in specific "tiers" and is measured correspondingly via the various capital ratios. In certain cases, banks are allowed to use their own estimated risk parameters here; these "internal ratings-based models" typically result in less required capital, but at the same time are subject to strict minimum conditions and disclosure requirements. As mentioned, additional to the capital covering RWA, the aggregate balance sheet will require capital for leverage and liquidity; this is monitored via the LR, LCR, and NSFR ratios.

The 2008 financial crisis exposed holes in the mechanisms used for hedging (see Fundamental Review of the Trading Book § Background, Tail risk § Role of the 2007–2008 financial crisis, Value at risk § Criticism, and Basel III § Criticism). As such, the methodologies employed have had to evolve, both from a modelling point of view, and in parallel, from a regulatory point of view.

Regarding the modelling, changes corresponding to the above are: (i) For the daily direct analysis of the positions at the desk level, as a standard, measurement of the Greeks now inheres the volatility surface — through local- or stochastic volatility models — while re interest rates, discounting and analytics are under a "multi-curve framework". Derivative pricing now embeds considerations re counterparty risk and funding risk, amongst others, through the CVA and XVA "valuation adjustments"; these also carry regulatory capital. (ii) For Value at Risk, the traditional parametric and "Historical" approaches, are now supplemented with the more sophisticated Conditional value at risk / expected shortfall, Tail value at risk, and Extreme value theory. For the underlying mathematics, these may utilize mixture models, PCA, volatility clustering, copulas, and other techniques. Extensions to VaR include Margin-, Liquidity-, Earnings- and Cash flow at risk, as well as Liquidity-adjusted VaR. For both (i) and (ii), model risk is addressed through regular validation of the models used by the bank's various divisions; for VaR models, backtesting is especially employed.

Regulatory changes, are also twofold. The first change, entails an increased emphasis on bank stress tests. These tests, essentially a simulation of the balance sheet for a given scenario, are typically linked to the macroeconomics, and provide an indicator of how sensitive the bank is to changes in economic conditions, whether it is sufficiently capitalized, and of its ability to respond to market events. The second set of changes, sometimes called "Basel IV", entails the modification of several regulatory capital standards (CRR III is the EU implementation). In particular FRTB addresses market risk, and SA-CCR addresses counterparty risk; other modifications are also being phased in.

To operationalize the above, Investment banks, particularly, employ dedicated "Risk Groups", i.e. Middle Office teams monitoring the firm's risk-exposure to, and the profitability and structure of, its various business units, products, asset classes, desks, and / or geographies. By increasing order of aggregation and time-horizon:

1. Financial institutions will set limit values for each of the Greeks, or other sensitivities, that their traders must not exceed, and traders will then hedge, offset, or reduce periodically if not daily; see the techniques listed below. These limits are set given a range of plausible changes in prices and rates, coupled with the board-specified risk appetite re overnight-losses.
2. Desks, or areas, will similarly be limited as to their VaR quantum (total or incremental, and under various calculation regimes), corresponding to their allocated economic capital; a loss which exceeds the VaR threshold is termed a "VaR breach".
3. RWA - the key Pillar I result - is correspondingly monitored from desk level and upward. Market-risk RWA will be monitored more frequently, with credit-risk RWA less so. While VaR is a risk-taking constraint (front office) RWA is a capital supply constraint (management + regulators); it does provide the denominator for the below ratios and feeds into other planning.
4. Each area's (or desk's) concentration risk will be checked against thresholds set for various types of risk, and / or re a single counterparty, sector or geography.
5. Leverage will be monitored, at very least re regulatory requirements via LR, the Leverage Ratio, as leveraged positions could lose large amounts for a relatively small move in the price of the underlying.
6. Relatedly, liquidity risk is monitored: LCR, the Liquidity Coverage Ratio, measures the ability of the bank to survive a short-term stress, covering its total net cash outflows over the next 30 days with "high quality liquid assets"; NSFR, the Net Stable Funding Ratio, assesses its ability to finance assets and commitments within a year (addressing also, maturity transformation risk). Any "gaps", also, must be managed.
7. Systemically Important Banks hold additional capital such that their total loss absorbency capacity, TLAC, is sufficient given both RWA and leverage. (See also "MREL" for EU institutions.)

