Scenario analysis · RiskAtoms Academy

By the end you will be able to

1Run an operational risk scenario workshop: choose severe but plausible events, prepare the evidence and record a frequency, a typical loss and a severe loss.
2Turn a 1-in-N frequency and typical and severe losses into a Poisson-lognormal source, and compute its expected annual loss and its 1-in-1,000-year loss.
3Recognise anchoring, availability, groupthink, overconfidence and motivational bias, and design a workshop that limits them.
4Explain why the definition of 'severe' must be written down, and how a different reading changes the answer.

Why it matters

In ten years RiskAtoms Bank has lost £240.5m to operational events, but it has never had its core systems encrypted by ransomware, never lost a cloud region for two days and never had a million customers' data stolen. Its largest internal fraud on the trading desk cost £4.3m. Yet the bank has to plan for the kind of year that comes once in a thousand. Ten years of data cannot show that year. People who know the business can describe it, and scenario analysis turns their judgement into numbers that can sit next to the loss data.

Core explanation

Asking the experts, carefully

Illustrative dataRiskAtoms Bank plc's operational risk book

The same £67bn bank as Modules 3.5 and 3.6, reporting at 31 December 2025: ten years of internal loss events above £10,000 (2016 to 2025), an RCSA, ten key risk indicators, seven workshop scenarios, five important business services and five suppliers. Every event, person, supplier and figure is made up for teaching and seeded so it never changes; none is any bank's data. Every lesson in Module 3.7 uses this book, so the figures agree.

This lesson uses the book's seven workshop scenarios (SCENARIOS). Each is a frequency (once in N years), a typical loss and a severe loss, in £ millions. In the book, “severe” is the 1-in-100 outcome if the event happens. The scenarios are added on top of the loss data, so the mis-selling scenario partly double counts the redress already in the data; real models blend the two.

Loss data shows what has happened (L3.7.03: Loss data). Key risk indicators show what is building up (L3.7.05: Key risk indicators in practice). A scenario asks what could happen that has not. It is the operational cousin of the hypothetical stress scenarios in L2.5.05: Scenario analysis, with one difference: there is no portfolio to revalue. The loss has to be estimated by people.

That happens in a workshop. The second line (operational risk) runs it; the first line (the business and technology owners) supplies the answers; finance, legal and the people who handled past incidents join. Each scenario must be severe but plausible: a specific chain of events that could happen at this bank, not a generic disaster.

ExploreA scenario workshop, step by step

Click each stage to see what happens there.

Select

Start from the risk register and the RCSA (L3.7.04: Controls: design, testing and assurance): the risks rated High that the loss data barely covers. RiskAtoms Bank's seven cover ransomware, rogue trading, mis-selling, a cloud failure, a large fraud attack, a data breach and a model error.

The three answers

Each scenario ends in three numbers: a frequency, once in N years; a typical loss; and a severe loss. Workshops ask “once in how many years?” rather than for a probability, because a return period is easier to picture and to argue about than a small percentage.

Scenario	Once in	Typical	Severe	σ	Mean if it happens	Expected a year
S1 Ransomware takes core banking down	15 yrs	£25m	£200m	0.894	£37.3m	£2.49m
S2 Rogue trading on the Markets desk	40 yrs	£15m	£150m	0.990	£24.5m	£0.61m
S3 Mis-selling redress programme	10 yrs	£40m	£300m	0.866	£58.2m	£5.82m
S4 Critical cloud provider fails	20 yrs	£10m	£100m	0.990	£16.3m	£0.82m
S5 Large external fraud attack	10 yrs	£8m	£60m	0.866	£11.6m	£1.16m
S6 Customer data breach and fine	20 yrs	£12m	£100m	0.911	£18.2m	£0.91m
S7 Model error in customer charges	15 yrs	£6m	£50m	0.911	£9.1m	£0.61m
All seven						£12.41m

Two things stand out. The mean loss if an event happens is well above the typical loss, because the severe answer stretches the right tail. And the seven together add £12.4m a year of expected loss, half as much again as the £24.3m the loss data implies. When the book adds them to its loss model, the 1-in-1,000-year loss rises from £430.4m to £487.4m (L3.7.07: Measuring frequency and severity). Scenarios matter most in the tail, which is exactly where the data is thinnest.

