8008 PRM Certification - Exam III: Risk Management Frameworks, Operational Risk, Credit Risk, Counterparty Risk, Market Risk, ALM, FTP - 2015 Edition Question and Answers

Unexpected loss for a credit portfolio refers to the excess of the VaR estimate over the average expected loss. The term 'unexpected loss' has this specific meaning in the context of credit risk, and not any other intuitive meaning. So if for a portfolio worth $100m expected losses are 4%, and the credit VaR at 99% is $12m, then unexpected losses at that VaR quintile are $8m. This is unrelated to actual realized losses versus expected losses.

Therefore Choice 'd' is the correct answer and the others are not.

Unexpected loss is used to determine the capital reserves to be maintained against a credit portfolio at a certain level of confidence.

When modeling operational loss frequency distribution (which, for example, may be based upon a Poisson distribution) and a loss severity distribution (for example, based upon a lognormal distribution), it is assumed that the frequency of losses and the severity of the losses are completely independent and do not impact each other. Therefore Choice 'a' is correct, and the others are not valid assumptions underlying the operational loss modeling.

Once each of these distributions has been built, a random number is drawn from each to determine a loss scenario. The process is repeated many times as part of a Monte Carlo simulation to get a the loss distribution.

The term 'group risk' has been defined in the FSA document 08/24 on stress testing as the risk that a firm may be adversely affected by an occurrence (financial or non-financial) in another group entity or an occurrence that affects ther group as a whole. These risks may occur through:

- reputational contagion,

- financial contagion,

- leveraging,

- double or multiple gearing,

- concentrations and large exposures (particularly intra-group).

Thus, the insurance sector may be considered a group, and a firm may suffer just because another group firm has had losses or reputational issues.

The FSA statement goes on to identify some elements of group risk as follows:

- intra-group exposures (credit or operational exposures through outsourcing or service arrangements, as well as more standard business exposures);

- concentration risks (from credit, market or insurance risks which could put a strain on capital resources across entities simultaneously);

- contagion (reputational damage, operational or financial pressures); and

- complex group structures (with dependencies, complex split of responsibilities and accountabilities).

Therefore Choice 'a' is the correct answer and the rest of the choices are incorrect.

Top down approaches rely upon available data such as total capital, income volatility, peer group information etc and attempt to imply the capital attributable to operational risk. They do not consider firm specific scenarios or causal factors. Bottom up approaches on the other hand attempt to determine operational risk capital based upon an identification and quantification of firm specific risks. Bottom up approaches help determine a traditional loss distribution from which capital requirements can be determined at a given level of confidence.

Therefore Choice 'd' is the correct answer.

Exposure for derivative instruments can vary significantly over the lifetime of the instrument, depending upon how the market moves. The potential future exposure represents the extremes, not the most likely outcome. The expected exposure is the most suitable measure for pricing the credit risk. Over time, as multiple transactions are entered into, the expectation (or the mean) will be realized - though individual transactions may have more or less by way of exposure.

The notional amount may not be relevant, though for loans it may be the most important contributor to the expected exposure. Mark-to-market will represent the exposure at a given point in time, but cannot be predicted nor be used to price the credit risk.

This situation represents one of the paradoxes in estimating severity that one needs to be aware of - the improvement in controls reduces the weight of the body/middle of the distribution and moves it towards the tails (as the total probability under the curve must stay at 100%) and the distribution becomes more heavy tailed. As a result, the 99.9th percentile loss actually increases. instead of decreasing, creating a counterintuitive result. Therefore the correct answer is that the capital required will increase.

If scenario analysis produces such a result, the analyst must question if the 1 in 100 year loss severity is still accurate. If the new control has reduced the severity in the body of the distribution, the question as to why the more extreme losses have not changed should be raised.

Stress events rarely play out in a well defined period of time, and looking back it is always difficult to put exact start and end dates on historical stress events. Even after that is done, the question arises as to what magnitude of a change in a particular risk factor (for example interest rates, spreads, or exchange rates) are reasonable to consider for the purposes of the stress test.

Statements I and III correctly identify the two approaches that are acceptable and used in practice - the risk manager can either take the maximum adverse move - from peak to trough - in the risk factor, or alternatively he or she could consider the change in the risk factor from the start of the event to the end as defined for the purposes of the stress test. Between the two, the approach mentioned in statement III is considered slightly superior as it produces more believable shocks.