Periodically, these all are estimated under a given stress scenario — regulatory and, often, internal — designed to assess whether the bank is "sufficiently capitalized to absorb losses during stressful conditions while meeting obligations to creditors and counterparties and continuing to be able to lend to households and businesses". Risk capital, together with these limits if indicated, is correspondingly revisited (or optimized). The approaches taken center either on a hypothetical or historical scenario, and may apply increasingly sophisticated mathematics to the analysis. More generally, these tests provide estimates for scenarios beyond the VaR thresholds, thus “preparing for anything that might happen, rather than worrying about precise likelihoods". A reverse stress test, in fact, starts from the point at which "the institution can be considered as failing or likely to fail... and then explores scenarios and circumstances that might cause this to occur".

Economic Capital (EC) goes further, reflecting the total risk capital that the bank requires to cover "all" its risks as a going concern assessed on a realistic basis, including survival in a worst-case scenario. It is calibrated to a specific confidence level (e.g., 99.9%) over a one-year horizon, a further distinction re regulatory capital. The modelling - at least once annually - must be such that any material risks are adequately and conservatively quantified: banks typically deploy detailed (long run) simulations and coupled stress testing, aggregating credit, market, operational, and business risk, while accounting for diversification. The balance-sheet composition is naturally revisited as part of the assessment. Although essentially an internal measure, EC will be (re)viewed by the Regulator under Pillar II and, as above, is governed by ICAAP, the framework for the bank's "internal capital adequacy assessment process".

A key practice, incorporating and assimilating much of the above, is to assess the Risk-adjusted return on capital, RAROC, of each area (or product). Here, "economic profit" is divided by allocated-capital; and this result is then compared to the target-return for the area — usually, at least the equity holders' expected returns on the bank stock — and identified under-performance can then be addressed. (See similar below re. DuPont analysis.) The numerator, risk-adjusted return, is realized trading-return less a term and risk appropriate funding cost as charged by Treasury to the business-unit under the bank's funds transfer pricing (FTP) framework; direct costs are (sometimes) also subtracted. The denominator is the area's allocated capital, as above, increasing as a function of position risk; several allocation techniques exist. RAROC is calculated both ex post as discussed, used for performance evaluation (and related bonus calculations), and ex ante - i.e. expected return less expected loss - to decide whether a particular business unit should be expanded or contracted.

Other teams, overlapping the above Groups, are then also involved in risk management. Corporate Treasury is responsible for monitoring overall funding and capital structure; it shares responsibility for monitoring liquidity risk, and for maintaining the FTP framework. Middle Office maintains the following functions also: Product Control is primarily responsible for ensuring traders mark their books to fair value — a key protection against rogue traders — and for "explaining" the daily P&L; with the "unexplained" component, of particular interest to risk managers. Credit Risk monitors the bank's debt-clients on an ongoing basis, re both exposure and performance; while (large) exposures are initially approved by an "investment committee". In the Front Office — since counterparty and funding-risks span assets, products, and desks — specialized XVA-desks are tasked with centrally monitoring and managing overall CVA and XVA exposure and capital, typically with oversight from the appropriate Group. "Stress Testing" is similarly centralized.

Performing the above tasks — while simultaneously ensuring that computations are consistent over the various areas, products, teams, and measures — requires that banks maintain a significant investment in sophisticated infrastructure, finance / risk software, and dedicated staff. Risk software often deployed is from FIS, Kamakura, Murex, Numerix (FINCAD) and Refinitiv. Large institutions may prefer systems developed entirely "in house" - notably Goldman Sachs (SecDB), JP Morgan (Athena), Jane Street (Core), Barclays (BARX), BofA (Quartz), Citadel (Apollo), Morgan Stanley (SecMaster) - while, more commonly, the pricing library will be developed internally, especially as this allows for currency re new products or market features.

