Updated for the 2026-2027 CFA® Level I curriculum.
Every risk decision starts with a measurement. Before a portfolio manager can decide whether to hedge, insure, diversify, or simply live with a risk, that risk has to be sized up in some way, either through judgment or through numbers.
This note covers how to measure risk in a portfolio and how that measurement points to the right response. Level I tests this connection directly: given a described exposure, you need to pick the response that fits.
Quick Answer
Measuring risk means estimating how likely a loss is and how large it could be, using qualitative judgment, quantitative tools, or both. Modifying risk means choosing a response once that exposure is measured: avoid it, accept it, transfer it, or mitigate it.
The two steps work as a pair. A manager measures the exposure first, then matches it to a response based on cost, liquidity, and how much risk remains after acting. Level I questions often describe a scenario and ask which response fits the measured risk.
Key Takeaways About Measuring and Modifying Risk Exposures
Risk measurement combines qualitative judgment (probability and impact ratings) with quantitative tools (sensitivity measures, scenario analysis, and loss estimates).
A probability risk matrix maps likelihood against impact to sort exposures into categories like monitor, mitigate, or transfer.
The four core responses are avoid, accept, transfer, and mitigate. Each fits a different combination of severity and available tools.
Transfer reduces exposure but rarely removes it completely. Basis risk and counterparty risk remain.
The right response depends on cost, liquidity of the hedging instrument, and the residual risk left after acting, not just on the size of the exposure.
Level I questions typically test whether you can match a described risk profile to the correct response, not whether you can build a full quantitative model.
What You Need to Know for CFA Level I
Distinguish qualitative risk measurement (ratings, judgment) from quantitative risk measurement (probability, impact, sensitivity, scenario loss estimates).
Know what probability, impact, exposure, and sensitivity each describe, and how they combine to size up a risk.
Understand how a risk matrix or probability risk matrix sorts exposures by likelihood and severity.
Know the four risk responses (avoid, accept, transfer, mitigate) and recognize which one fits a given scenario.
Understand at a general level how derivatives, insurance, diversification, and internal controls are used to modify risk. You do not need pricing models.
Recognize that cost, liquidity, basis risk, and model risk all affect which method a manager actually chooses.
How to Measure Risk in a Portfolio Before Choosing a Response
Risk measurement is not one technique. It is a mix of judgment and calculation, and Level I expects you to recognize both.
Qualitative and Quantitative Risk Measurement
Qualitative measurement relies on judgment. An analyst rates a risk as low, medium, or high based on experience, expert opinion, or comparison to similar past events. This is common for risks that are hard to quantify, such as reputational damage or regulatory change.
Quantitative measurement relies on data and calculation. It includes probability estimates, sensitivity measures (such as duration or beta), and modeled loss estimates. Quantitative measurement is more precise, but it depends on assumptions and historical data that may not hold in the future.
Most real risk management blends both. A manager might quantify a currency exposure using historical volatility, then apply qualitative judgment about whether current geopolitical conditions make that history less reliable.
Probability, Impact, Exposure, and Sensitivity
Four terms show up repeatedly in this LOS, and Level I expects you to keep them separate.
Term | What It Measures |
|---|---|
Probability | How likely the risk event is to occur |
Impact | How large the loss would be if the event occurs |
Exposure | The portion of the portfolio affected by the risk |
Sensitivity | How much the portfolio's value changes per unit change in the risk factor |
Probability and impact combine to size the risk. Exposure tells you how much of the portfolio is at stake. Sensitivity tells you how responsive that exposure is to changes in the underlying risk factor, such as interest rates or exchange rates.
Risk Matrices and Scenario Analysis
A risk matrix, sometimes called a probability risk matrix or risk management matrix, plots probability on one axis and impact on the other. Each risk gets placed into a cell of the grid, and the cell suggests a general course of action.
Low Impact | Medium Impact | High Impact | |
|---|---|---|---|
Low Probability | Accept | Accept or monitor | Monitor |
Medium Probability | Accept or monitor | Mitigate | Mitigate or transfer |
High Probability | Monitor | Mitigate or transfer | Avoid or transfer |
Scenario analysis works alongside the matrix. Instead of a single probability and impact estimate, scenario analysis asks "what happens to the portfolio under this specific scenario," such as a rate spike or a currency devaluation. It gives a more concrete loss estimate than the matrix alone, without requiring a full statistical model.
Four Ways to Respond to a Measured Risk
Once a risk is measured, the manager chooses a response. Level I organizes these into four categories.
Avoid
Avoiding a risk means not taking the exposure at all, or exiting a position that carries it. This fits risks with high probability and high impact where no cost-effective hedge exists, or where the exposure offers little benefit relative to its risk.
Accept
Accepting a risk means taking no action beyond monitoring. This fits risks with low probability, low impact, or risks where the cost of modifying them exceeds the expected benefit.
Transfer
Transferring a risk shifts it to another party, usually through insurance or derivatives such as options, forwards, or swaps. Transfer reduces exposure but does not eliminate it. Basis risk (the hedge does not move exactly with the exposure) and counterparty risk both remain.
Mitigate
Mitigating a risk reduces its probability or impact without fully removing it. Diversification, position limits, and internal controls are common mitigation tools. Equity risk management strategies often combine mitigation (reducing position size, diversifying across sectors) with transfer (buying protective options) rather than relying on one method alone.
Choosing a Method: Cost, Liquidity, Basis, and Model Considerations
The measured severity of a risk narrows the choice, but four practical factors decide the final method.