Statement II is incorrect because we never want to consider the minimum, and statement IV is not correct as it is likely to generate a shock of a magnitude that is not plausible. Therefore Choice 'b' is the correct answer.

According to Basel II, in any given year, negative capital charges (resulting from negative gross income) in any business line may offset positive capital charges in other business lines without limit. Therefore Choice 'b' is the correct answer.

Choice 'd' represents a risk that does not arise from its holdings of mortgages. Therefore Choice 'd' is the correct answer.

All the other risks identified are correct - the bank faces interest rate, default and prepayment risks on its mortgages.

The probabilities of default of the two bonds are independent (as indicated by a zero default correlation). The various possible states of the portfolio are as follows:

First bond defaults, and the second does not: Probability * Loss = 0.03*0.92 * $50m = $1.38m

Second bond defaults, and the first does not: Probability * Loss = 0.97*0.08 * $50m = $3.88m

Both bonds default: Probability * Loss = 0.03*0.08 * $100m = $0.24m

Thus total expected loss on this portfolio = $5.5m. Since recovery rates are not provided, those should be assumed to be zero.

There is an easier way to solve this as well: default correlation does not affect expected losses, but their volatility. You can calculate the expected losses of the two bonds and add them up, ie, $50m*0.03 + $50m *0.08 = $5.5m

Managing liquidity requires understanding and providing for two things: the amount of liquidity needed to pay for all current obligations (in both normal and stressed scenarios), and determining the time horizon over which this liquidity should be available. The first is essentially a function of the business of the firm, and the assets and liabilities resulting from operations. The second considers other factors such as the speed with which new cash can be borrowed (eg, from the repo markets), the consequences are of running out of liquidity (eg, maybe only an overdrawn fee as opposed to bankruptcy), etc. In other words, liquidity risk management answers two questions: how much, and for how long.

This question asks for identifying the factors that affect the 'how much' part. Choice 'd', Choice 'c' and Choice 'b' do affect the determination of the liquidity needs of the firm. Choice 'a' does not affect the liquidity needs, but the 'how long' part. Choice 'a' is therefore the correct answer.

This is a tricky question in the sense no risk management professional can be expected to know the answer to this one unless they have read Chapter 2 of the PRMIA handbook. So this question appears purely for the sake of something you would need to know purely for the sake of the exam.

PRMIA's handbook classifies governance sructures as reactive, preventative and active. Reactive structures involve monitoring signals after the event leading to corrective actions. Preventative structures are forward looking and anticipate issues before they arise. Active structures include considerations of operational efficiency and not just governance. All other answers are made up phrases and are incorrect.

In reality, corporations employ all structures together without worrying about the boundary between the three, and these distinctions do not exist except in textbooks.

First of all, if prices are lognormally distributed, that implies the returns (which are equal to the log of prices) are normally distributed. To say that prices are lognormally distributed is just another way of saying that returns are normally distributed.

Since the correlation between the two securities is zero, this means their variances can be added. But standard deviations, or volatilities cannot be added (they will be the square root of sum of variances). VaR is nothing but a multiple of standard deviation, and therefore it is not additive if correlations are anything other than 1 (ie perfect positive, which would imply we are dealing with the same asset). Therefore VaR(A+B)=SQRT(VaR(A)^2 + VaR(B)^2). This implies the combined VaR of a portfolio with these two securities will be less than the sum of VaRs of the two individual securities.

Thus Choice 'c' is the correct answer and the other choices are wrong.

A break close, also called a 'mutual put', gives either party the right to terminate a transaction at market price at a given date, or dates in the future. These are usually availed of in longer dated transactions, eg 10 years and over. For example, a 15-year swap might have a mutual put in year 5, and every 2 years thereafter.

All other choices are incorrect.

The total value of the portfolio is $370 (=$100 + $120 + $150). The modified duration of the portfolio is the weighted average of the MDs of the different bonds, ie =(5 * 100/370) + (10 * 120/370) + (12 * 150/370) = 9.46.

This means that for every 1% change in interest rates, the value of the portfolio changes by 9.46%. Since the daily volatility of interest rates is 2%, the 95% confidence level move will be 1.65 * 2% = 3.30%. Thus, the VaR of the portfolio at the 95% confidence level will be 3.3 * 9.46% * $370 = $115.51.

All other answers are incorrect.

Explanation

If the risks are considered perfectly positively correlated, ie assumed to have a correlation equal to 1, the standard deviations can simply be added together. This gives the most conservative estimate of combined risk for capital calculation purposes. In practice, this is the assumption used most often.

