Stress tests and enterprise risk management
Every earlier lesson in this module measured one kind of risk. This one asks how the pieces fit. A stress test takes a severe but possible scenario and works out what it would do to a firm’s capital, and it does not depend on how likely the scenario is. Enterprise risk management is the system of appetite, limits, reporting and independent challenge that tells a firm which risks to take. The lesson uses the Federal Reserve’s 2025 stress test of 22 banks and the Basel guidelines on risk governance, and a calculator runs an invented bank through a stress and then asks how large a loss it could take before it hit a minimum.
- Level
- Beginner
- Reading time
- About 26 minutes
- Know this first
- Operational and concentration risk
By the end you will be able to:
- explain what a stress test measures and how it differs from value at risk
- read a stress test result as a starting ratio, a low point and a fall
- run a reverse stress test to find the loss that reaches a minimum
- define risk appetite and the three lines of defence
- say how stress tests fit into enterprise risk management
From single risks to the whole firm
The earlier lessons in this module each took one risk and measured it: a loss that is exceeded one day in twenty, a bond’s sensitivity to yields, a currency exposure, a run on deposits, an outage or a lost customer. A firm faces all of them at once, and they often arrive together. Two ideas pull the pieces together. A stress test asks what a severe but possible scenario would do to the firm’s finances. Enterprise risk management is the system a firm uses to decide how much risk to take, who watches it and what happens when limits are breached.
What a stress test is
The value at risk of the first lesson estimates a loss from the past pattern of returns, at a chosen confidence level. A stress test works differently. It starts from a scenario, a specific path for the economy and markets, and calculates the firm’s losses and income along that path. The scenario does not come with a probability. It is chosen because it is severe and could happen, and the result is a number the firm can compare with its capital. Value at risk asks “how bad is a normal bad day or year?” A stress test asks “what if it is much worse than that, in a particular way?”
The Federal Reserve tests the largest US banks each year. In 2025 it tested 22. The projections start from data for the last quarter of 2024 and cover the period from the first quarter of 2025 to the first quarter of 2027. The Fed describes them as hypothetical estimates of an economic outcome that is more adverse than expected, and it does not call them forecasts.
| Severely adverse scenario, 2025 | Path from 2024:Q4 to the low point |
|---|---|
| Unemployment rate | Rises to a peak of 10% |
| Real GDP | Falls 7.80% |
| House prices | Fall 33% |
| Commercial real estate prices | Fall 30% |
| Equity prices | Fall 50% |
That scenario combines a deep recession, a fall in property prices and a halving of equity prices. It does not stop at one of the risks from the earlier lessons; it hits credit, markets and income together, which is how real downturns behave.
What the 2025 results show
The Fed projected losses on loans and other positions of $549 billion across the 22 banks. The key output is not the loss but what is left: the common equity tier 1 ratio, the bank’s highest-quality capital divided by its risk-weighted assets. For the 22 banks together the ratio fell from 13.4% at the end of 2024 to a minimum of 11.6%, a fall of 1.8 percentage points. The loss was large and the ratio stayed well above zero, because the banks started with a good deal of capital.
Individual banks differed a great deal. The table compares two.
| Common equity tier 1 ratio | End of 2024 | Minimum in the scenario | Fall, points |
|---|---|---|---|
| All 22 banks together | 13.4% | 11.6% | 1.8 |
| JPMorgan Chase | 15.7% | 14.2% | 1.5 |
| Capital One | 13.5% | 9.2% | 4.3 |
JPMorgan Chase started at 15.7% and fell 1.5 points, about 9.6% of its starting ratio, to 14.2%. Capital One started at 13.5% and fell 4.3 points, about 31.9% of its starting ratio, to 9.2%. The Fed projects each bank separately, and this lesson does not explain why the two differ. The lowest point of JPMorgan Chase’s ratio was higher than Capital One’s starting point. The Fed’s page also mentions a stress capital buffer requirement for each bank, which uses the results, but it does not define it, and this lesson does not either.
The reverse stress test
An ordinary stress test fixes the scenario and finds the result. A reverse stress test fixes the result and finds the scenario: how large would the loss have to be for the ratio to fall to a chosen minimum? The answer is the bank’s capital cushion in loss terms. If the scenario loss is $5 and losses of $9.5 would reach the minimum, the bank can take 1.9 times the scenario loss. A ratio of that kind says more about resilience than a bare pass or fail, since two banks that both pass can have very different margins.
Enterprise risk management
A stress test is a tool. Enterprise risk management is the system that uses it, together with the other measures in this module. The Basel guidelines on corporate governance for banks spell out its parts. Risk appetite is the aggregate level and types of risk a bank is willing to assume, decided in advance and within its risk capacity. The risk appetite statement is the written articulation of the aggregate level and types of risk that the bank will accept, or avoid. Limits on single customers, on trading losses, on currency positions and on liquidity are set so that the whole stays inside that appetite. The guidelines also say that banks should use stress tests and scenario analyses as part of this system.
