A map of risk types · RiskAtoms Academy

By the end you will be able to

1Sort a firm's risks into a taxonomy of financial, insurance and non-financial risk types.
2Explain why a taxonomy matters: one owner and one way of measuring for each risk type.
3Recognise that risk types interact, and that some drivers, such as climate, cut across them.
4Find where each risk type sits on a bank's and an insurer's balance sheet.

Why it matters

When Silicon Valley Bank failed in 2023, was it market risk, liquidity risk or poor governance? All three, feeding each other. A firm can only manage what it has named, so the first job of risk management is a map.

Core explanation

One home for every risk

M2.1: What risk is showed what risk is and why firms manage it. In practice, “risk” is too big to manage as one thing. A bank's trader, its mortgage team and its IT department all face risk, but not the same risk, and not measured the same way. So every firm splits risk into types and writes the list down. That list is its risk taxonomy.

Think of a library. Every book goes on one shelf, the shelves have labels, and one librarian looks after each section. A risk taxonomy does the same for risks: each risk has one home, each home has a definition, and each has a named owner.

The map. Firms draw their own, but almost all share the same main types. They fall into three families:

Financial risks, from the positions the firm holds: market, credit (including counterparty) and liquidity risk.
Insurance risk, for insurers: the risk that claims, or how long people live, differ from what was priced and reserved for.
Non-financial risks, from how the firm is run: operational risk (with legal, conduct and cyber risk inside it), model risk, strategic risk and reputational risk.

ExploreThe main risk types

Click a risk type for its definition, its owner and how it is measured.

Market risk

The risk of loss from moves in market prices and rates: interest rates, equity prices, exchange rates, commodity prices and credit spreads.

Owner: Traders and the treasury own the positions; market risk management sets limits and measures them.

Measured with: Sensitivities, value at risk, expected shortfall and stress tests.

ExploreExample Group: where the risks sit

Pick a risk type to light up the lines that carry it. Pick a line to see why.

Example Bank plc

£ billions

Assets

Liabilities

Example Insurance SE

€ millions

Assets

Liabilities

Equity is left off: it is not a risk type, but the buffer that absorbs losses from all of them.

Three things stand out. Credit risk touches 86% of the bank's assets; loans alone are 60%. For the insurer, market risk touches 90% of its assets, and insurance contract liabilities make up 77% of its balance sheet. And the non-financial risks barely appear on any line: they live in processes, systems and decisions. All of them are absorbed by the same thin layer of equity: 6% of assets at the bank, 10% at the insurer.

Sort itWhich risk type?

Each of these happened somewhere in Example Group last year. File each one under its main risk type.

Rates rise and the bank's holding of fixed-rate government bonds loses value.
A property developer stops paying interest on its loan.
Wholesale lenders refuse to roll over £5bn of short-term funding.
A winter storm brings three times the usual number of home insurance claims.
A payments system update fails and customers cannot use their cards for a day.
An employee in the back office diverts client money to a personal account.
The credit scoring model was built on boom-year data and approves too many weak borrowers.
A rival app-only bank wins a third of the group's young customers in two years.

Where this goes next

This module gives each risk type one lesson. Level 3: Core Risk Disciplines gives each its own module, to measure and manage it in practice, and Level 4: Regulation, Capital & Accounting covers the capital and liquidity rules built on top.

The formal version

The main risk types at a glance

There is no single official taxonomy. Each firm writes its own, and supervisors check that it is complete. But the core types and their definitions are close to universal. The operational risk definition below is the one set by the Basel Committee; the others follow standard usage.

Risk type	Definition	Typical measure
Market risk	The risk of loss from moves in market prices and rates: interest rates, equity prices, exchange rates, commodity prices and credit spreads.	Sensitivities, value at risk, expected shortfall and stress tests.
Credit risk	The risk of loss because a borrower or counterparty fails to pay what it owes, or becomes less likely to pay.	Probability of default, loss given default, exposure at default and expected loss.
Liquidity risk	The risk of being unable to pay what is due on time without unacceptable cost, or of being unable to sell assets without a large price cut.	Cash flow gaps, survival horizons, the liquidity coverage and net stable funding ratios.
Insurance risk	The risk that claims and benefits on insurance policies cost more, or come sooner, than priced and reserved for.	Loss and combined ratios, reserve run-offs, catastrophe models and mortality tables.
Operational risk	The risk of loss from inadequate or failed internal processes, people and systems, or from external events. It includes legal risk.	Loss event data, key risk indicators, risk and control self-assessments and scenarios.
Strategic risk	The risk that the firm's plans or business model fail: wrong choices, poor execution, or a market that changes around it.	Business plans, earnings stress tests and scenario analysis.
Reputational risk	The risk that a loss of trust among customers, investors, staff or regulators costs the firm business or funding.	Mostly judgement: complaints, media and customer surveys, deposit and funding trends.
Model risk	The risk of loss from decisions based on models that are wrong or used wrongly.	A model inventory, risk tiers, validation findings and limits on model use.

Many firms add subtypes: counterparty risk under credit; interest rate risk in the banking book under market; conduct, legal, cyber and third-party risk under operational. Climate is usually a driver mapped onto all of these.