If risks are uncorrelated, ie correlation is assumed to be zero, variances can be added or the standard deviation is the root of the sum of the squares of the individual standard deviations. This obviously gives a number lower than that given when correlation is assumed to be +1.

Similarly, assumptions of negative correlation, or any correlation other than +1 will give a standard deviation number that is smaller and therefore less conservative. Choice 'b' is the correct answer.

According to the first principle set out by the BCBS paper on stress testing, the Board has ultimate responsibility for the overall stress testing programme. Senior management is accountable for the implementation, management and oversight of the programme, but the overall responsibility stays with the Board of Directors of the institution. Therefore Choice 'c' is the correct answer.

Additionally, this principle lays down that stress testing should be a part of the overall governance, ie support the strategic choices made as part of business planning; and be integrated with the risk management culture of the bank, ie stress tests should be used as an input for setting the risk appetite, exposure limits, and the capital and liquidity planning processes of the bank.

Transition matrices are used for building distributions of the value of credit portfolios, and are the realized frequencies of migration from one credit rating to another over a period, generally one year. Therefore Choice 'd' is the correct answer.

Since they represent an actually observed set of values, they are not probabilities nor are they forward looking ex-ante estimates, though they are often used as proxies for probabilities. Choice 'a' and Choice 'c' are not correct. They include more than information on just defaults, therefore Choice 'b' is not correct.

All the factors listed above contributed to systemic failure. Liquidity risk was not on the radar of regulators, and was a second priority for risk managers, and most of the focus was on capital adequacy as liquidity was thought to be an unlikely problem. Liquidity, regardless of capital adequacy, was the primary cause of failure of a number of institutions during the crisis.

Similarly, stress tests proved to be much milder than the shocks that were actually experienced, and the strategy of 'originate and distribute' implied that the mortgage and other debt originators had no interest in any due diligence as they intended to package and sell the debt to other investors.

Therefore Choice 'd' is the correct answer.

High frequency and low severity risks, for example the risks of fraud losses for a credit card issuer, may have high expected losses, but low unexpected losses. In other words, we can generally expect these losses to stay within a small expected and known range. The capital requirement will be the worst case losses at a given confidence level less expected losses, and in such cases this can be expected to be low.

On the other hand, medium severity medium frequency risks, such as the risks of unexpected legal claims, 'fat-finger' trading errors, will have low expected losses but a high level of unexpected losses. Thus the capital requirement for such risks will be high.

It is also worthwhile mentioning high severity and low frequency risks - for example a rogue trader circumventing all controls and bringing the bank down, or a terrorist strike or natural disaster creating other losses - will probably have zero expected losses & high unexpected losses but only at very high levels of confidence. In other words, operational risk capital is unlikely to provide for such events and these would lie in the part of the tail that is not covered by most levels of confidence when calculating operational risk capital.

Note that risk capital is required for only unexpected losses as expected losses are to be borne by P&L reserves. Therefore the operational risk capital requirements for a low severity high frequency risk is likely to be low when compared to other risks that are lower frequency but higher severity.

Thus Choice 'c' is the correct answer.

According to the Basel II framework, Tier 1 capital, also called core capital or basic equity, includes equity capital and disclosed reserves.

Tier 2 capital, also called supplementary capital, includes undisclosed reserves, revaluation reserves, general provisions/general loan-loss reserves, hybrid debt capital instruments and subordinated term debt.

Tier 3 capital, or short term subordinated debt, is intended only to cover market risk but only at the discretion of their national authority.

The total variance of the system is 100^2 + 40^2 + 30^2 = 12500 (as variance = volatility squared). The first factor alone has a variance of 10,000, or 80%. Therefore only the first factor will be included in the final analysis, and the rest will be ignored.

Interestingly, this example highlights one of the limitations of PCA. Obviously, the second and third factors are material when considering volatility, though the effect of squaring them to get the variance makes them appear less important than they are.

The first two formulae describe component VaR. The last formula is the formula for Marginal VaR. Therefore I and II is the correct answer.

Component VaR is a VaR decomposition technique that allows the total VaR for a portfolio to be broken down and attributed to the components of a portfolio. The total of the component VaR for each constituent of a portfolio is equal to the VaR for the portfolio. This property is extremely useful as opposed to the standalone VaR for each constituent taken alone as it can be used for allocating trading budgets.

The commercial paper has greater credit risk as the entire notional is outstanding. On the forward contract, only the replacement value of the contract, which normally would be a mere fraction of the notional, would be at risk.

