Scenario Analysis: A Practical Guide
Scenario Analysis: A Practical Guide
Scenario Analysis: A Practical Guide
Scenario Analysis
A Practical Guide
Helping to develop insight and
manage uncertainty
IN ASSOCIATION WITH:
Acknowledgements
ORIC International
ORIC International is a not-for-profit company, owned by the industry, dedicated to advancing non-financial
risk management practices. Our unique industry collaboration model enables the anonymised and secure
exchange of data, process, best practice benchmarks and lessons learned across our network of member firms.
This means that ORIC’s member firms have access to unparalleled non-financial risk intelligence from peer
firms, including access to data on peer loss events and near misses, scenarios and emerging risks, and capital
allocation approaches and metrics.
As well as providing a platform for sharing data and insights across its member firm network, ORIC also
performs leading edge research, sets trusted standards for operational risk and provides a community for
members to exchange ideas and best practice. In an increasingly interconnected world, exchanging risk
intelligence with peers helps firms to identify, assess and mitigate against a wide range of risks before they
become boardroom, shareholder or sector problems.
Our expertise brings together risk, resilience, crisis management, business continuity, data analytics and
engagement to provide a range of sophisticated services, from the use of risk management tools, AI and data
analysis, through to embedding our consultants into your risk teams.
The leading UK association for everyone who has a responsibility for risk management and insurance in their
organisation, Airmic has over 450 corporate members and more than 1,800 individual members. Individual
members are from all sectors and include company secretaries, finance directors, and internal auditors, as
well as risk and insurance professionals. Airmic supports members through learning and research; a diverse
programme of events; developing and encouraging good practice; and lobbying on subjects that directly \
affect our members and their professions. Above all, we provide a platform for professionals to stay in touch,
to communicate with each other, and to share ideas and information.
With thanks to Suki Basi and the Russell Group for their contribution to section 1.7 on scenario analysis
and connected risk.
Airmic guides are provided to give an insight and some understanding into different areas of risk. They are not
intended to address any particular requirements or issues. Airmic guides are not intended to replace the need
for advice nor are they training guides. Airmic does not accept any liability for the content of the guides which
are prepared based on the views of the author (who may not be an Airmic employee).
2
GUIDES
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
CONTENTS
01
Principles of scenario analysis. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
02
A framework for scenario analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
03
Using scenario analysis for strategic planning . . . . . . . . . . . . . . . . . . . . . . 22
04
Using scenario analysis for operational risk . . . . . . . . . . . . . . . . . . . . . . . . . 26
05
Using scenario analysis for insurance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
06
Using scenario analysis for stress testing . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
07
Using scenario analysis for resilience. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
08
Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Annex one . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Annex two . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Contributors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
3
Introduction
4 AIRMIC GUIDES
GUIDES
“One of the critical skills a risk professional “Many boards are blindsided by risk events
typically possesses is the ability to adapt their that come out of the blue. In a world where
communication style to their audience. The use the pace of change is continuously increasing,
of scenario analysis provides an opportunity anticipating and responding effectively to
to engage and interact with people across an nonfinancial risks is a growing challenge. The
organisation in a fresh and dynamic way.” use of scenario analysis helps firms identify
blind spots and to better understand and
Karla Gahan respond to nonfinancial risk.”
Barnett Waddingham
Caroline Coombe
CEO, ORIC International
“The world is experiencing a step change as the power of Artificial Intelligence becomes more visible.
This will increase the need for organisations to address their Purpose in a constantly changing context.
Scenario analysis will help organisations to make better informed decisions in support of inevitable
changes to their strategy and business models.”
