Risk & Risk Management
Every risk measure is a summary, and every summary discards something. The exam tests whether you know what each one discards — and which risk it cannot see at all.
The VaR family
Value at risk answers one question: over a stated horizon and at a stated confidence level, what loss will not be exceeded? Three ways to compute it, each with a different failure mode.
(delta-normal)
Scaling and interpretation. Under an i.i.d. assumption, VaR scales with √T — an assumption that fails when returns are serially correlated, which is exactly the case for smoothed alternative returns (there the true multi-period risk is higher than √T scaling suggests). Also be precise about what VaR is not: it is not a maximum loss, it says nothing about the size of losses beyond the threshold, and a 99% one-day VaR should be breached roughly two or three times a year — a model with zero exceptions is miscalibrated, not conservative.
Coherence, CVaR & higher moments
The four axioms of a coherent risk measure: monotonicity (a portfolio that always loses more is riskier), translation invariance (adding cash reduces risk by the amount of cash), positive homogeneity (doubling the position doubles the risk), and subadditivity (the risk of a combined portfolio cannot exceed the sum of the parts).
VaR fails subadditivity. For non-elliptical distributions — discrete default risk, options, credit portfolios — combining two positions can raise measured VaR, so VaR can penalise diversification and can be gamed by moving risk just beyond the confidence threshold. Conditional VaR (expected shortfall, expected tail loss) is the expected loss given that VaR is exceeded. It is coherent, it uses information from the whole tail, and it is convex — so mean-CVaR optimisation is a tractable linear program, whereas mean-VaR optimisation is non-convex and riddled with local optima. For fat-tailed alternative portfolios, CVaR is the better default.
Higher moments. Skewness measures asymmetry — most alternative strategies that earn a premium are negatively skewed, because they are effectively selling insurance. Excess kurtosis measures tail fatness. Reporting a Sharpe ratio for a strategy with strong negative skew is misleading, since the denominator treats upside and downside deviation identically; use Sortino, a drawdown-based ratio, or an explicit tail measure alongside it.
Drawdown measures deserve their own note: maximum drawdown, time to recovery, and the Calmar ratio speak directly to the institution's real constraint — the point at which a board loses its nerve or a redemption is forced. They are path-dependent and sample-dependent, so a maximum drawdown from a short history understates the plausible worst case.
Decomposing portfolio risk
Total risk tells you nothing about where the risk comes from. Three decompositions, each answering a distinct question:
Risk budgeting proceeds by setting a total risk budget, allocating it across strategies or factors by component contribution, and monitoring utilisation. Note the important structural point: capital weights and risk weights diverge dramatically once leverage and volatility differ across sleeves — a 5% allocation to a levered volatility strategy can consume 25% of the risk budget. Risk parity is the limiting case of budgeting: equalise every component's contribution.
Factor-based decomposition is usually more informative than asset-class decomposition, because it reveals that ostensibly different sleeves share a driver. The classic finding: an endowment portfolio spread across public equity, buyout, venture and opportunistic real estate has one dominant factor — equity risk — no matter how many boxes the allocation table contains.
Liquidity & counterparty risk
Two kinds of liquidity risk, and they correlate. Funding liquidity risk is the inability to meet obligations as they come due — margin calls, capital calls, redemptions, benefit payments. Market (asset) liquidity risk is the inability to transact size at a fair price, visible as bid-ask spread, market depth, and price impact. The spiral that matters: a price fall triggers margin calls (funding), forcing sales into a thin market (market), pushing prices down further. Model them jointly, never separately.
Measurement and management. Liquidity-adjusted VaR adds an explicit liquidation-cost term; time-to-liquidation analysis classifies the book into tiers (days / weeks / quarters / years); cash-flow stress tests project calls, distributions, spending and margin under adverse scenarios simultaneously. Management tools: liquidity budgets and floors, committed credit facilities, staggered fund terms, gates and side pockets at the fund level, and diversification of funding sources.
Counterparty risk. Exposure has two parts — current exposure (mark-to-market replacement cost today) and potential future exposure (how large it could become before maturity). Mitigants examined: netting agreements, collateral and CSAs with variation and initial margin, central clearing through a CCP, downgrade triggers, and limits on rehypothecation. Remember the two second-order effects: wrong-way risk, where exposure rises just as the counterparty's credit deteriorates (buying protection on a bank's affiliate), and the fact that collateralisation converts counterparty risk into liquidity risk, since variation margin must be funded in cash at short notice.
Prime broker risk for hedge funds specifically: asset segregation, rehypothecation rights, cross-margining, and the possibility that a PB failure freezes assets. Multiple prime brokers and clear custody arrangements are the standard mitigants — and are a core ODD question.
Operational & model risk
Operational risk is the risk of loss from inadequate or failed internal processes, people and systems, or from external events. It is the leading cause of catastrophic hedge fund failure — a larger share of fund closures trace to operational failure and fraud than to investment losses. Crucially, it is uncompensated: there is no risk premium for weak controls, so the only rational exposure is zero, which is why ODD carries a veto rather than a score.