Commercial and retail banking

Commercial and retail banks are, by nature, more conservative than Investment banks, earning steady income from lending and deposits; their focus is more on the "banking book" than the "trading book". The biggest concern here - as mentioned - is the credit risk due to loan defaults from individuals or businesses. Liquidity risk - in this context deposit risk, i.e. not having enough liquid assets to meet withdrawal demands - is also a major focus; while interest rate risk concerns the impact of interest rate changes on net interest margins (the spread between deposit and loan rates).

For these banks, regulatory oversight is often tighter due to their direct impact on the financial system. Thus they are also highly regulated under Basel III and national banking laws, and will also be subject to regular stress testing by central banks; and all regulations above then apply (with local exceptions; e.g. an LCR "threshold" in the US). Additional to these, however, they must maintain high capital and liquidity ratios to protect depositors; see CAMELS rating system.

Given their business model and risk appetite, as outlined, various differences result vs risk management at investment banks.

• Banks here maintain specific (and often additional) capital buffers to cover potential loan losses; reflected also in the fact that retail and commercial loans usually attract higher RWA results than for assets typical in investment banking. See, e.g., the ALLL and NPL ratios.
• At the same time, credit exposure for these banks is to significantly more clients than at investment banks. For retail banks, "consumer credit risk" is often diversified across a vast number of borrowers, and these employ statistical models for (ongoing "behavioral") credit scoring and probability of default. Commercial banks deal with mid-sized corporate loans and bonds, and apply accounting- and financial analysis to determine creditworthiness; the approach differs re investment banking in that the broad client base allows for (necessitates) automation, with close monitoring on an exception basis. AI / ML is increasingly employed at all stages.
• Concentration risk, relatedly, differs in its management: the concern is sector concentration as opposed to "name concentration". Here, in calculating VaR for a credit portfolio, banks will incorporate a joint default probability for the various sectors and / or industries.
• Both retail and commercial banks employ strict liquidity management to ensure enough cash for customer withdrawals: at a minimum meeting the above NSFR and LCR requirements; but also complying with their regulator's reserve requirement. See also liquidity at risk.
• Both use interest rate hedging (e.g., swaps) but here, in the main, to protect their profit margin against rate fluctuations, and the resultant "margin compression"; i.e., as opposed to addressing market risk per se. Re the latter, they will often employ the abovementioned cash flow at risk and earnings at risk models. They also hold specific capital for interest rate risk in the banking book, "IRRBB", which deals with the risks associated with a change in interest rates, including interest rate gaps, basis risk, yield curve risk, and option risk.
• Banks' Economic Capital models, here, are focused more on credit- and operational risk. ICAAP applies; although allows for modelling which may be simpler, and with less stringent review by regulators.

The Risk Management function typically exists independent of operations - although may sit in Treasury - and reports directly to the board. Its scope often extends to non-financial operational and reputational risk (monitoring for any consequent run on the bank). Specialised software is employed here, both operationally and for risk management and modelling.

Corporate finance

In corporate finance, and financial management more generally, financial risk management, as above, is concerned with business risk - risks to the business’ value, within the context of its business strategy and capital structure. The scope here - ie in non-financial firms - is thus broadened (re banking) to overlap enterprise risk management, and financial risk management then addresses risks to the firm's overall strategic objectives, incorporating various (all) financial aspects of the exposures and opportunities arising from business decisions, and their link to the firm’s appetite for risk, as well as their impact on share price. In many organizations, risk executives are therefore involved in strategy formulation: "the choice of which risks to undertake through the allocation of its scarce resources is the key tool available to management." Relatedly, strategic projects and major corporate investments must first undergo thorough analysis, with approval by an Investment Committee.