Julia Graham
CEO, Airmic
SCENARIO ANALYSIS 5
01 Principles of scenario analysis
Scenarios are not predictions but alternative to more complex, multi-factor future events
views of what possible events may happen. All involving an extensive chain of events, such as an
organisations will have their own set of scenarios, energy company asking itself how green technology
which can range from simple single-factor events, for could drive business strategy, and deliver new
example, a retailer asking itself what would happen products and services.
if there were a major fire at a warehouse,
Scenarios are possible worlds built from incomplete and uncertain information
“The value to Shell of producing scenarios is to help senior management think about the
long-term challenges the business could face. In this way, the thinking in Shell’s scenarios
may influence the company’s strategy – as one of many inputs – but that is as far as it goes:
scenarios are not expressions of Shell’s strategy, they are not Shell’s business plan and they
do not necessarily reflect the thinking or behaviour of the business.”
Scenario analysis helps organisations in making strategic and risk management decisions
under complex and uncertain conditions such as climate change
For a company, the ultimate purpose of scenario analysis is to understand how it might
perform under different hypothetical future climate states, thus positioning itself to make
better strategic decisions and improve its strategy resilience. Climate-related scenarios
allow an organisation to build an understanding of how the physical and transition risks
and opportunities of climate change might plausibly develop in different ways, and how the
business might be impacted over time.
Disclosure regarding strategy and scenarios is important. The Task Force on Climate-related
Financial Disclosures (TCFD) recommends disclosure of “the actual and potential impacts
of climate-related risks and opportunities on the organization’s businesses, strategy, and
financial planning where such information is material” including “the resilience of the
organization’s strategy, taking into consideration different climate-related scenarios.”
6 AIRMIC GUIDES
GUIDES
In a rapidly changing and increasingly connected uncertainty, make informed decisions and maintain
and complex world, anticipating and responding their competitive edge. By considering the range
to potential disruptions is a critical skill. As a of possible outcomes, scenario analysis can
forward-looking technique, scenario analysis can promote innovation, stimulate creative thinking
help identify and respond to potential threats and encourage the exploration of alternative
and new opportunities, and enhance business approaches when problem-solving.
resilience. Scenario analysis helps leaders navigate
SCENARIO ANALYSIS 7
01 Principles of scenario analysis
Scenario analysis should form part of the risk management framework for an organisation, but scenarios are
not risks.
Characteristic: Risks refer to the uncertainties or potential outcomes that can arise from a situation, while
scenarios are plausible narratives or alternative futures that help us explore the potential development of
events.
Probability: Risks are usually quantified by their likelihood and potential impact, allowing organisations to
prioritise and connect or aggregate them. In contrast, scenarios are not typically assigned probabilities, as
they represent a range of possibilities rather than a forecast.
Support decision-making: Risks are identified and assessed to develop strategies to manage them,
whereas scenarios are created to explore possible outcomes.
Adaptability: Risk management involves regularly monitoring and updating strategies to address changing
and emerging risks. In contrast, scenario planning involves updating the scenario to reflect defined
information and uncertainties to inform decision-making.
8 AIRMIC GUIDES
GUIDES
01
1.4 Scenario analysis: drivers and benefits
Scenario analysis is a valuable technique for Scenario analysis is also crucial for business
Improved decision-making
Engaging managers and senior stakeholders/executives in the process and related outputs
Creating better relationships across the organisation, ensuring that the impacts or threats and weaknesses for one
function are considered in view of the organisation as whole
Creating and embedding a risk-aware culture across the organisation
Meeting regulatory requirements in risk reporting, Board responsibilities and capital modelling for financial institutions
“We cannot solve our problems with the same thinking we used when we created them.”