Worked example

One bad week, filed in the right boxes

A hedge fund that trades with Example Bank plc collapses after the shares it bet on fall sharply. Follow how the bank's risk team uses the taxonomy to file what happened. Try each step before you reveal it.

Classifying a client collapse

Step 1 of 5

1
What was the first cause?
A sharp fall in share prices: a market move. But the shares were the fund's, not the bank's, so the bank had no market loss of its own.

This pattern is close to what happened when Archegos Capital Management collapsed in 2021. Several large banks lost billions; L2.1.07: Landmark failures: SVB and Archegos tells that story.

Regulatory lens

Regulators write their own maps, and those maps shape how firms draw theirs.

Banks (Basel): Pillar 1 sets minimum capital by formula for credit, market and operational risk. Everything else, such as concentration risk, interest rate risk in the banking book and strategic risk, is covered by Pillar 2, where each bank assesses its own risks and the supervisor reviews them.
Insurers (Solvency II): the standard formula for capital is built from risk modules: market, counterparty default, life, health and non-life underwriting risk, intangible asset risk, and operational risk.
Globally: the IAIS Insurance Core Principles ask insurers to run enterprise risk management that covers all their material risks, and Basel asks the same of banks.

How these rules work in detail is the subject of Level 4: Regulation, Capital & Accounting.

Sparks

SparkOperational risk joined the map late

The first Basel Accord in 1988 set capital for credit risk only. Market risk was added by an amendment in 1996. Operational risk only got its own capital charge with Basel II in 2004, after losses such as the collapse of Barings in 1995 showed that a bank could be destroyed by what happens inside it.

SparkWhen a loss sits on the border

If a borrower lies about its accounts and the loan goes bad, is that credit or operational risk? Basel II settled it for capital: such boundary losses count as credit risk for capital, but banks still record them in their operational loss data, flagged, so the fraud pattern is not lost.

Key takeaways

A risk taxonomy gives every risk one home, one definition and one owner.
The main types: market, credit and liquidity risk (financial), insurance risk, and operational, model, strategic and reputational risk (non-financial).
The map decides who owns each risk, how it is measured, and how capital and limits are set.
Risk types interact: one event can travel from market to liquidity to credit to reputation.
Climate is usually treated as a driver that reaches the firm through the existing risk types.
On a bank's balance sheet credit risk dominates; on an insurer's, insurance and market risk do.

Reaction

Check what stuck

Glossary

Risk taxonomy: An agreed list of risk types, each with a definition, so that every risk a firm faces has exactly one home.
Financial risks: Risks that come from holding financial positions: market, credit and liquidity risk.
Non-financial risks: Risks that come from how the firm is run rather than from what it holds: operational, model, strategic and reputational risk.
Market risk: The risk of loss from moves in market prices and rates: interest rates, equity prices, exchange rates, commodity prices and credit spreads.
Credit risk: The risk of loss because a borrower or counterparty fails to pay what it owes, or becomes less likely to pay.
Liquidity risk: The risk of being unable to pay what is due on time without unacceptable cost, or of being unable to sell assets without a large price cut.
Insurance risk: The risk that claims and benefits on insurance policies cost more, or come sooner, than priced and reserved for.
Operational risk: The risk of loss from inadequate or failed internal processes, people and systems, or from external events. It includes legal risk.
Strategic risk: The risk that the firm's plans or business model fail: wrong choices, poor execution, or a market that changes around it.
Reputational risk: The risk that a loss of trust among customers, investors, staff or regulators costs the firm business or funding.
Model risk: The risk of loss from decisions based on models that are wrong or used wrongly.
Risk owner: The person or team accountable for a risk: for taking it within limits, measuring it and reporting it.
Risk driver: Something that causes losses through several risk types at once, such as climate change or a pandemic, rather than a risk type of its own.
Boundary loss: A loss that sits on the line between two risk types, such as a loan lost because of a fraud.
Pillar 1: The part of the Basel rules that sets minimum capital for credit, market and operational risk by formula.
Pillar 2: The part of the Basel rules where each bank assesses all its material risks, and its supervisor reviews them and can ask for more capital.

Deep Dives & Origins

Deep Dives

Crouhy, Galai and Mark, The Essentials of Risk Management, 2nd edition (McGraw-Hill, 2014), the chapters on the types of risk. Beginner.
Hull, Risk Management and Financial Institutions (Wiley), the opening chapters on banks, insurers and the risks they face. Intermediate.

Origins

Basel Committee on Banking Supervision (BCBS), The Basel Framework, chapters on scope (SCO), the supervisory review process (SRP) and operational risk (OPE).
BCBS, International Convergence of Capital Measurement and Capital Standards: A Revised Framework (Basel II), June 2006.
Directive 2009/138/EC (Solvency II), Articles 103 to 111 and Annex IV, on the standard formula.
IAIS, Insurance Core Principles, ICP 16: Enterprise Risk Management for Solvency Purposes.
COSO, Enterprise Risk Management: Integrating with Strategy and Performance, 2017.

Watch this lesson

Video version

Prefer to watch? The same lesson as a 10-minute video will sit here, made from this page's script.