Re the standard framework, then, the discipline largely focuses on operations, i.e. business risk, as outlined. Here, the management is ongoing — see following description — and is coupled with the use of insurance, managing the net-exposure as above: credit risk is usually addressed via provisioning and credit insurance; likewise, where this treatment is deemed appropriate, specifically identified operational risks are also insured. Market risk, in this context, is concerned mainly with changes in commodity prices, interest rates, and foreign exchange rates, and any adverse impact due to these on cash flow and profitability, and hence share price.

Correspondingly, the practice here covers two perspectives; these are shared with corporate finance more generally:

1. Both risk management and corporate finance share the goal of enhancing, or at least preserving, firm value. Here, businesses devote much time and effort to (short term) liquidity-, cash flow- and performance monitoring, and Risk Management then also overlaps cash- and treasury management, especially as impacted by capital and funding as above. More specifically re business-operations, management focuses on their break even dynamics, safety margins, contribution margin and operating leverage; along with the corresponding monitoring and management of revenue, of costs, and of other budget elements. The DuPont analysis entails a "decomposition" of the firm's return on equity, ROE, allowing management to identify and address specific areas of concern, preempting any underperformance vs shareholders' required return. In larger firms, specialist Risk Analysts complement this work with model-based analytics more broadly; in some cases, employing sophisticated statistical models, in, for example, financing activity prediction problems, and for risk analysis ahead of a major investment.
2. Firm exposure to long term market (and business) risk is a direct result of previous capital investment decisions. Where applicable here — usually in large corporates and under guidance from their investment bankers — risk analysts will manage and hedge their exposures using traded financial instruments to create commodity-, interest rate- and foreign exchange hedges (see further below). Because company specific, "over-the-counter" (OTC) contracts tend to be costly to create and monitor — i.e. using financial engineering and / or structured products — "standard" derivatives that trade on well-established exchanges are often preferred. These comprise options, futures, forwards, and swaps; the "second generation" exotic derivatives usually trade OTC. Complementary to this hedging, periodically, Treasury may also adjust the capital structure, reducing financial leverage - i.e. repaying debt-funding - so as to accommodate increased business risk; they may also suspend dividends.

Multinational corporations are faced with additional challenges, particularly as relates to foreign exchange risk, and the scope of financial risk management modifies significantly in the international realm (see below re geopolitical risk generally). Here, dependent on time horizon and risk sub-type — transactions exposure (essentially that discussed above), accounting exposure, and economic exposure — so the corporate will manage its risk differently. The forex risk-management discussed here and above, is additional to the per transaction "forward cover" that importers and exporters purchase from their bank (alongside other trade finance mechanisms).

Hedging-related transactions will attract their own accounting treatment, and corporates (and banks) may then require changes to systems, processes and documentation; see Hedge accounting, Mark-to-market accounting, Hedge relationship, Cash flow hedge, IFRS 7, IFRS 9, IFRS 13, FASB 133, IAS 39, FAS 130.

It is common for large corporations to have dedicated risk management teams — typically within FP&A or corporate treasury — reporting to the CRO; often these overlap the internal audit function (see Three lines of defence). For small firms, it is impractical to have a formal risk management function, but these typically apply the above practices, at least the first set, informally, as part of the financial management function; see discussion under Financial analyst.

The discipline relies on a range of software, correspondingly, from spreadsheets (invariably as a starting point, and frequently in total) through commercial EPM and BI tools, often BusinessObjects (SAP), OBI EE (Oracle), Cognos (IBM), and Power BI (Microsoft).

Insurance

Insurance companies make profit through underwriting — selecting which risks to insure, charging a risk-appropriate premium, and then paying claims as they occur — and by investing the premiums they collect from insured parties. They will, in turn, manage their own risks with a focus on solvency and the ability to pay claims: Life Insurers are concerned more with longevity risk and interest rate risk; Short-Term Insurers (Property, Health, Casualty) emphasize catastrophe- and claims volatility risks.

