Outline using scenario analysis as a substitute when there is little data to work with.
The idea
Scenario analysis fills the gap when historical data are thin, especially for rare, severe events such as a major cyber attack or rogue-trading loss that the bank has never experienced. Managers and experts, usually in structured workshops, describe plausible scenarios and estimate how often each might occur and how large the loss would be, often giving a typical case and a worst case. These judgements are turned into a frequency distribution, such as a Poisson whose mean equals the estimated events per year. A one in 25 year event gives a mean of 0.04 events per year. They are also turned into a severity distribution, such as a lognormal fitted to the quantiles the experts give. The results supplement internal and external data in the loss model. The main weakness is subjectivity: availability bias (overweighting recent vivid events), anchoring on a first number, and overconfidence in narrow ranges. Structured elicitation, challenge sessions and comparison with external data limit these biases.
A practice question
Scenario analysis is most useful for operational risk when:
- A large database of frequent, small losses already exists and supports estimationWhy not: With plentiful data, statistical estimation is feasible and scenarios add little.
- Historical data on rare, severe events are scarce or absent - correct
- The bank wants to avoid using any internal loss data at allWhy not: Scenarios supplement internal and external data; they are not a replacement for it.
- Market prices are available to hedge the riskWhy not: Operational risks are mostly not traded; hedging prices are not what makes scenarios useful.
Scenario analysis relies on expert judgement and is used where data are too thin, for example for low-frequency, high-severity events.
A harder one
Experts judge that a loss above USD 20 million occurs on average once every 25 years. Assuming a Poisson process, the probability of at least one such loss over the next 10 years is closest to:
- 40.0 percentWhy not: Computes 10/25 directly; the probability of at least one event is not the expected count.
- 67.0 percentWhy not: Computes the probability of no loss, e^-0.4, instead of at least one.
- 3.9 percentWhy not: Uses the one-year horizon, 1 - e^-0.04, instead of ten years.
- 33.0 percent - correct
lambda = 10/25 = 0.4 events over ten years. P(at least one) = 1 - e^-0.4 = 0.3297.
The hardest tier
Scenario experts expect 0.5 qualifying events per year (Poisson). If an event occurs, there is a 5 percent chance its loss exceeds USD 20 million. The expected waiting time between losses above USD 20 million is closest to:
- 40 years - correct
- 2 yearsWhy not: Waits for any event, 1/0.5, ignoring that only 5 percent exceed USD 20 million.
- 20 yearsWhy not: Uses 1/0.05 and ignores how often events occur.
- 1.8 yearsWhy not: Adds the event rate and the exceedance probability: 1/(0.5 + 0.05).
Losses above USD 20 million arrive at rate 0.5 x 0.05 = 0.025 per year, so the mean waiting time is 1/0.025 = 40 years.
In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.
Start free →More in Operational Risk
- Outline the types of operational risk, with an account of how each type can arise.
- Contrast three ways of arriving at regulatory capital for operational risk: the advanced measurement approach, the standardized approach and the basic indicator approach.
- Explain why the Basel Committee introduced the standardized measurement approach and describe what it involves.
- Explain how Monte Carlo simulation builds a loss distribution out of a suitable loss frequency distribution and loss severity distribution.
- Outline the data problems commonly seen that make estimates of loss frequency and severity distributions inaccurate or biased.
- Outline how causal relationships are identified, and the roles that education, Risk and Control Self-Assessment (RCSA) and Key Risk Indicators (KRIs) play in understanding and managing operational risks.
- Outline how operational risk capital is allocated across business units.
- Explain how operational risk can be measured with the power law.
- Explain the link between insuring against operational risk and the moral hazard and adverse selection problems that insurance companies face.