Someone has to check that the limits are respected, and the guidelines divide the work into three lines of defence.
| Line of defence | Who | Role in the Basel guidelines |
|---|---|---|
| First | Business units | They take risks |
| Second | Independent risk management and compliance functions | They are independent of the business units |
| Third | Internal audit | An independent and effective function |
The business units are the first line because they take the risks. The second line is independent of them. The guidelines place the risk function under the direction of a chief risk officer with sufficient stature and independence, so that a risk that is inconvenient for the business can still be reported. The third line, internal audit, checks the first two. The idea is that those who earn money from a risk should not be the only ones judging it.
The module’s lessons fit this frame. Interest-rate risk, currency risk and tail risk are market risks that the first line takes and the second line measures. Liquidity and operational and concentration risk are limited by rules and buffers. A stress test combines them in one scenario, and the risk appetite statement sets how much of each the firm accepts. A company outside banking uses the same logic, with its own limits on customers, suppliers, currencies and debt.
Stress an invented bank
The calculator uses a bank with $100 of risk-weighted assets, so that dollars and percentage points of the ratio are the same number. Set its starting common equity ratio, the losses in the scenario and the income it earns during it. The ratio at the low point is the start minus the losses plus the earnings. The calculator compares it with an invented minimum of 7%, and runs the reverse test: what loss would bring the ratio exactly to 7%. It leaves out changes in the assets, dividends and buybacks, and taxes, all of which are part of the real test.
An invented bank with $100 of risk-weighted assets starts with a common equity ratio of 13.5%. In the scenario it loses $5.0 and earns $3.0, so the ratio falls by 2.0 points to 11.5% at its low point. That is 4.5 points above a hurdle of 7%. Losses of $9.5 would bring the ratio to the hurdle, 1.9 times the loss in the scenario.
Five experiments. First, leave the settings alone: a starting ratio of 13.5%, losses of $5 and income of $3, close to the aggregate result in the 2025 test. The ratio falls by 2.0 points to 11.5%, which is 4.5 points above the minimum. Losses of $9.5 would reach it, 1.9 times the scenario loss. Second, lower the starting ratio to 10.5%. The ratio falls by the same amount, to 8.5%, but the cushion is only 1.5 points and the bank can take losses of $6.5, 1.3 times the scenario. The fall is the same and the margin is not. Third, with the 10.5% start, raise the losses to $9. The ratio falls to 4.5%, which is 2.5 points below the minimum, so the bank fails this test. Fourth, return to the 13.5% start and $5 of losses, and cut the income to $0. The ratio falls to 8.5% and the cushion shrinks to 1.5 points, which shows how much the cushion in this calculator depends on income. Fifth, set the start to 16% with losses of $5 and income of $3. The low point is 14.0%, a loss of $12.0 would be needed to reach the minimum, and that is 2.4 times the scenario.
How to read the result
Three numbers matter: where the ratio starts, how far the scenario pushes it and what the bank earns on the way. A high starting ratio and strong income are cushions, and a loss that is large relative to assets is the threat. Notice also what a stress test does not tell you. It says nothing about how likely the scenario is, and it covers only the risks that the scenario includes. A bank can pass a recession scenario and still fail from a cyber attack, or from a run on deposits that moves faster than the scenario assumes, as the lesson on liquidity showed. That is why stress tests sit inside a wider system, with several scenarios, several measures and independent challenge, and why the reverse test is a useful complement: it asks how much room is left without having to guess a single scenario.
What this lesson leaves out
- An invented bank. Its ratio, losses, income and the 7% minimum are assumptions. The 7% is not a regulatory figure.
- A simplified path. The calculator takes losses and income as given. It ignores changes in risk-weighted assets, taxes, dividends and buybacks, which the real test models.
- One year of results. The lesson uses the 2025 test, as published by the Federal Reserve and revised on 30 September 2025. Other years have different scenarios and results.
- Only the figures read. The lesson uses the capital ratios and losses on the Fed’s results page and the scenario variables on its introduction. It does not describe the models behind them or the stress capital buffer.
- Governance in outline. The three lines of defence are described as in the Basel guidelines. Real firms organise them differently, and a structure on paper does not guarantee that it works.
- No advice. A bank’s result in one scenario says little about how any particular bank will do in the future, and the lesson does not assess any investment.
Common mistakes
Reading a stress scenario as a forecast
The Fed describes its scenario as hypothetical and more adverse than expected. It is chosen to be severe, not likely.
Confusing a stress test with value at risk
Value at risk comes from the pattern of past returns at a confidence level. A stress test takes a chosen scenario with no probability.
Looking only at pass or fail
Two banks can pass and have very different cushions. The reverse test and the size of the fall show the difference.
Comparing the fall without the starting point
A fall of 1.5 points from 15.7% is not the same as a fall of 4.3 points from 13.5%, and neither says how much room remains above the minimum.