Fundamental here, therefore, are risk selection and pricing discipline, which as outlined, prevent insurers from taking on unprofitable business. For expected claims — i.e. those covered, on average, by the pricing model’s assumptions re claim frequency and severity — reserves are set aside (actuarial, with statutory reserves as a floor). These will cover both known claims, reported but unpaid, as well as those which are incurred but not reported (IBNR). To absorb unexpected losses, insurance companies maintain a minimum level of capital plus an additional solvency margin. Capital requirements are based on the risks an insurer faces, such as underwriting risk, market risk, credit risk, and operational risk, and are governed by frameworks such as Solvency II (Europe) and Risk-Based Capital (U.S.). To further mitigate large-scale risks — i.e. to reduce exposure to catastrophic losses — insurers transfer portions of their risk to Reinsurers. Here, analogous to VaR for banks, insurers use simulations to estimate potential losses at various thresholds, while stress tests assess how extreme events might impact capital and reserves under various scenarios. (Dynamic financial analysis (DFA) and the Wilkie model are used generally in scenario analytics, and may underpin the VaR engine.) In parallel with all these, as above, premiums collected are invested to generate returns which will supplement underwriting profits, and the fund is then risk-managed as follows: ALM must ensure that investments align with the timing and amount of expected claim payouts; while returns ("float") are defended using the techniques discussed in the next section. As for banks, all models are regularly reviewed, comparing, i.a., "Actual versus Expected".

Specific treatments will, as outlined, differ by insurer-profile:

• Life Insurers deal with long-term risks tied to mortality, longevity, and interest rates. Policies (e.g., whole life, annuities) can span decades, making them sensitive to long-term economic and demographic shifts. Reserves are large and complex due to the long duration of liabilities, with capital models emphasizing longevity risk, interest rate risk, and lapse risk. Stress tests, correspondingly, focus on long-term scenarios (e.g. sustained low interest rates, or a pandemic related spike in mortality). Reinsurance is often used for excess death claims. ALM here is critical, and investments will be in long-term, stable assets (bonds as well as equities) to match these long-duration liabilities.
• Short-Term Insurers face more volatility relative to Life companies, while claims are typically resolved within a year or two (although tail events - e.g. asbestos litigation - can linger). Thus, reserves are shorter-term but must account for high uncertainty in claim frequency and severity; IBNR may be significant, especially after large events. Capital requirements focus on underwriting risk (e.g., mispricing policies) and catastrophe risk (e.g., hurricanes, earthquakes). Stress tests therefore emphasize short-term catastrophic scenarios, and specialized catastrophe models are often used. Reinsurance is widely utilized to cap exposure to catastrophes; as are quota-share or excess-of-loss treaties re single events. Rapid claims settlement reduces reserving duration compared to life insurance, and portfolios lean toward liquid, shorter-term assets (e.g., cash, short-term bonds).

In a typical insurance company, Risk Management and the Actuarial Function are separate but closely related departments, each with distinct responsibilities. In smaller companies, the lines might blur, with actuaries taking on some risk management tasks, or vice versa. Regardless, the Head Actuary (or Chief Actuary or Appointed Actuary) has specific responsibilities, typically requiring formal "sign-off": Reserve Adequacy and Solvency and Capital Assessment, as well as Reinsurance Arrangements.

The relevant calculations are usually performed with specialized software — provided e.g. by WTW and Milliman — and often using R or SAS.

Investment management

Fund managers, classically, define the risk of a portfolio as its variance (or standard deviation) — the extent to which the portfolio's return is uncertain — and through diversification the portfolio is optimized so as to achieve the lowest risk for a given targeted return, or equivalently the highest return for a given level of risk: this approach is known as mean-variance optimization. (The collection of these risk-efficient portfolios form the "efficient frontier"; see Markowitz model.) The logic here is that returns from different assets are highly unlikely to be perfectly correlated, and in fact the correlation may sometimes be negative. In this way, market risk particularly, and other financial risks such as inflation risk (see below) can at least partially be moderated by forms of diversification.

