The credit worthiness of the retail customer is certainly a factor for the bank to consider as it will need to price the loan to cover the expectation of default. At the same time, it will need to look at other loans in its portfolio as to avoid unacceptable concentration risk. A corollary of the same theme is that the bank will need to take a portfolio view of the loan request and consider its contribution to total portfolio risk. Therefore all the choices are appropriate considerations for the bank and Choice ' d ' is the correct answer.

Statement I is not correct as VaR does not set an upper limit on losses. In this case, the bank expects the losses to exceed $253m 5% of the times, and the VaR number does not indicate any theoretical maximum amount of losses. Statement II is incorrect as there is a 95% (and not 5%) probability that the bank ' s losses will not exceed $253m Statement III is correct and describes VaR. Statement IV is incorrect, as regulatory capital is a more complex computation for which VaR is only one of the various input. Therefore Choice ' b ' is the correct answer.

An interesting property that distinguishes the three most used distributions for modeling event frequency is that for a given mean, their variances differ. The ratio of variance to mean (the variance-mean ratio, calculated as variance/mean) can then be used to decide the kind of distribution to use. Both the variance and the mean can be estimated from available data points from the internal or external loss databases, or the scenario exercise.

The variance-mean ratio reflects how dispersed a distribution is. (In the PRMIA handbook, the variance to mean ratio has been described as the " Q-Factor " .)

The Poisson distribution has its mean equal to its variance, and therefore the variance to mean ratio is 1. For the negative binomial distribution, this ratio is always greater than 1, which means there is greater dispersion compared to the mean - or more intervals with low counts as well as more intervals with high counts. For the binomial distribution, the variance to mean ratio is less than one, which means it is less dispersed than the Poisson distribution with values closer to the mean.

In a situation where operational risk events are seen as clustering together, or dependent, the variance will be higher and it would be more appropriate to use the negative binomial distribution.

The peaks-over-threshold model is used when losses over a given threshold are recorded, as is often the case when using data based on external public sources where only large loss events tend to find a place. The generalized Pareto distribution is also used when attempting to model loss severity using EVT. Lognormal mixtures and generalized hyperbolic distributions are not used as extreme value distributions.

Choice ' d ' is the correct answer.

Measures of risk sensitivity include delta, gamma, vega, PV01, convexity and CR01, among others. They allow approximating the change in the value of a portfolio from a change (generally small) in one of the underlying risk factors.

Risk sensitivity measures are derivatives of the value of the portfolio, calculated with respect to the risk factor. Some risk sensitivity measures are second derivatives, and allow a more precise calculation of the change in the value of the portfolio. Many risk sensitivities are represented by Greek letter, but not all.

Delta (δ) is a measure of the change in portfolio value based on a 1% change in the value of the underlying. Gamma (γ) is a second order derivative that improves the calculation as part of a Taylor expansion. CR01 is a measure of the change due to a 1 basis point change in the credit spread. PL01 is not a measure of any kind of risk sensitivity, it does not mean anything.

If VaR is calculated based upon historical simulations, and these simulations are designed as to include all stress scenarios of interest, then VaR and stress tests can be a part of an integrated risk measurement system. Therefore it is not correct to say that stress tests are always separately modeled from VaR and II is false. I and III are true, and therefore Choice ' d ' is the correct answer.

The probabilities of default of the two bonds are independent (as indicated by a zero default correlation). The various possible states of the portfolio are as follows:

First bond defaults, and the second does not: Probability * Loss = 0.03*0.92 * $50m = $1.38m

Second bond defaults, and the first does not: Probability * Loss = 0.97*0.08 * $50m = $3.88m

Both bonds default: Probability * Loss = 0.03*0.08 * $100m = $0.24m

Thus total expected loss on this portfolio = $5.5m. Since recovery rates are not provided, those should be assumed to be zero.

There is an easier way to solve this as well: default correlation does not affect expected losses, but their volatility. You can calculate the expected losses of the two bonds and add them up, ie, $50m*0.03 + $50m *0.08 = $5.5m

The actuarial or CreditRisk+ model considers default as an ' end of game ' event modeled by a Poisson distribution. The annual number of defaults is a stochastic variable with a mean of μ and standard deviation equal to √μ.

The probability of n defaults is given by (μ^n e^-μ) /n!, and therefore in this case is equal to (=2^4 * exp(-2))/FACT(4)) = 0.0902.

Note that CreditRisk+ is the same methodology as the actuarial approach, and requires using the Poisson distribution.

p = k/N. If there are N observations of which K are upto T, then p = k/N allows us to have a continuous unbroken curve which gets increasingly weighted towards the distribution selected for the tail as we move towards the ' right ' , ie the higher values of losses.

The other choices are incorrect and mostly nonsensical.

The point that this question is trying to emphasize is the independence of the risk management function. The risk function should be segregated from the risk taking functions as to maintain independence and objectivity.

Choice ' d ' , Choice ' c ' and Choice ' a ' run contrary to this requirement of independence, and are therefore not correct. The risk function should report directly to senior levels, for example directly to the audit committee, and not be a part of the risk taking functions.