How does scenario analysis work for operational risk, and how do banks combine it with historical data?

Scenario analysis bridges the gap between historical loss data (which often lacks extreme events) and the need to capitalize against catastrophic operational failures. Here's how it works in practice:

The Scenario Analysis Process:

1. Identify scenarios — Risk teams, with input from business units, define plausible but severe events. Examples: massive cyber breach, systemic compliance failure, rogue trader, natural disaster destroying a critical data center.

1. Expert workshops — Senior business leaders and risk managers estimate:

• Frequency: How often could this realistically occur? (e.g., once in 20 years)
• Severity: What's the plausible range of losses? (typically 10th, 50th, and 90th percentile estimates)

1. Calibration against data — The raw expert estimates are benchmarked against:

• Internal loss data (does the scenario align with observed loss patterns?)
• External loss data (has this type of event happened to peers?)
• Key risk indicators (are current KRI trends consistent with the assumed frequency?)

1. Distribution fitting — Quantitative analysts fit the scenario estimates to a loss distribution (often lognormal or generalized Pareto) for use in the capital model.

Example — Ironclad Financial Services:

Scenario: A sophisticated cyber attack compromises customer data for 2 million clients.

The quantitative team fits a lognormal distribution with mean = ln($180M) and calibrates the variance to match the 10th/90th percentile range. This distribution is then integrated into the aggregate operational risk capital model.

Common Biases and Mitigants:

• Anchoring: Experts anchor on recent events. Mitigant: present scenarios without referencing specific past losses.
• Availability bias: Overweighting dramatic but rare events while underweighting mundane but frequent risks.
• Groupthink: Dominant voices in workshops. Mitigant: use anonymous voting tools (e.g., Delphi method).
• Motivational bias: Business units may downplay risks to avoid higher capital charges.

Exam focus: Expect questions on how scenario analysis complements loss data, common biases, and why purely historical approaches fail for operational risk tail modeling.

For scenario analysis practice problems, check our FRM Part II question bank on AcadiFi.