Developing a set of practical scenarios
In our latest blog Tony and John discuss how to go about developing practical scenarios using operational risk software, and the problems that may be encountered.
Taken from: Mastering Risk Management
Using risk and control self-assessments
It is possible to develop scenarios by considering the key risks to the firm and assuming that several of the key risks occur either simultaneously or within appropriate timescales. This has the advantage of clearly being relevant to the firm, as the key risks have already been identified through risk and control self-assessment. However, this method of development, if used as the only method, has the disadvantage that extreme risks not identified during the assessment will not be used. Ideally, scenarios should be developed with the key risks in mind together with any other exceptional but plausible risks. The RCSA should then be challenged back to check that no key risks have been inadvertently missed.
Using random words
At the other end of the scenario development spectrum lies the random word ‘methodology’. Using random words is a surprisingly powerful way of generating scenarios. It consists of taking a number of scenario-related words or phrases which may apply to the firm (such as fire, flood, utility failure, outsourcer failure, money laundering, internal fraud, terrorist attack) and choosing two or three at random. A scenario is then constructed around the chosen words for phrases which is relevant to the firm. It can be surprising how randomly chosen words are a powerful and imaginative way to construct credible and relevant scenarios.
Using strategic events
Strategic events are the crystallising of a strategic risk. i.e. a risk to the firm’s overall business objectives. These can be risks such as ‘Poor strategic decisions’ or ‘Inability to increase distribution’. Strategic events can also be generic risks occurring at the firm wide level such as ‘Loss of key staff’ (perhaps the head of a major business line) or ‘Failure of IT system’ (perhaps a major IT system interfacing with a major customer group).
Scenarios are the occurrence of an exceptional but plausible event. The occurrence of a strategic risk is more likely to have an exceptional impact for the firm than the occurrence of a departmental or minor business line risk. The use of strategic events in constructing stress tests and scenarios is therefore to be encouraged, although in a constructive and thoughtful way. It is easy for a stress test of scenario to become too extreme by combing several strategic events.
If treated with caution, the combining of strategic events can lead to exceptional but plausible scenarios. The cautionary point is with relation to the impact of the strategic event. Combing several relatively benign strategic event occurrences can lead to an exceptional event. Obviously, the combination of several exceptional events will lead to a scenario which is very likely deemed too extreme by senior management and the board.
Using horizon scanning
Horizon scanning is a loose term relating to the recognition of risks that may occur at some indeterminate but extended time in the future. Before 2020, most people would have put a worldwide pandemic in this category, despite the previous evidence of SARS, MERS and Ebola. Many firms undertake regular horizon scanning (often quarterly) to identify future possible risks. As detected, but future risks, these are excellent for using in scenario development. Particularly, grouping horizon scanning risks with strategic risks can lead to scenarios with a significant impact.
Using industry information
Scenarios obviously need to be tailored to your particular business activity, but generic, yet relevant, risk scenarios can be found in industry-based information.
Using news stories
The key to good scenarios is imagination. Perhaps the ‘unknown unknowns’ are not really so unknown, but simply reflect a lack of imagination in people’s thinking. So the first thing is to be imaginative. With that in mind, a good place to start when developing a set of practical scenarios is to look at recent news stories. These may be events with no obvious link to a particular firm or to your industry so they should enables a more diverse and innovative way of thinking. on others.
Common scenario outcomes
However the scenarios are generated, a number of common themes emerge in the outcomes. These are often:
- Failure of the firm to meet its objectives
- Funding difficulties
- Exposure to fraud
- Inability to maintain business volume
- Lack of building access
- Impact on ratings
- Reputational damage
- Adverse environmental impact
- Supply chain disruption
- Major competitor win.
Typical problems following scenario development
Balancing effort and understanding
Scenarios should be kept as far as possible at the strategic level. They should only be as detailed as they need to be. Scenarios which go down to the nth degree of detail require much more analysis of risks and controls in order to generate meaningful results and a tested risk profile. Similarly, a scenario may touch on a wide variety of events and also therefore appear to require considerable analysis. Either way significant effort is required to provide an apparently suitable level of analysis for an extreme (although plausible) event.
In addition, it is unlikely that a scenario, however detailed, will exactly match what happens in reality.
On the other hand, a scenario must be developed in sufficient detail that it can be seen to be directly relevant and appropriate for the firm. A two-word scenario, ‘internal fraud’, is neither useful nor helpful. The answer is to maintain a balance between effort and understanding the impact of the scenario.
Rejection of the technique
If too much detail is available, it is much easier to find ambiguities and irrelevancies in the scenario. This leads to a rejection of the overall technique. It is important to focus on the principle that various extreme but plausible events should be analysed in order to determine the sensitivity of the firm’s risk profile to those events. Don’t let that principle be swamped in the detail.
Paralysis
Sometimes the scenario result is so awful that the conclusion is drawn that little can be done to prepare for it. Even in the event of the scenario showing that the firm would be liquidated, action can always be taken.
In our final blog on the topic of scenarios Tony and John consider how best to apply risk scenarios.
Mastering Risk Management by Tony Blunden and John Thirlwell is published by FT International. Order your copy here: https://www.pearson.com/en-gb/subject-catalog/p/mastering-risk-management/P200000003761/9781292331317
For more information contact us today on sales@risklogix-solutions.com