A key issue, however, is that the (assumed) relationships are (implicitly) forward looking. As observed in the late-2000s recession, historic relationships can break down, resulting in losses to market participants believing that diversification would provide sufficient protection (in that market, including funds that had been explicitly set up to avoid being affected in this way). A related issue is that diversification has costs: as correlations are not constant it may be necessary to regularly rebalance the portfolio, incurring transaction costs, negatively impacting investment performance; and as the fund manager diversifies, so this problem compounds (and a large fund may also exert market impact). See Modern portfolio theory § Criticisms.

The above mean-variance optimization is implemented (more or less) directly by asset allocation funds. At the same time - in part given the issues outlined - alternative methods for portfolio construction have been developed, including new approaches to defining risk, and to the optimization itself. Notably, managers will employ factor models — generically APT — using time series regression to design portfolios with the desired exposure to macroeconomic, market and / or fundamental risk factors; respectively: macro-, factor-, and style portfolios. The optimization, under both the mean-variance and factor model approaches, may be with respect to (tail) risk parity, focusing on allocation of risk, rather than allocation of capital, and employ, e.g. the Black–Litterman model which modifies the above "Markowitz optimization", to incorporate the "views" of the portfolio manager.

Alongside these, Discretionary investment management funds, instead, lean heavily on traditional stock picking, employing company specific ("bottom-up") fundamental analysis in preference to advanced mathematical approaches. (These Managers are then the major consumers of securities research.) The specific concerns will, in turn, differ as a function of the Manager's investment philosophy and active strategy, preferring, e.g., value-, growth- or defensive stocks within her fund; in all cases, reaching a target price can trigger a review or sale. Portfolios here are managed, also, using qualitative and subjective considerations, which include evaluations of company management, industry dynamics, and macro/political factors. Risk Management here, to be discussed below, will correspondingly, be largely pragmatic and heuristic, as opposed to quantitative.

An overarching consideration - i.e regardless of approach - is that the Manager must ensure that the portfolio's risk level matches the investor's objectives and comfort zone, i.e. must ensure risk tolerance alignment. Correspondingly, the fund's (advertised) investment strategy will, almost necessarily, define its own risk tolerance and appetite, and hence selection and application of optimization-criteria and risk management techniques (and investors). Here, for both individuals and Funds, generally, longer time horizons allow for greater tolerance of short-term volatility, while shorter horizons require more conservative strategies. A further generalization: portfolios constructed using mathematical-approaches are more exposed to market risk and the stock market cycle; while those constructed by stock picking are exposed, more, to firm and sector specific risks.

In measuring risk quantitatively, the Manager will employ a variety of financial risk modeling techniques — including value at risk, historical simulation, stress tests, and extreme value theory — to analyze the portfolio and to forecast the likely losses incurred for a selection of exposures and scenarios (see § Investment banking for discussion).

Guided by the analytics, and / or the above considerations, fund managers (and traders) will implement specific risk hedging techniques and strategies. As appropriate, these are applied to the portfolio as a whole ("top-down") or to individual holdings ("bottom-up"):

• To protect the overall portfolio, fund managers may sell the stock market index future or buy puts on the stock market index option; the respective sensitivities, portfolio beta and option delta, determine the number of hedge-contracts required. For both, the logic is that the (diversified) portfolio is likely highly correlated with the stock index it is part of: thus if the portfolio-value declines, the index will have declined likewise with the derivative holder profiting correspondingly. Fund managers may (instead) engage in "portfolio insurance", a dynamic hedging process that involves selling index futures during periods of decline and using the proceeds to offset portfolio losses.

• Fund managers, or traders, may also wish to hedge a specific stock's price. Here, they may likewise buy a single-stock put, or sell a single-stock future. Alternative strategies may rely on assumed relationships between related stocks, employing, for example, a "long/short" strategy.

• Bond portfolios, when e.g. a component of an asset-allocation fund or other diversified portfolio, are typically managed similar to equity above: the fund manager will hedge her bond allocation with bond index futures or options; with the number of contracts, a function of duration. Managers may also employ duration management more generally to "immunize" the fund against undesired interest rate risk (often guided by a "DV01 target"), or against failing to meet a target return objective (e.g. a target date fund has an implicit liability to its investors). See below re liquidity management; also liability-driven investment strategy, duration gap, laddering.

