Embrace Scenario Analysis, Stress and Reverse Stress Testing
Assessing operational risk accurately is not without challenge, particularly when only limited data is available on risk probability and impact. And even if trend data can be accessed, who’s to say that risk events will repeat themselves?
Of greater challenge still are “low probability, high impact ‘tail’ events, where data is often non-existent”, suggests the Institute of Operational Risk (IOR), in its white paper guidance ‘Scenario Analysis, Stress and Reverse Stress Testing.’ Additional difficulties may present themselves in ‘dynamic organizational environments, where there are high levels of internal or external change (e.g., political, technological or social change), which further reduce the value of tracking historical trends.’
For greater clarity, risk professionals have turned to scenario analysis and the related tools, stress and reverse stress testing, as when conducted effectively, these can help:
- Management to test organizational resilience to major operational risk events and in advance, decide response actions
- To provide a forward-looking perspective – potential operational risk events may differ from historical events
- Risk managers to think creatively and share their insights
- To complement other widely adopted techniques to identify and assess risks, such as risk and control self-assessment
- To enhance the control environment – possible weaknesses or gaps in current controls will be identified as part of scenario analysis
Content within the ‘Scenario Analysis, Stress and Reverse Stress Testing’ guidance encompasses:
- The relationship between scenario analysis, stress testing, and reverse stress testing;
- The stages to follow, when implementing these risk identification and assessment tools: agreeing on the focus of analysis; determining the levels of analysis; preparing for a workshop; conducting a workshop; validation of outputs; governance of the process; and
- How to make effective use of scenario analysis, stress and reverse stress testing outputs, including using scenarios to support risk assessments and risk and capital modeling
According to the IOR, “Operational risk events are often the most serious of all for organizations, eclipsing pure market, credit or business risk events in terms of their magnitude. The COVID-19 pandemic is a recent example, as was the Global Financial Crisis of 2007-8.”
Ultimately, the board and senior management need to understand the types of events that may jeopardize business activities and should ensure that strategic or operational decision-making does not, inadvertently, increase exposure to risk events or make the organization more vulnerable to their impacts.
Learn more about Operational Risk Management