Therefore Choice 'd' is the correct answer.

Marginal liquidity gap measures the expected net change in liquidity over, say, a day. It is just equal to the liquidity inflow minus liquidity outflow. The cumulative liquidity gap measures the aggregate change in liquidity from a point in time, in other words it is just the summation of the marginal liquidity gap for each of the days included in the period under consideration. The residual liquidity gap goes one step further and adds available 'opening balance' of liquidity to the cumulative liquidity gap to reveal the days or times when the net liquidity is most at risk.

Liquidity at Risk measures the expected time to survival at a certain confidence level applied to the firm's cash flows - and is not a measure of the liquidity gap.

Therefore Choice 'a' is the correct answer.

The Basel II framework allows the use of the basic indicator approach, the standardized approach and the advanced measurement approaches for operational risk. There is no approach called the 'internal measurement approach' permitted for operational risk. Choice 'a' is therefore the correct answer.

If the marginal probability of default of two securities A and B is P(A) and P(B), then the probability of both of them defaulting together is affected by the default correlation between them. Marginal probability of default means the probability of default of each security on a standalone basis, ie, the probability of default of one security without considering the other security.

The relationship that expresses the probability of joint default of the two is given by the following expression:

It is easy to see that in a situation where the Default Correlation of A & B = 0, ie, the defaults are independent, the combined probability of default is P(A)*P(B), exactly what we would intuitively expect. Also in the other extreme case where the default correlation is equal to 1 and P(A) = P(B) = p, ie the securities behave in an identical way, the expression resolves to just p, which is what we would expect.

From the above relationship, it is clear that the probability of joint default of A and B is the greatest when default correlation between the two is equal to 1, ie the securities behave in an identical way. Therefore Choice 'a' is the correct answer.

Economic capital is a measure of the level of capital needed to maintain a desired credit rating. Regulatory capital is the amount of capital required to be held by regulation, and this may be quite different from economic capital. Book value is an accounting measure reflecting the assets minus liabilities as measured per accounting rules, this is often expressed per share. Shareholders' equity is a narrow term which is the amount of capital attributable to the shareholders and includes paid up capital and reserves but not long term debt or other non-equity funding.

Therefore Choice 'b' is the correct answer.

Note that events of default under the ISDA MA are caused by one of the parties that is considered 'at fault'. In contrast, "termination events" are events for which no one is at fault, for example changes in legislation, illegality etc that still justify termination of the transactions under the contract.

The ISDA MA describes the following 8 types of events of default:

1. failure of pay or deliver

2. breach of agreement

credit support default

4. misrepresentation

5. default under specified transaction

6. cross default

7. bankruptcy

8. merger without assumption

All of the options presented in the question are events of default.

The exact formula for VaR is = -(Zα σ + μ), where Z α is the z-multiple for the desired confidence level, and μ is the mean return. Now Zα is always a negative number, or at least will certainly be provided the desired confidence level is greater than 50%, and μ is often assumed to be zero because generally for the short time periods for which market risk VaR is calculated, its value is very close to zero.

Therefore in practice the formula for VaR just becomes -Zασ, and since Z is always negative, we normally just multiply the Z factor without the negative sign with the standard deviation to get the VaR.

For this question, there are two ways to get the answer. If we use the formula, we know that -Zασ= 250,000 (as μ=0), and therefore -Zασ - μ = 250,000 - 10,000 = $240,000.

The other, easier way to think about this is that if the mean changes, then the distribution's shape stays exactly the same, and the entire distribution shifts to the right by $10,000 as the mean moves up by $10,000. Therefore the VaR cutoff, which was previously at -250,000 on the graph also moves up by 10k to -240,000, and therefore $240,000 is the correct answer.

The other choices are intended to confuse by multiplying the z-factor for the 99% confidence level with 10,000 etc.

The correct answer is Choice 'c'. The following is a brief description of the major approaches available to model credit risk, and the analysis that underlies them:

1. CreditMetrics: based on the credit migration framework. Considers the probability of migration to other credit ratings and the impact of such migrations on portfolio value.

2. CreditPortfolio View: similar to CreditMetrics, but adds the impact of the business cycle to the evaluation.

3. The contingent claims approach: uses option theory by considering a debt as a put option on the assets of the firm.

4. KMV's EDF (expected default frequency) based approach: relies on EDFs and distance to default as a measure of credit risk.