Albert Einstein
SCENARIO ANALYSIS 9
01 Principles of scenario analysis
Scenario analysis is a powerful tool for organisations Inadequate follow-up and implementation: The
to navigate uncertainty and make informed insights gained from scenario analysis are only
decisions. However, it presents some potential valuable if they are effectively integrated into the
challenges: decision-making process. Establish a system for
monitoring progress and updating scenarios to
Overemphasis on a single scenario: It is tempting to ensure their continued relevance.
focus on the scenario perceived as the most likely
outcome. This can lead to a narrow perspective and Abdication of leadership: Understanding the
insufficient consideration of alternative possibilities. range of likely events will enable leaders to feel
To overcome this, ensure appropriate consideration prepared and communicate a single goal clearly
is given to different assumptions and drivers. and convincingly. However, leaders should not
communicate within the organisation using
Confusing scenarios with forecasts: Scenarios are scenarios.
not meant to be definitive predictions of the future
but rather plausible stories that help explore the By being aware of these challenges, organisations can
range of possible outcomes. Avoid treating scenarios enhance the effectiveness of their scenario analysis,
as forecasts and, instead, use them to gain insights be more decision-ready and make more informed and
into the potential impact of various uncertainties on resilient decisions.
the business.
Insufficient resources and expertise: Lack The objective of Purpose is to achieve clarity
of resources or expertise can lead to poorly about why an organisation exists, which
constructed scenarios. Consider investing in training, is distinct from its profit-making motive.
leveraging analytical tools, external consultants and Purpose will inform an organisation’s brand,
specialist operational risk data services. values and desired behaviours and act as a
focus for everything an organisation does.
Reliance on a snapshot of external drivers: This Organisations must remain aware of the
allows an organisation to explore a limited range constantly shifting external and internal
of uncertainties. Using data at the right scale and context. Risk professionals should be among
granularity to craft a scenario will assist. those who top management look to for
guidance when setting or resetting Purpose
Lack of stakeholder engagement: Neglecting as they can assist in the process by using
stakeholders can result in a lack of buy-in or techniques like scenario analysis to help
misaligned strategic priorities. Foster a culture of identify risks an organisation might
open communication and collaboration to encourage otherwise miss.
stakeholder participation in the process.
10 AIRMIC GUIDES
GUIDES
There can be a tendency for organisations to For example, to try and assess the impacts of
overcomplicate or be too granular in the details climate change on an organisation in a single
of scenarios. Problems can also arise if scenarios scenario is likely to lead to an overly large scenario,
are not correctly scoped for the needs of the so it may be appropriate to assess the impact
organisation. To ensure the appropriate scope of each change that climate change will bring.
boundaries are set and the appropriate level of Consider separate scenarios, one looking at the
granularity is used, it is important to start with consequences of more significant weather extremes
a thorough understanding of the questions the and another assessing the impact of sea level
scenarios are expected to address. As scenarios are change. Later on, the results of both scenarios
developed, re-testing the quality of the scenarios may be aggregated to provide the depth of
against the questions or objectives to be addressed understanding needed by the organisation for risk
will highlight whether the scenarios are correctly and planning purposes. Similarly, if the scenarios
scoped and of sufficient detail. are too narrow, consider merging scenarios.
Alex Hindson
Partner, Head of Sustainability,
Crowe U.K. LLP
Airmic Member
SCENARIO ANALYSIS 11
01 Principles of scenario analysis
Connected Risk has come of age. In this new era of whether they are cyber, geopolitical, war or natural
digital and supply chain complexity, risk managers perils – generate knock-on events, which in-turn can
need to quantify their business inter-dependencies, generate new threats.
to ensure that their operations and portfolios are
sustainable and resilient. The current reactive and siloed approach to dealing
with the circularity of threats and events is not
1. Achieving this will require four major changes: sustainable in the long term for organisations. By
2. A change in mindset of risk leaders from being moving to a more imaginative and forward-looking
reactive to proactive. scenario analysis approach, organisations can
3. an imaginative, collaborative approach to stress-test potential hits to their business and
scenario analysis. in doing so help to facilitate a more sustainable
4. joined-up exposure approach across the outcome for all involved.
company.
5. A journey from perils-based to outcome-based Scenario analysis needs to be driven by a
solutions. joined-up exposure approach across the enterprise.