Decision framework:
Measure the exposure (qualitative rating and/or quantitative probability, impact, sensitivity).
Compare the measured exposure to the portfolio's risk tolerance.
If exposure exceeds tolerance, select a response: avoid, transfer, or mitigate.
Test the response against cost, liquidity, basis risk, and model risk.
Monitor the residual risk that remains after the response is in place.
Notation and terms used in this framework:
Exposure: dollar or percentage amount of the portfolio affected by the risk
Tolerance: the maximum loss or volatility the mandate allows
Residual risk: the risk remaining after a response is applied
Level I does not require a single memorized portfolio at risk formula. The concept, however, is straightforward and worth understanding in simple terms: a portfolio's risk at stake from one exposure can be approximated as the exposed value multiplied by the probability of loss and the expected severity of that loss.
This illustrates the logic behind the number, not a formula the exam requires you to compute from memory. What matters for Level I is understanding that a larger exposed value, a higher loss probability, or a more severe expected loss all push this estimate higher, and any of the three can justify a stronger response.
Worked Example: Matching Measurement to Response
Scenario: Elena manages a $50 million equity portfolio benchmarked to a small-cap index. One holding, a biotech company awaiting a drug trial result, represents 8% of the portfolio ($4 million). Elena assigns a medium-to-high probability to a negative trial outcome and estimates the stock could fall 25% if that happens. Her mandate limits expected loss from any single position to 1.5% of portfolio value. A three-month put option on the stock is available, liquid, and costs 3% of the hedged position's value.
Step 1: Measure the exposure
Exposed value:
Expected loss if the negative outcome occurs:
As a percentage of the total portfolio:
Step 2: Compare to risk tolerance
2% exceeds Elena's 1.5% single-position limit. The exposure is outside tolerance.
Step 3: Select a response
Full avoidance (selling the position) would create tracking error against the benchmark and realize transaction costs on a position Elena still believes in long term.
Full acceptance is not allowed under the mandate. Mitigate/transfer fits best: Elena keeps most of the position but buys puts on part of it to cap the downside.
Step 4: Test cost, liquidity, and basis risk
The put costs 3% of the hedged value, the options market for this stock is liquid, and because the option is written on the same stock, basis risk is minimal.
Step 5: Residual risk
Elena still bears losses below the put's strike price and pays the premium regardless of outcome. Model risk exists if the option's pricing assumptions do not hold in a fast-moving market.
The trial risk is too large to ignore but too disruptive to fully avoid. Buying puts on part of the position transfers the worst-case loss to the option seller while keeping the stock's upside and the portfolio's tracking characteristics intact.
Common Exam Traps
Choosing a hedge before identifying the exposure
Level I questions sometimes describe a hedge first. Always confirm what risk is being measured and how large it is before evaluating whether the hedge fits.
Assuming transfer removes all residual risk
Options, forwards, and insurance reduce exposure but leave basis risk, counterparty risk, or gaps in coverage. Full protection is rare.
Ignoring hedge cost and basis risk
A hedge that looks correct on exposure alone can still be wrong if its cost outweighs the benefit or if it does not move closely with the actual exposure.
Using a risk matrix as a precise quantitative model
A probability risk matrix sorts risks into general categories. It is not a substitute for an actual loss estimate or a pricing model, and exam questions may test whether you understand that limitation.
Practice Question
A portfolio manager identifies a foreign currency exposure with a 30% probability of an adverse move that would reduce portfolio value by $2 million. Using a probability risk matrix, the manager classifies this exposure as high probability, high impact. The manager wants to keep the underlying foreign position for its diversification benefit. A currency forward contract that would offset the exposure is available at low cost and trades in a liquid market.
Which response is most appropriate?
Avoid the exposure by liquidating the foreign currency position entirely.
Accept the exposure without modification because the diversification benefit outweighs the mapped risk level.
Mitigate the exposure by entering the currency forward contract while keeping the underlying position.
Correct Answer: C
The exposure is high probability and high impact, which calls for a strong response. A low-cost, liquid forward contract lets the manager offset the currency risk while keeping the underlying position and its diversification benefit. This matches the exposure to a response that fits both the risk matrix classification and the available tools.
Option A: Avoiding the position removes the diversification benefit entirely, which is unnecessary when a cheap, liquid hedge is available.
Option B: Accepting a high probability, high impact risk without modification ignores the risk matrix classification and the fact that a low-cost hedge exists specifically for this exposure.
Continue Your CFA Level I Prep With KeyPoint
Use structured lessons, practice questions, mock exams, and progress tracking to focus on the time you have left
FAQs About Measuring and Modifying Risk Exposures
What is the difference between measuring risk and modifying risk in a portfolio?
Measuring risk means estimating how likely a loss is and how large it could be. Modifying risk means acting on that measurement by choosing to avoid, accept, transfer, or mitigate the exposure.
How do you use a probability risk matrix?
Plot the risk's probability against its impact on a grid. The cell it falls into suggests a general response, such as accept, monitor, mitigate, or transfer, though it does not replace a detailed loss calculation.
Does transferring a risk always remove it completely?
No. Transfer tools like insurance and derivatives reduce exposure but usually leave some basis risk or counterparty risk in place.
Is there one official portfolio at risk formula tested at Level I?
No. Level I focuses on the concept that exposed value, loss probability, and loss severity together determine how much risk a position carries, rather than a single memorized formula.