• For individual bonds and other fixed income securities, specific credit and interest rate risks can be hedged using interest rate- and credit derivatives (although with care, under multi-curves ). Sensitivities re interest rates are measured using duration and convexity for bonds, and DV01 and key rate durations generally, and an offsetting derivative-position is purchased. For credit risk, sensitivities are measured via CS01, while analysts use models such as Jarrow–Turnbull and KMV to estimate the (risk neutral) probability of default, hedging where appropriate, usually via credit default swaps. Probabilities (actuarial) may also be obtained from Bond credit ratings; then, often at a portfolio level — e.g. for credit-VaR — analysts will use a transition matrix of these to estimate the probability and impact of a "credit migration", aggregating the bond-by-bond result. Interest rate- and credit risk together, may be hedged via a Total return swap. See Fixed income analysis

• For derivative portfolios, and positions, the Greeks are a vital risk management tool: as above, these measure sensitivity to a small change in a given underlying price, rate, or parameter, and the portfolio is then rebalanced accordingly by including additional derivatives with offsetting characteristics, or by purchasing or selling specified units of the underlying security.

Further, and more generally, various safety-criteria may also inform overall portfolio composition, both at initial construction and, in this context, as a risk overlay. The Kelly criterion will suggest - i.e. limit - the size of a position that an investor should hold in her portfolio. Roy's safety-first criterion minimizes the probability of the portfolio's return falling below a minimum desired threshold. Chance-constrained portfolio selection similarly seeks to ensure that the probability of final wealth falling below a given "safety level" is acceptable.

Managers likewise employ the abovementioned factor models on an ongoing basis to measure exposure to the relevant risk factors. Ahead of an anticipated movement in any of these, the Manager may then, as indicated, reduce holdings, hedge, or purchase offsetting exposure. Thus a factor-based fund may "tilt" from momentum to value, a style-based fund from cyclical to defensive. Risk management for asset allocation funds is, similarly, both proactive and reactive: guided by economic forecasts, a diversified fund could, allocation-strategy dependent (tactical, dynamic, or strategic) rebalance its asset allocation from e.g. equities to bonds. In all cases here, the Risk Manager may impose a limit on the relevant factor-, asset-, or country exposure.

Parallel to the aforementioned concerns, managers — active and passive — periodically monitor and manage tracking error, i.e. underperformance vs a "benchmark". Here, they will use attribution analysis preemptively so as to diagnose the source early, and to take corrective action: realigning, often factor-wise, on the basis of this "feedback". As relevant, they will similarly use style analysis to address style drift. See also Fixed-income attribution and Benchmark-driven investment strategy.

In preference to the approaches above, Managers of Discretionary Funds, will, as mentioned, rely largely on insight when managing portfolio risk. Here, they will closely monitor company-level risks, industry dynamics, and macro-factors, and will then reduce exposure, or hedge, based on any perceived risks. The weight attached to the various concerns will differ given the strategy employed: value funds, for example, focus on changes in firm fundamentals (but otherwise will "buy and hold"); while growth funds are exposed to both market (beta) and sector returns. In parallel, these Managers apply (practice derived) position-level stop loss rules, as well as portfolio-level construction limits re max position size, sector exposure, country or currency exposure, and benchmark-relative tracking error. As a supplement, Managers (at larger institutions) may use various of the above quantitative tools to monitor risk exposures and potential losses.

Regardless of approach, all Managers - especially those with long horizons - must ensure a positive real growth rate, i.e. that their portfolio-returns at least match inflation (and regardless of market returns). Since this phenomenon impacts all securities, inflation risk will typically be managed at the portfolio level. Here the manager will programmatically (or heuristically) increase exposure to inflation-sensitive stocks (e.g. consumer staples) and / or invest in tangible assets and commodities, as well as inflation swaps and inflation-linked bonds (ILBs). The latter inflation derivatives can, in fact, provide a direct inflation hedge: to fully offset inflation, the proportion of the portfolio in ILBs, for example, will correspond to its inflation beta (sensitivity of portfolio return to increases in inflation, measured using regression). See Inflation hedge § Portfolio construction.