This will require the enterprise to move away
The first step on the road map to dealing with from the current siloed approaches and focus on
Connected Risk, is a change in the mindset of risk cross-department collaboration. That requires a
leaders to being more proactive than reactive. Risk cultural shift in attitudes to enterprise-wide risk
leaders need to focus more on the “what if” risks. management.
Risks that may not seem important now but will
affect their organisation in the medium to long term. In the aftermath of an event impacting an
organisation, the response in dealing with the fallout
Alongside this change in mindset, organisations normally involves, though not always, multiple
should use scenario analysis to stress-test the departments working together. So why not have a
potential impact that these “what-if” risks can have cross-departmental proactive approach to prevent
on their organisations. these risks from occurring in the first place?
Scenario analysis can help an organisation to think Once an organisation has achieved the necessary
more strategically too, and they can identify potential changes required in its cultural mindset, widened
impacts of multiple, cross-connecting exposures the scenario analysis lens, and moved to a
across their business portfolios. joined-up exposure approach across the enterprise, it
is a converged framework for the business in which it
It is vital that organisations run these scenarios can build successful resilience strategies.
purely because events and threats are becoming
circular in nature. By this, we mean, that threats –
12 AIRMIC GUIDES
GUIDES
Suki Basi,
Managing Director & Founder,
Russell Group
SCENARIO ANALYSIS 13
02 A framework for scenario analysis
The seven key stages are summarised in the diagram below and are described in turn. The second half of this
Guide explains how each stage can be used.
14 AIRMIC GUIDES
GUIDES
02
Stage 1: Definition, approach & governance
Before undertaking scenario analysis, there must stakeholders and, ultimately, enhances the efficacy
Risk professionals do not need to be data analysts, but they do need to be able to work across the
organisation to produce the insight the organisation needs for decision-making under uncertainty.
Risk professionals should not own all the risks within an organisation, but they should be the trusted
partners of risk owners, able to assist in the analysis and treatment of risk. Risk professionals are not
alone in producing strategic insight for the leadership team, but risk professionals need to be able
to provide the organisation with a coherent view of how uncertainty may affect the organisation’s
objectives and how uncertainty is being managed across all parts of the organisation.
SCENARIO ANALYSIS 15
02 A framework for scenario analysis
This stage establishes clear objectives and desired • Relevant losses and insurance claims and
outcomes. The objectives will influence the notifications
governance structure and processes to be employed • Relevant external reports and materials.
throughout the scenario planning. Scenario
leaders must carefully consider the most suitable
approach for conducting the scenario exercise; The leader of the scenario exercise will develop
while workshops are often the preferred method, the workshop objectives and supporting material
alternatives such as war games can promotes and information to be shared with participants
creativity, collaboration and critical thinking, while in advance. For the majority of scenarios, pre-
providing an opportunity to learn in a controlled scenario workshop material will typically include
environment. a short description of the scenario and a number
of questions or prompts that will shape the
Risk professionals must identify the appropriate conversation.
participants for the scenario, ensuring relevant
functions are represented and at the right level of
seniority. External specialists or stakeholders may be WARGAMING
included depending on the purpose and scope of the Wargaming enables management to think
scenario. outside of conventional models to discover
threats and opportunities of strategic
Risk professionals should provide the following when choices. It can be particularly valuable in
developing the scenario to explore: situations in which the actions of external
parties could affect outcomes and generate
• The risk register including principal and second- and third-order effects. To improve
emerging risks decision-making under uncertainty,
• Matters relevant for legal and regulatory organisations can employ wargaming
compliance and simulations to identify marketplace
• Matters relevant to internal and external dynamics and rehearse, refine and test
audit strategies and responses in a
• Matters specifically raised by the leadership realistic environment.
of the organisation
• Client requirements including procurement Source: Wall Street Journal Scenario
and contractual commitments Planning and Wargaming for the
• Matters specifically raised by other external Risk Management Toolkit – WSJ
stakeholders
16 AIRMIC GUIDES
GUIDES
The purpose of the scenario discussion is to work 4. Assessment of impact, which should be quantified
through the scenario, asking the different functions and modelled in more detail where appropriate.
to identify the probability and impact on their Techniques might include Monte Carlo simulation
area of the business. A key benefit of effective and sensitivity analysis.
scenario assessment is its capacity to uncover
interrelationships between different impacts, 5. Mitigation and controls already in place, and
often revealing complex risk dynamics and proposed improvements or changes
potentially cascading effects.