The biases to design out

Expert judgement is the method's strength and its weakness. In a 2009 report on a survey of 42 banks using internal models, the Basel Committee named the biases that distort scenario answers and found that fewer than half of the banks addressed all of them explicitly. Five matter most in practice:

Anchoring: the first number seen or said pulls every answer towards it.
Availability: last October's 31-hour outage looms larger than a fraud scenario no one in the room has lived through.
Groupthink: the room converges on the most senior person's view.
Overconfidence: severe answers too close to typical, because a small number of past events makes the world look tamer than it is.
Motivational bias: answers shaded by interest, for example a business head who knows a larger scenario means a larger capital allocation.

Sort itSpot the bias

Each line is from a RiskAtoms Bank workshop. Which bias is most at work?

The pack opens with the £18.4m payments outage. Every estimate of a cloud failure comes back between £15m and £25m.
Weeks after the outage, the group rates a technology failure more likely than any other scenario, and the fraud scenario gets ten minutes.
The CTO says two days is the worst case. Nobody else offers a number, and the group writes down two days.
Asked for the severe case, the team gives £12m against a typical £10m, because the worst they have seen was £11m.
The head of Markets, whose desk's capital depends on the rogue trading scenario, argues it should be once in 100 years.

The formal version

A scenario becomes a Poisson frequency with $\lambda = 1/N$ and a lognormal severity (M-C07: The lognormal distribution) pinned by two quantiles (M-C09: Quantiles): the typical loss is the median and the severe loss is the 99th percentile.

Fitting μ and σ. If $\ln X \sim N(\mu, \sigma^2)$ , then $P(X \le x) = \Phi\big((\ln x - \mu)/\sigma\big)$ . Set the two answers:

\begin{aligned} P(X \le \text{typical}) = 0.5 &\;\Rightarrow\; \frac{\ln \text{typical} - \mu}{\sigma} = 0 \;\Rightarrow\; \mu = \ln \text{typical} \\ P(X \le \text{severe}) = 0.99 &\;\Rightarrow\; \frac{\ln \text{severe} - \mu}{\sigma} = z_{0.99} = 2.326 \\ &\;\Rightarrow\; \sigma = \frac{\ln(\text{severe}/\text{typical})}{2.326} \\ E[X] &= e^{\mu + \sigma^2/2}, \qquad \text{EAL} = \lambda\, E[X] \end{aligned}

Only the ratio of severe to typical sets σ. A severe answer eight times the typical one gives σ = 0.894; doubling the severe answer adds $\ln 2 / 2.326 = 0.298$ to σ. That frequency times mean severity gives the expected loss is shown in full in L3.7.07: Measuring frequency and severity.

The 1-in-M-year loss. Losses larger than $x$ happen at a rate of $\lambda\,P(X > x)$ a year. If events arrive at random at rate $r$ , the chance of none in a year is $e^{-r}$ (M-C05: The Poisson distribution). The 1-in-M-year loss is the $x$ with a 1/M chance of being exceeded at least once in a year:

\begin{aligned} 1 - e^{-\lambda P(X > x)} &= \tfrac{1}{M} \\ P(X > x) &= \frac{-\ln(1 - 1/M)}{\lambda} \;\approx\; \frac{1}{\lambda M} \\ x &= \exp\!\big(\mu + \sigma\, z_{1 - P(X > x)}\big) \end{aligned}

For a 1-in-10 scenario and $M = 1{,}000$ , $P(X > x) \approx 1\%$ : the 1-in-1,000-year loss is the severe answer. That is why the book's mis-selling scenario S3, once in 10 years with a severe case of £300m, has a 1-in-1,000-year loss of £300.0m. This is the largest single loss; the annual total can be a little higher if two events land in one year, which is rare for scenarios this infrequent.

Try it

Start from the ransomware scenario. Double the severe answer and watch the 1-in-1,000-year loss almost double while the expected loss rises by a third. Then switch the meaning of “severe” to the annual reading. Finally, load S2 (once in 40 years) and switch again: the answers stop hanging together.

Try itFrom three answers to a loss distribution

Start from a scenario in the book

S1: Ransomware takes core banking down.