Newer and broader, and often qualitative risks, are similarly managed industry-wide. These include ESG risks (financially material risks related to the broader environmental, social, and governance contexts in which the firm operates), cybersecurity risks (a material drop in share prices caused, e.g., by a significant ransomware incident) and geopolitical risks. These risks are often less tangible and less immediately visible than traditional financial risks, and quantifying these can be challenging. Managers may then employ techniques such as scenario analysis, and, sometimes, approaches from game theory. Based on this, in the case of geopolitical risks they will then diversify geographically and / or increase exposure (possibly factor-wise) to macro-sensitive assets such as gold, oil, and Bitcoin. (See Global macro.) ESG and cybersecurity risks are dealt with by diversification, and (for bottom-up portfolios) proactive screening, with direct management engagement as necessary. The rise of alternative investments (e.g., cryptocurrencies, private equity) introduces unique risks that must also be addressed.

Beyond market volatility, investment management requires rigorous control of liquidity, operational, and leverage risks (the concerns mirroring those discussed above re banking). Liquidity risk management ensures that a fund can meet redemption requests or rebalance portfolios without incurring excessive transaction costs, typically by maintaining cash buffers or limiting holdings in illiquid assets; this is closely tied to leverage concerns, where borrowed capital magnifies losses (as outlined above) and introduces the risk of margin calls or forced liquidation. Operational and counterparty risks—the potential for failure in internal systems, trade execution, or default by a trading partner—are mitigated through robust reconciliation processes, segregation of duties, and collateral agreements. Note that the controls here, will, in their turn, impose constraints on any portfolio holdings; see Portfolio optimization § Optimization constraints.

These concerns differ significantly by fund structure. Hedge funds often employ high leverage and hold illiquid assets to boost returns, managing the associated risks through "lock-up" periods that restrict withdrawals; in contrast, mutual funds and ETFs typically face regulatory limits on leverage and must provide daily liquidity, necessitating stricter risk controls to prevent asset-liability mismatches. Unlike institutional managers, discretionary managers and retail brokers manage liquidity by holding cash and blue-chip assets for immediate access, and avoiding or (strictly) limiting leverage; operational and counterparty risks are largely outsourced to clearing houses and protected by, e.g., SIPC insurance, prioritizing regulatory safety over complex hedging strategies. Pension funds are, as above, specifically concerned re any asset–liability mismatch, and will employ interest rate immunization or cashflow matching, respectively attempting to offset changes in liabilities with corresponding changes in asset value, or by matching cash outflows - i.e., financial obligations - with cash inflows and asset growth over a given time horizon; see dedicated portfolio.

While portfolio risks are managed day-to-day by the fund manager, the Chief Risk Officer - often Chief Investment Officer - is responsible for overall risk. The Risk Function ("Group" at an IB, as above) thus monitors aggregate firm-level risks (exposure across funds, as well as, e.g., reputational risk) ensuring alignment with the firm's risk appetite and regulatory obligations; it will, relatedly, be involved in scenario generation - economic and geopolitical - and stress testing. This team also provides independent challenge and escalation if a fund breaches its Risk Budget (e.g. VaR, stress losses and sector concentration). The CRO typically signs off on stress testing, liquidity risk reviews, and model validation.

Given the complexity of these analyses and techniques, Fund Managers - and Risk Analysts - typically rely on sophisticated software (as do banks, above). Widely used platforms are provided by BlackRock (Aladdin), Refinitiv (Eikon), Finastra, Murex, Numerix, MPI, Morningstar, MSCI (Barra), SimCorp (Axioma), SS&C Advent and State Street (Charles River).