5. CreditRisk+: Also called the 'actuarial approach', considers default as a binary event that either happens or does not happen. This approach does not consider the loss of value from deterioration in credit quality (unless the deterioration implies default).

Credit risk is the risk from a borrower defaulting on moneys lent. Counterparty risk, on the other hand, is the risk that a counterparty to a derivative transaction will be unable to pay at the time the transaction is in-the-money.

Credit risk therefore relates more to the banking book, counterparty risk relates more to the trading book. Credit risk and counterparty risk differ in that for counterparty risk, the amount at risk fluctuates for counterparty risk depending upon the value of the underlying derivative. Counterparty risk generally starts at zero, for most swaps and other derivatives are near zero value at inception. Over time, as the prices of the underlying instruments move, one party ends up owing money to the other. A deterioration in the financial situation of the party owing moneys may lead to a loss to the other party, resulting in counterparty risk. Counterparty risk can also arise from stock lending operations and repo trades.

Credit risk on the other hand is the traditional risk of default by a borrower, or a bank's customer who has taken a loan or has an overdraft or other credit facility.

Statement I is therefore incorrect as credit risk and counterparty risks are different.

Statement II is correct as counterparty risk is 'contingent' in the sense it arises only if the transaction with the counterparty ends up being in-the-money, and the counterparty defaults.

Statement III is incorrect. The statement describes credit risk.

Statement IV is incorrect, as the exposure is known for moneys lent. Derivative exposures for the future are difficult to estimate, they can even turn from moneys owed to moneys due as the value of the underlying changes.

When a derivative position is entered into, its mark-to-market value is generally close to zero (though the notional may be high). With the passage of time, the derivative's value fluctuates in an unpredictable way, creating a counterparty exposure that may be difficult to estimate and risk manage. Counterparty risk in such cases is estimated based on Potential Future Exposure, which may be calculated using either:

a) Take the mark-to-market at present, and add a certain percentage of the notional, or

b) Perform a Monte Carlo simulation, capturing the stochastic nature of the PFE.

Therefore I and II are valid choices. MLE and parametric estimation are not methods for calculating PFE.

A bank's stress testing programme in relation to firm wide stress tests should document the type, frequency and the purpose of the programme, as well as methodologies for defining scenarios and the remedial actions envisaged. Choice 'b' is therefore a necessary attribute of a robust stress testing programme.

The programme should be supported by a robust systems infrastructure that allows the execution of periodic as well as ad-hoc stress tests at the right level (business unit, as well as firm-wide) at the right level of detail or granularity. Choice 'c' also therefore is a valid choice.

A related element is data quality - without which no stress tests can be be credible.

Therefore all the choices listed are correct and Choice 'd' is the correct answer.

The square root of time rule can be used to convert, say a 1-day VaR to a 10-day VaR, by multiplying the known number by the square root of time to get the VaR over a different time horizon. However, there are key assumptions that underlie the application of this rule, and statements I to IV correctly state those assumptions.

Statements V and VI are not correct, because the application of the square root of time rule requires the absence of serial correlations, and also the absence of volatility clustering (ie independence). Therefore Choice 'c' is the correct answer.

The square root of time rule is also applied to convert volatility or standard deviation for one period to the volatility for a different time period. Remember that VaR is just a multiple of volatility, and therefore the assumptions that apply to the square root of time rule for VaR also apply to the same rule when used in the context of volatilities or standard deviation.

If returns display mean reversion, then clearly daily volatilities will be greater than weekly volatility, both annualized using the square root of time rule. Mean reversion would imply that the deviation from the mean will be lower over a longer time period than a shorter time period, and therefore annualized volatility based on daily volatility will be greater.

This is an example of pipeline and warehousing risk. Generally there is a lag between acquiring assets and securitizing them due to the legal work to be done, the work to be done by the ratings agencies and in finding investors. During this period, the bank is exposed to the underlying assets purchased, and this is the 'pipeline and warehousing' risk as these assets are in the pipeline and warehoused for intended subsequent sale. Generally this period tends to be short. However, during the credit crisis this became a significant source of risk as many banks were left exposed to risk they had intended to get rid of, but could not do so as the market dried up. The other choices are all incorrect.

Note that pipeline and warehousing risk is also known as 'securitzation risk'. It means that funding from securitization cannot be relied upon as a matter of fact.

VaR is specified by just two parameters - the holding period, and the confidence level. We speak of, for example, a 10-day VaR at the 95% confidence level. No other parameters are required. Therefore Choice 'd' is the correct answer and the others are incorrect.