Once in N years1 in 15

Typical loss£25m

Severe loss£200m

What the workshop meant by severe

Expected annual loss λ × mean£2.5m

1-in-1,000-year loss£173.9m

Frequency λ = 1/N0.0667 a year

1-in-100-year loss£63.0m

μ = ln(typical)3.219

Mean loss if it happens£37.3m

σ = ln(severe ÷ typical) ÷ z0.894

z used2.326 (tail 1.00%)

The 1-in-M-year loss is the single loss exceeded at least once in a year with probability 1/M: events above x arrive at rate λ × P(X > x). Illustrative scenarios from the book; £ millions.

Worked example

Ransomware takes core banking down (S1)

The workshop agreed: once in 15 years, typical loss £25m, severe loss £200m if it happens. The pack showed the bank's worst technology loss, the £18.4m payments outage of October 2025, as the anchor event. All figures in £ millions.

From the workshop's answers to the tail

Step 1 of 6

1
Frequency
$\lambda = \frac{1}{15} = 0.0667\ \text{events a year}$

Halving or doubling the severe answer moves the expected loss by a fifth to a third, but moves the 1-in-1,000-year loss by roughly half or double. The workshop's hardest question, how bad a bad case is, drives the tail almost one for one. That is where challenge time should go.

Write down what 'severe' means

Suppose the head of technology meant £200m as the loss “we'd see once in a hundred years”. For an event that happens once in 15 years, that puts 15.1% of the outcomes above £200m, not 1%. σ becomes 2.01, the mean loss if it happens £189m and the expected annual loss £12.63m, five times the £2.49m above. Same three numbers, different question, very different risk.

Regulatory lens

Under the Basel II advanced measurement approaches (AMA), scenario analysis was one of four required data elements, with internal loss data, external data and business environment and internal control factors, and the capital figure was the 99.9% one-year loss. The Basel Committee's 2011 supervisory guidelines for the AMA noted that the scenario process is qualitative and that quantifying the uncertainty from scenario biases is hard. The 2017 reforms replaced the AMA with one standardised approach, which uses no scenarios (L3.7.07: Measuring frequency and severity), but supervisors still expect them: the 2021 Principles for the Sound Management of Operational Risk list scenario analysis among the tools to identify and assess risk, and say that its subjectivity calls for a robust governance framework and independent review. Scenarios also inform the capital banks hold under Pillar 2, which M4.4: Counterparty, operational and large exposures covers. Operational resilience asks for a different kind of scenario test, of whether a service stays within its impact tolerance, in L3.7.15: Operational resilience.

Spark Atoms

Spark AtomThe severe case is the 1-in-1,000-year loss

For a scenario that happens once in 10 years, the 1-in-100 outcome if it happens is, to within a small fraction of a per cent, its 1-in-1,000-year loss: 10 × 100 = 1,000. For the book's mis-selling scenario that is £300.0m against a severe answer of £300m. One question to a workshop, “how bad if it happens, one time in a hundred?”, sets the far tail of the whole model.

Spark AtomFewer than half

When the Basel Committee reported in 2009 on its survey of banks using internal models, it listed overconfidence, motivational bias, availability, partition dependence (answers that shift with how the choices are split into ranges) and anchoring. Fewer than half of the banks said they addressed all of these biases explicitly. The Committee's conclusion was that challenge processes should be strengthened.

Key takeaways

Scenario analysis estimates severe but plausible losses that the loss data has not seen, through structured workshops run by the second line with first-line experts.
Each scenario gives a frequency (once in N years), a typical loss (the median) and a severe loss (here the 99th percentile if it happens): λ = 1/N, μ = ln(typical), σ = ln(severe/typical)/2.326.
The expected annual loss is λ × e^(μ + σ²/2): £2.49m for ransomware, £12.4m for the book's seven scenarios together.
The severe answer drives the tail almost one for one; for a 1-in-10 scenario it is the 1-in-1,000-year loss.
Anchoring, availability, groupthink, overconfidence and motivational bias distort the answers: use private first estimates, external evidence, challenge and a written definition of every answer.

Reaction

Check what stuck

Question 1 · objective 2

A workshop puts a scenario's typical loss at £10m and its severe loss (the 1-in-100 outcome if it happens) at £100m. What is σ of the lognormal, to two decimal places?

Question 2 · objective 2

The same scenario happens once in 20 years. What is its expected annual loss, in £m, to two decimal places?

£m

Question 3 · objective 3

The facilitator opens the ransomware workshop with the bank's largest ever loss, the £82m redress provision, and asks "could ransomware be worse than that?" Every estimate lands between £60m and £100m. Which bias is most at work?

AAnchoringBAvailabilityCMotivational biasDPartition dependence

Question 4 · objective 4

A business owner says the £200m severe case for ransomware is the loss "we'd see once in a hundred years". The model treats £200m as the 1-in-100 outcome if the attack happens. What happens if the model is right and the owner meant what they said?

AThe two readings imply very different distributions: read the owner's way, σ is about 2 and the expected loss is about five times largerBNothing: both readings mean the same thingCThe owner's reading gives a smaller σ, so the model overstates the riskDOnly the frequency changes, not the severity

Question 5 · objective 2

A scenario happens once in 10 years, with a typical loss of £40m and a severe loss (99th percentile if it happens) of £300m. Roughly what is its 1-in-1,000-year single loss, in £m?

£m

Glossary

Scenario (operational risk): An operational risk scenario: a short, specific story of a severe but plausible loss event, with an estimate of how often it could happen and how much it would cost.
Scenario workshop: A structured meeting of the people who know a risk best (business, technology, risk, finance) that agrees a scenario's narrative, frequency and losses, led by a facilitator from the second line.
Severe but plausible: Bad enough to test the firm, but a chain of events that could really happen given its business and controls; not the worst imaginable outcome.
Once in N years: Once in N years: an annual frequency of λ = 1/N. Once in 15 years is λ ≈ 0.067 events a year.
Typical loss: The middle outcome if the event happens: half of such events would cost less and half more (the median).
Severe loss: In this book, the 1-in-100 outcome if the event happens: the 99th percentile of the loss given the event. Other firms define it differently, so the definition must be written down.
1-in-M-year loss: The 1-in-M-year loss: the loss size exceeded at least once in a given year with probability 1/M. A 1-in-1,000-year loss has a 0.1% chance a year.
Anchoring: Leaning too heavily on the first number seen or said, such as a figure in the background pack.
Availability bias: Overweighting events that are recent or vivid, such as last year's outage, and underweighting the rest.
Groupthink: A group converging on one view without real challenge, often the most senior or confident person's view.
Overconfidence: Ranges that are too narrow: severe answers too close to typical, so the tail is understated.
Motivational bias: Answers shaded by the respondent's interests, for example a business owner keeping a scenario small because it drives their capital charge.

Deep Dives & Origins

Deep Dives

Basel Committee on Banking Supervision, Revisions to the Principles for the Sound Management of Operational Risk, BIS, March 2021, Principle 6 (identification and assessment tools, including scenario analysis). Introductory.
Basel Committee on Banking Supervision, Observed range of practice in key elements of Advanced Measurement Approaches (AMA), BIS, July 2009: how banks ran scenario analysis and the biases they faced. Intermediate.
P. V. Shevchenko and G. W. Peters, “Loss distribution approach for operational risk capital modelling under Basel II: combining different data sources for risk estimation”, 2013 (arXiv:1306.1882). Advanced.

Origins

Basel Committee on Banking Supervision, Observed range of practice in key elements of Advanced Measurement Approaches (AMA), BIS, July 2009, pp. 15–21 (scenario analysis governance, including scenario biases).
Basel Committee on Banking Supervision, Operational Risk: Supervisory Guidelines for the Advanced Measurement Approaches, BIS, June 2011, paragraphs 40–41 (the four data elements; scenario uncertainty).
Basel Committee on Banking Supervision, Revisions to the Principles for the Sound Management of Operational Risk, BIS, March 2021, paragraph 35(f).
PwC, Operational risk: a single standardised approach for all, January 2018 (the AMA replaced by the standardised approach).
ORX, Future of Operational Risk Scenarios white paper, March 2021 (public summary).

Watch this lesson

Video version

Prefer to watch? The same lesson as a 12-minute video will sit here, made from this page's script.