Using given probability assumptions, work out operational risk exposures with a fault tree model.

FRM® Part II · Operational Risk and Resilience · Risk Measurement and Assessment · FRM2.ORR.4.e

The idea

A fault tree starts from an undesired top event and works down through logic gates to basic failures. At an AND gate all inputs must occur, so for independent events the output probability, written P, is P = p1 × p2. At an OR gate any one input is enough, so for independent events the output probability, written Q, is Q = 1 − (1 − p1) × (1 − p2). The OR result is less than the sum p1 + p2, because events can overlap. Work from the bottom up, applying each gate in turn. Then multiply the final probability by the expected loss severity conditional on the event to obtain an expected loss, where a fixed loss amount is the special case. Multiplication is valid only with independence. If events share a cause, the joint probability, written Pjoint, uses the conditional probability: Pjoint = P(A) × P(B given A). Typical errors are adding probabilities, using the wrong gate, and ignoring dependence.

Formulas

AND gate in a fault tree

P = p1 × p2

p1, p2: the probabilities of the two input events

All inputs must occur, and the inputs must be independent. Redundancy works through this gate: two backups both failing is far less likely than either one.

OR gate in a fault tree

Q = 1 − (1 − p1) × (1 − p2)

p1, p2: the probabilities of the two input events

Any one input is enough, with independent inputs; extend the product for more inputs. Adding the probabilities overstates the result because the events can overlap.

Joint probability of two events with a common cause

Pjoint = P(A) × P(B given A)

P(A): the probability of event A
P(B given A): the probability of event B once A has occurred

Use when the events share a cause, such as one system. Multiplying the unconditional probabilities understates the AND branch.

Expected loss from a fault tree

expected loss = P × S

P: the probability of the top event from the gates
S: the expected loss severity given that the event occurs, a fixed amount being the special case

Work up the tree gate by gate first, then multiply once by severity. Applying the wrong gate at any level carries through to the loss.

A practice question

From the question bank, with the reason each wrong option is wrong.

How does a fault tree model analyse an operational risk event?

It starts from an undesired top event and works backward through logic gates to the failures that cause it. - correct
It starts from an initiating failure and works forward through branches to map the range of possible outcomes and their probabilities.Why not: Describes an event tree, which is the forward-looking inductive counterpart of the fault tree.
It fits a frequency and a severity distribution to historical losses and simulates their sum.Why not: Describes the loss distribution approach, not a fault tree.
It rates the likelihood and impact of each risk and plots the results on a grid.Why not: Describes a heatmap, which has no gates or causal logic.

A fault tree is deductive: top event at the top, AND and OR gates beneath, basic events at the bottom. Probabilities of basic events are combined through the gates to obtain the top-event probability.

A harder one

A payment fraud occurs if (a) a control bypass AND collusion both happen, or (b) a system flaw is exploited. Probabilities are: control bypass 30%, collusion 20%, system flaw 10%, all independent. What is the probability of fraud?

16.0%Why not: Adds the AND-branch (6%) and the system flaw (10%) instead of combining them with the OR formula.
49.6%Why not: Treats all three events as an OR gate, ignoring that bypass and collusion must occur together.
0.6%Why not: Treats all three events as an AND gate, requiring every event to happen.
15.4% - correct

AND branch: 0.30 x 0.20 = 0.06. Then OR with 0.10: 1 - (1 - 0.06)(1 - 0.10) = 0.154, i.e. 15.4%.

The hardest tier

A loss event requires a data breach, which can occur through a phishing attack (15%) or an insider leak (25%), and then a failure of the monitoring control (10%), all independent. If the event costs USD 8 million, what is the expected annual loss from this fault tree, closest to?

USD 320 thousandWhy not: Adds 15% and 25% for the OR gate instead of 1 - 0.85 x 0.75.
USD 290 thousand - correct
USD 1,370 thousandWhy not: Puts the monitoring failure inside the OR branch with the insider leak, so it no longer has to coincide with a breach.
USD 30 thousandWhy not: Treats all three as an AND gate: 0.15 x 0.25 x 0.10, requiring both breach routes at once.

OR for the breach: 1 - 0.85 x 0.75 = 0.3625. AND with monitoring failure: 0.3625 x 0.10 = 0.03625. Expected loss = 0.03625 x 8,000,000 = 290,000.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →