The accurate assessment of operational risk is a major challenge for organisations. Often historical data on probability and impact is limited and even when available there is no guarantee that historical trends will repeat themselves. Particularly problematic are low probability, high impact ‘tail’ events, where data is often nonexistent. Likewise, dynamic organisational environments, where there are high levels of internal or external change (e.g. political, technological or social change), further reduce the value of tracking historical trends. Scenario analysis, and the related tools of stress and reverse stress testing, have emerged as common responses to the problems of limited data and unreliable trends.
When done effectively, these tools can shed light on uncertainty and help organisations to prepare for and proactively respond to risk events through a proper operational risk management framework This includes, but is not limited to:
- Enabling management to test the resilience of their organisation about major operational risk events and providing an opportunity to discuss, in advance, how to respond to them
- Providing a forward-looking perspective, by focusing on managers’ attention on future operational risk events that may differ from those in the past
- Offering a break from day-to-day risk management activities, helping managers to think creatively about future operational risk events and to share their knowledge and expertise in a less time-pressured environment
- Complementing other risk identification and assessment techniques, such as loss event analysis and risk control and self-assessment. By incorporating the data produced by these techniques and providing structured methods to fill in knowledge gaps
- Improving the control environment, where potential gaps or weaknesses in existing controls are identified as part of the analysis.
Stress testing involves the assessment of specific stress events that might occur within the external operating environment of an organisation and which may impact a range of risk types, including operational risk. Examples include an economic recession, pandemic or political events like Brexit. Stress events have the potential to seriously disrupt the strategy and operations of an organisation, making them high impact, though usually, the probability of occurrence is low.
Reverse stress testing involves analysing events that threaten the viability of an organisation, causing insolvency or bankruptcy. The starting point of reverse testing is to identify the point of non-viability, usually in terms of determining the maximum financial loss that an organisation can withstand and then considering the types of internal risk events that may cause losses which exceed this value. From an operational risk perspective, this may include a major IT failure or fraud, for example.
Scenario analysis encompasses an element of stress and reverse stress testing but can be used in a wider range of applications. Scenarios need not be extreme stress events, for example, but more common situations that have a higher probability of occurrence, up to and including events that may be expected to occur once or more a year. In contrast, the events considered as part of the stress and especially reverse stress testing will occur much less often and have a significantly higher impact.
An alternative perspective on demarcating stress and scenario testing is in terms of the number of variables analysed. From this perspective, stress testing involves analysing the impact of major changes in a limited number of variables (usually one or two), while scenario analysis is said to involve the analysis of changes in a wider range of variables.
For example, a stress test might analyse the financial impact of a significant change in interest rates or the rate of inflation. In contrast, scenario analysis would consider the wider implications of an economic recession (increased unemployment, reduced credit ratings, etc.).
According to the IOR (part of the IRM Group), while a variable-based distinction may apply from an accounting, finance or strategic risk perspective, it does not apply from an operational risk perspective. This is because operational risk events are multi-faceted and necessarily involve changes in a range of variables. These changes may be relatively small or stressed to a significant degree. Hence a better way to distinguish between scenario analysis and stress testing is in terms of the severity of impact, rather than the number of variables to be considered.
Like most risk identification and assessment tools, effective scenario analysis, stress testing and reverse stress testing a process that involves several stages. These are as follows:
- Identifying and agreeing on the focus of the analysis
- Determining the level of analysis
- Preparing for a workshop
- Conducting a workshop
- Validation of the outputs
- Governance of the process