The three pillars are minimum capital requirements, supervisory review and market discipline. National regulation is not a pillar described under the accord. Choice 'c' is the correct answer.

The persistence parameter, β, is the coefficient of the most recent day's returns in GARCH calculations. A higher value of the persistence parameter tends to 'persist' the prior value of variance for longer. Consider an extreme example - if the persistence parameter is equal to 1, the variance under GARCH will never change in response to returns.

The risk analyst is using the block maxima approach. The data points that result will then be used to fit a GEV distribution.

Expected shortfall refers to the expected losses beyond a specified threshold. The peaks-over-threshold approach is an alternative approach to the block maxima approach, and involves considering exceedances above a threshold. Fourier transformation is not relevant in this context, and is a non-sensical option.

CreditRisk+ treats default as a binary event, ignoring downgrade risk, capital structures of individual firms in the portfolio or the causes of default. It uses a single parameter, λ or the mean default rate, and derives credit risk based upon the Poisson distribution. Therefore Choice 'c' is the correct answer.

For a number of processes, including many in finance, while a distribution such as the normal distribution is a good approximation of the distribution near the modal value of the variable, the same normal distribution may not be a good estimate of the tails. For this reason, the Pareto distribution is one of the distributions that is often used to model the tails of another distribution. Generally, if you have a set of observations, and you discard all observations below a threshold, you are left with what are called 'exceedances'. The threshold needs to be reasonably far out in the tail. If from each value of the exceedances you subtract the threshold value, the resulting dataset is estimated by the generalized Pareto distribution.

The Pareto distribution has a 'shape parameter'. The average of two Pareto distributions with tail parameters ξ1 and ξ2 (ξ is a Greek character, pronounced as 'sai' (saa-eee)), is the weighted average of ξ1 and ξ2 with weights proportional to the number of observations in the datasets underlying the distributions.

Statement I is true. If a Monte Carlo simulation is based upon the same parameters as used for analytical VaR, and enough number of simulations are carried out, we would get the same results as with analytical VaR.

Statement II is false. We cannot use Monte Carlo simulations using parameters based upon a normal assumption when the underlying distribution is not normal. For example, if a return stream is based upon say a uniform distribution, we cannot use a simulation based upon drawings from a normal distribution even though we use the same mean and standard deviation.

Statement III is true. This is the advantage of historical simulations - no assumptions are necessary. (Historical simulations however often suffer from the great disadvantage of the paucity of data that would cover all possibilities.)

Statement IV is true. The results of historical simulations are limited to the data they are based upon.

The change in the price of a security that follows a Weiner process is determined by its standard deviation and expected return. To get the price itself, we need to add this change in price to the current price. Therefore the future price in a Weiner process is determined by all three of current price, expected return and standard deviation.

The three pillars under Basel II are minimum capital requirements, supervisory review process and market discipline. Therefore statement I is false. The other two statements are accurate. Therefore Choice 'd' is the correct answer.

For EVT, we use the block maxima or the peaks-over-threshold methods. These provide us the data points that can be fitted to a GEV distribution.

Least squares and maximum likelihood are methods that are used for curve fitting, and they have a variety of applications across risk management.

Conditional VaR is the expected average losses above a given percentile, or a given VaR estimate at the given level of confidence. For example, if we know what the 99% VaR is, we still do not know what we can expect our losses to be if this VaR loss estimate were to be exceeded. Conditional VaR provides the answer to this question by providing an estimate of the average or expected losses beyond 99% mark. Therefore Choice 'c' is the correct answer and the other choices are mostly non-sensical.

When returns are non-normal and have fat tails, an assumption of normality in returns leads to underestimation of VaR at high confidence levels. At the same time, at lower confidence levels the normal distribution may give higher VaR estimates. Therefore Choice 'a' is correct. The other choices are incorrect.

Also refer to the tutorial about VaR and heavy tails.

All of the distributions referred to in the question can be used to model the loss severity distribution for op risk. Therefore Choice 'c' is the correct answer.

The default correlation between two obligors goes up if the joint probability of default between them increases. This is intuitive. Also consider the formula for the default correlation between two obligors

Default correlation = [P(1,2) - P1 * P2] / √P1*(1-P1)*P2*(1-P2); where P(1,2) is the joint probability of default between the two and P1 and P2 are their individual probabilities of default. Obviously, an increase in P(1,2) will cause the default correlation to increase.