Categories to be able to name: valuation and pricing errors; unauthorised trading and limit breaches; settlement and reconciliation failure; misappropriation of assets; inadequate segregation of duties; key-person dependency; cyber and business-continuity events; and regulatory or compliance breaches.
Model risk has three sources — the wrong model, the right model with wrong inputs, and the right model implemented incorrectly. In alternatives it appears in valuation of Level 3 assets, in risk models calibrated on benign samples, and in systematic strategies where the model is the product. Governance response: independent validation separate from the model's developers, documented assumptions and limitations, backtesting against realised outcomes, sensitivity analysis across plausible specifications, version control and change management, and pre-agreed criteria for switching a model off.
Stress testing & scenario analysis
Statistical measures estimate risk from the sample. Stress testing asks what happens outside it, which is where institutions actually fail. Three approaches:
The correlation assumption is the point. In a crisis, correlations across risk assets converge toward one and diversification disappears exactly when it is needed. Stress tests should therefore impose elevated correlations rather than estimate them from history. Include second-round effects: forced deleveraging by other holders, redemption cascades in crowded strategies, funding-market closure, and the withdrawal of dealer balance sheet.
For alternatives specifically: stress must run on cash flows as well as marks. A scenario that produces a survivable mark-to-market loss can still be fatal if it simultaneously triggers capital calls, halts distributions, and increases margin — the combination that broke over-committed endowments in 2008–09.
The risk management process
Measures are the easy half. The exam also tests risk management as a governed process, because the failures it studies were governance failures with adequate models attached.
Three lines of defence. The business owns its risk; an independent risk and compliance function sets the framework and challenges the business; internal audit tests that both work. The critical exam point is independence: a risk officer who reports to the portfolio manager is not a second line. The same logic drives operational diligence's insistence that valuation and cash movement sit outside the investment team.
Leverage and financing risk deserve separate treatment because they convert a survivable loss into a terminal one. Distinguish balance-sheet leverage (borrowed capital), notional leverage (derivative exposure per unit of capital), and embedded leverage (options, structured notes, levered funds). Then examine the funding: term of the financing versus term of the asset, margin terms and the counterparty's discretion to raise them, rehypothecation rights, and cross-default clauses. A portfolio financed overnight against assets that take months to sell is one margin call from liquidation regardless of its VaR.
Confusion pairs
Practice
Six multiple-choice questions in exam style, with the reasoning — not just the letter.
1. A portfolio has expected monthly return 0.8% and monthly volatility 3.0%. Using the parametric method and z = 1.65, the 95% one-month VaR as a percentage of value is closest to:
2. Which property does VaR lack, and what is the practical consequence?
3. A risk manager wants to know how much of current portfolio risk is attributable to the credit sleeve. The correct measure is:
4. A fund's monthly returns show first-order autocorrelation of 0.35. Scaling monthly volatility by √12 to obtain annual volatility will most likely:
5. An institution buys credit protection on a corporate borrower from a bank that is itself heavily exposed to the same sector. This is best described as:
6. Which risk should an allocator seek to minimise rather than budget for?
Constructed-response practice
Write these under time. Each outline is the shape the rubric rewards, not a model answer to memorise.
Prompt A (15 minutes). An endowment's risk report shows 99% one-month VaR of 4% of assets and describes the portfolio as "well diversified across nine asset classes". Critique the report and specify three additions you would require.
- Attack the measure: VaR says nothing about tail magnitude, is not coherent, and for a portfolio containing private assets is computed on smoothed inputs that understate volatility and correlation.
- Attack the diversification claim: nine asset-class boxes with one dominant factor is concentration, not diversification — require factor decomposition and component risk contributions.
- Addition 1: CVaR plus a de-smoothed input series, so tail losses and true correlations are visible.
- Addition 2: a joint cash-flow and mark-to-market stress test covering spending, capital calls, and a drawdown occurring together (the denominator effect).
- Addition 3: liquidity tiering with time-to-liquidation and a reverse stress test identifying what would breach the spending policy.
- Close on governance: state who reviews it, at what frequency, and what action thresholds trigger a response.
Prompt B (12 minutes). Distinguish funding liquidity risk from market liquidity risk, explain how they interact in a crisis, and describe two structural mitigants an institutional allocator can put in place in advance.
- Define both precisely, with an example of each specific to an alternatives portfolio (margin call vs inability to exit a fund interest).
- Describe the spiral explicitly as a feedback loop: price fall → margin call → forced sale into thin market → further price fall.
- Mitigant 1: a liquidity budget with tiered time-to-liquidation and a committed credit facility arranged before it is needed.
- Mitigant 2: structural — staggered fund maturities and diversified vintages, secondary-market relationships, and a deliberate over-commitment limit tested against a 2008-style scenario.
- Note what each mitigant costs (cash drag, facility fees, forgone return) so the answer is a trade-off, not a wish list.