6. Any additional information that should be noted
For all scenarios, it is useful to document the that affected opinions and decisions.
following:
7. Any material shifts in opinion, response or output
1. The rationale for the scenario chosen and how this from previous scenario exercises and the reasons
relates to the objectives of the organisation. behind this.
2. The storyline(s) created. Developing multiple 8. When the scenario analysis should next be
complementary storylines provides for a range conducted
of perspectives and can uncover hidden risks and
opportunities. 9. Any additional scenarios that need to be
considered as a result of the exercise.
3. Any assumptions made. This includes assumptions
about trends, potential events, their timing and the
response to these.
SCENARIO ANALYSIS 17
02 A framework for scenario analysis
Modelling is the process of creating a simplified version of a real-world situation, process or system. It helps
organisations understand complex scenarios, making it easier to understand their potential outcomes and make
informed decisions.
Validation is the process of checking whether a model accurately represents the real-world situation it aims to
simulate. By comparing the model’s projections with actual observations or data, organisations can have confidence in
the model’s ability to inform decision-making.
The output should also be assessed by the participants and alternative participants or external specialists to
sense-check the plausibility of the scenario.
Care must be taken as it is often identified that the more complex the scenario, the more likely a not-very
plausible outcome is accepted. Where possible, benchmarking the scenario against external loss data or
industry-wide information is recommended.
Identify the potential for ‘super-scenarios’ and consider the aggregation and correlation of different scenarios
for the business. Review the documentation, checking for any bias or groupthink that may have crept in.
Anchoring Relying too heavily on the first piece Example: Presenting historical loss
of information encountered when data to participants may ‘anchor’
making decisions. their frequency and severity as-
sessments, even if the information
provided is not directly relevant to
the scenario being considered.
Confirmation bias Favouring information that con- Example: Only selecting scenarios
firms one’s pre-existing beliefs and that support a positive view of a
ignoring information that contradicts particular investment, disregarding
them. any negative findings or data.
18 AIRMIC GUIDES
GUIDES
Stage 5: Reporting
The output of the exercise should be presented simulations or training and awareness programmes
to the relevant stakeholders and leadership for to ensure that relevant people are able to identify
comment and sign-off. This may include the risk or when a risk event is developing and know how to
audit committee, functional managers, the C-Suite monitor, report and react to the event.
and the Board. Scenarios should be produced in
a format and language that allows any external or Reporting agility is especially important in what
internal recipients to formulate their strategy and can seem like a perma-crisis and poly-crisis
determine immediate actions. environment, enabling risk professionals to quickly
adjust and effectively respond, ensuring resilient
While traditional forms of output like charts and operations and effective decision-making.
graphs still hold value, the advent of advanced data
analytics and AI technologies has the potential
to transform scenario analysis. Tools can already
generate interactive visualisations, simulate
complex systems and use machine learning to
predict outcomes, offering richer insights and
enhanced decision-making capabilities.
Perma-crisis: Refers to a state of constant crisis or instability where disruptive events or emergencies are the norm
rather than the exception. It implies a shift from episodic crises to a continuum of crises, demanding more flexible,
proactive and resilient approaches to risk management.
Poly-crisis: Refers to a situation where multiple crises occur simultaneously or sequentially, creating a complex and
multi-dimensional challenge. These crises may be interconnected, with one crisis potentially triggering or
exacerbating others, requiring multifaceted solutions and comprehensive management.