Treating risk management as the risk team’s job alone
The business units take the risk and are the first line. The independent functions check it, and internal audit checks them.
Try it yourself
1. A bank starts at 12%, loses $6 per $100 of risk-weighted assets in a scenario and earns $2. What is the ratio at the low point?
Show the working
12 − 6 + 2 = 8%.
2. The minimum is 7%. What is the cushion for the bank in question 1?
Show the working
8% − 7% = 1 percentage point above the minimum.
3. What loss would bring that bank to 7%, and how many times the scenario loss is it?
Show the working
12 + 2 − 7 = $7 per $100. That is 7 ÷ 6 = 1.2 times the scenario loss of $6.
4. In the 2025 test Capital One’s ratio went from 13.5% to 9.2%. What was the fall, and what share of the starting ratio is it?
Show the working
13.5 − 9.2 = 4.3 points. 4.3 ÷ 13.5 = 31.9% of the starting ratio.
5. JPMorgan Chase went from 15.7% to 14.2%. What share of its starting ratio did it lose?
Show the working
15.7 − 14.2 = 1.5 points. 1.5 ÷ 15.7 = 9.6%.
Where this is used
- The Federal Reserve runs its stress test every year on the largest US banks and publishes the results.
- A bank’s board approves a risk appetite statement and receives reports on whether the bank is inside it.
- A bank runs reverse stress tests to find which combinations of events would threaten its survival.
- A chief risk officer reports to the board independently of the business units.
- A company outside banking tests its debt covenants and cash against a recession scenario before borrowing.
Key terms
- Stress test
- An estimate of a firm’s losses and income under a severe but possible scenario.
- Scenario
- A specified path for the economy and markets, such as a deep recession with falling asset prices.
- Reverse stress test
- A test that starts from a chosen outcome, such as reaching a minimum ratio, and finds the loss that causes it.
- Common equity tier 1 ratio
- A bank’s highest-quality capital divided by its risk-weighted assets.
- Risk-weighted assets
- A bank’s assets weighted by how risky they are, used as the base for capital ratios.
- Risk appetite
- The aggregate level and types of risk a firm is willing to assume, decided in advance and within its risk capacity.
- Risk appetite statement
- The written statement of the aggregate level and types of risk the firm will accept or avoid.
- Three lines of defence
- Business units that take risks, independent risk and compliance functions, and internal audit.
- Chief risk officer
- The senior executive who directs the risk function and has the stature and independence to challenge the business.
Questions people ask
Is a stress test a prediction?
No. It is a what-if. The scenario is severe on purpose, and the result shows whether the firm could absorb it.
Why does income count in a stress test?
Because a bank can earn income during a downturn, and that income offsets part of the loss. In the calculator, setting income to zero cuts the cushion sharply. The real test is more detailed than the calculator.
What does the chief risk officer do?
The Basel guidelines place the risk function under the direction of a chief risk officer with sufficient stature and independence, so that the function can challenge the business units.
Does enterprise risk management remove risk?
No. It decides which risks to take and keeps them within limits. A firm that took no risk would earn no return.
Sources and review
- Board of Governors of the Federal Reserve System, 2025 Federal Reserve Stress Test Results: Results for Banks under the Severely Adverse Scenario (June 2025, revised 30 September 2025), for the common equity tier 1 capital ratios of the 22 banks at the end of 2024 and at their minimum under the severely adverse scenario (including the aggregate, JPMorgan Chase and Capital One) and for projected losses of $549 billion.
- Board of Governors of the Federal Reserve System, 2025 Federal Reserve Stress Test Results: Introduction (June 2025), for the severely adverse scenario (unemployment rising to a peak of 10%, real GDP down 7.80%, house prices down 33%, commercial real estate prices down 30%, equity prices down 50%), the 2025:Q1 to 2027:Q1 projection period starting from data for 2024:Q4, the description of the projections as hypothetical estimates of an economic outcome more adverse than expected, and the 22 banks tested.
- Basel Committee on Banking Supervision, Basel Framework, Corporate governance (CGO10), for the definitions of risk appetite and the risk appetite statement (CGO10.6), the three lines of defence (CGO10.31 to CGO10.34) and the chief risk officer (CGO10.100). The read covered the first 100,000 characters of the page.
- Basel Committee on Banking Supervision, Corporate governance principles for banks (Financial Stability Institute executive summary of the July 2015 guidelines), for the use of stress tests and scenario analyses within a bank’s risk governance framework.
How the numbers were checked: the ratio at the low point, the fall, the cushion, the loss that reaches the minimum and the multiple were recomputed in plain code for the five experiments, and the calculator, which runs separately, was compared with that code for every combination of settings it allows. The scenario variables, the capital ratios and the definitions are quoted from the cited documents, and the shares of the starting ratio are calculated from them. The bank in the calculator and its 7% minimum are invented.