SCENARIO ANALYSIS 19
02 A framework for scenario analysis
Scenario analysis enables the comparison of Scenario analysis supports effective stakeholder
different outcomes, risks and rewards in order to communication by presenting clear, evidence-based
facilitate balanced, informed decisions. By actively rationales for decisions and actions. By monitoring
weighing the pros and cons, leaders can confidently outcomes, organisations can evaluate assumptions
choose strategies and action plans that align with and adjust their strategies as necessary to optimise
their organisation’s objectives and risk appetite. performance and adapt to changing conditions.
20 AIRMIC GUIDES
GUIDES
Regularly reviewing scenarios ensures that Scenarios need to be kept up to date if they are to
frameworks remain current, allowing decisions be the best possible source of information for risk
and actions to stay agile, responsive and informed response development or decision-making. This
by the latest data and insights. When significant means that the process for triggering a review must
events are foreseen or experienced, the set of be sensitive to material changes in the internal
scenarios should be checked to see if updating is and external context, the updating process should
required. Management should review whether the accommodate iterative changes and the entire
specific processes, individuals involved and output process needs to be agile so that the updating
objectives are fit for purpose. Organisations can also process does not itself become a bureaucratic
make use of external consultants and review best problem.
practices through industry forums and associations.
SCENARIO ANALYSIS 21
03 Using scenario analysis for strategic planning
Rising sociotechnical complexity and an ever- Strategic scenario planning involves examining the
faster pace of societal development mean good, business model’s sustainability in relation to the
strategically important decisions are hard to business environment. And in today’s economy, that
make, and the burden of making such decisions is environment extends to include sustainability in the
increasingly shared among several senior executives. natural environment, social responsibility and sound
With this, there has been a marked rise in the use governance. For example, creating a new product or
of scenarios for analysis and planning. Furthermore, service would require an organisation to consider
with recognition of the role played by emerging risks, the changes in its carbon footprint and how it may
established strategic risks and the need to develop reposition the organisation within society. And
a resilience strategy alongside the risk management beyond the organisation itself, these considerations
controls, risk and resilience professionals are would need to extend to the supply chain necessary
becoming more involved in the strategic planning to support that new product or service.
process.
“Traditional horizon scanning combined with reviews of internal data, such as root cause analyses,
can inform risk and opportunity assessment in complex environments. There is value in taking this
approach to informing strategy. However, there is no substitute yet for gathering people with different
perspectives together to walk through or experience a key scenario. It is one of the most powerful ways
of identifying how things might play out in reality, what opportunities could be harnessed (and how),
and what mistakes might be avoided or mitigated”.
Amanda Craib
Global Head of Strategic Change Risk and Governance | DBS & Global Function Risk
Global Operational & Resilience Risk | HSBC HOLDINGS PLC, Airmic Board Member
22 AIRMIC GUIDES
GUIDES
03
3.1 Organisational context
Organisation leaders can contribute from the outset long term. This approach will help set expectations
“Context brainstorming is particularly important in organisations where board members come from
varied backgrounds and experience; you do not want to lose that diversity of thought and approach
but provide a useful framework to focus their discussions”.
An Airmic Member
SCENARIO ANALYSIS 23
03 Using scenario analysis for strategic planning
Several useful scenario types may be helpful for highlight plausible futures and options; they do not
strategic planning purposes. An organisation’s predict a specific future.
selection should be driven by the output it requires
from its scenario planning work. Scenarios are especially useful when the situation to
Event based – what events do we see, and how will be explored has new features or when established,
our context change? well-known activities emerge in a new contextual
Financial – what events do we see, and how might setting. For example, scenarios would be an excellent
that affect our financial position? choice to explore emerging technologies, such
Behavioural – what events do we see, and how may as the Internet of Things (IOT), where everyday
this change people’s perceptions and behaviours? devices connect over the Internet. This could be in
Stress testing – what events do we see, and are we combination with the faster connection capability
sufficiently resilient to survive and prosper? of 5G. This is a complex marriage to explore as it
Back casting – what future do we want, and what combines two new technologies opening up the
events do we need to make this future more likely? possibility of more rapid, wireless, machine-to-
Beyond the scenario type, organisations may find machine communications.
it helpful to simplify the scenarios by selecting
a general viewpoint for each scenario. Here are With our example, an event-based scenario
examples, but the final choice will again depend could draw out important insights into how the
on the organisation and the output it needs for its technologies will develop over time. A financial
decision-making. scenario may lead to understanding how the price
per unit may change over time and so inform how
• World continues to develop along the same much investment should be made at any point in
trajectory time. The behavioural approach may surface risks
• The situation is cyclic, and we are at a related to uptake patterns and any fears people have
specific stage in the cycle about the new technologies and their impact on how
• A step change in capability is expected and they work or their privacy.
we need to be ready for it
• The context is changing because of a A stress scenario may explore the technology
fundamental shift in societal norms that we development risk set against the financial scenarios,
must recognise. if the financial scenarios have not already assessed
the limits of investment. And finally, a back-casting
None of these scenario types or viewpoints are scenario could identify the steps an organisation
exclusive; each provides a distinct perspective. By should take and when the organisation should take
using more than one type, deeper insight emerges, these steps to realise the opportunity. It is unlikely
and scenarios can be cross validated. Having more that all of these scenarios would be required, but the
than one scenario is good practice, as scenarios illustration stands.
24 AIRMIC GUIDES
GUIDES
Scenarios for strategic planning benefit from considering human behavioural factors, supported
having a wide range of input, which means pooling by quantitative data to make the scenario robust
knowledge from multiple people and drawing on and informative.
data from various sources. Engaging a wide range
of trusted sources will also help decision-makers Scenarios that are all speculation are likely to be
understand where the scenario can be an accurate more dangerous than valuable as they could create
guide and where the uncertainty involved suggests a a false sense of certainty about how the future
more cautious, exploratory approach may may unfold.
be needed.
Initial stages of scenario development should be
As with all scenarios, the quality of the scenario used to identify knowledge gaps and inform further
depends on the quality of the data captured and the data-gathering exercises. Developing scenarios of
open-mindedness of the scenario developers, as bias any type should be an iterative process, and the
is a significant scenario development risk. scenario developers should be driven by the data
and the plausible logic that emerges.
The data and information required for planning
purposes should be a mix of qualitative assessments
covering how a situation may unfold and
SCENARIO ANALYSIS 25
04 Using scenario analysis for operational risk
Scenario analysis is an important element of an the organisation’s risk exposure, but also fosters a
effective operational risk management framework. culture of risk awareness and preparedness.
By systematically evaluating severe yet plausible
events that could impact the operations of the The process for operational risk scenario analysis
organisation, scenario analysis allows senior is iterative and should be conducted regularly, and
managers to evaluate the potential impact on their its effectiveness is further enhanced when it is
organisation’s operations, financial position and integrated with other risk management tools and
reputation. This forward-looking approach not processes, such as stress testing, capital modelling
only enables a comprehensive understanding of and insurance purchases.
26 AIRMIC GUIDES
GUIDES
04
4.2 Using scenario analysis for capital modelling
Capital modelling is the process of assessing an By performing scenario analysis for capital
SCENARIO ANALYSIS 27
04 Using scenario analysis for strategic planning
Numerous data sources are available to organisations seeking to identify and assess operational risk scenarios,
with the most suitable options often depending on the specific circumstances of the scenario and the type and
quality of the data available. The table below outlines some common sources:
Source Description
Expert judgement The thoughts, knowledge, and experience of subject matter experts in their field
Risk and control The outputs of a risk assessment regime commonly in place within an ERM framework
self-assessment
outputs (RCSAs)
Internal loss data The data captured internally regarding risk events that have occurred within the
organisation.
Public risk event data Risk event data that is found within the public domain, e.g., ORIC International’s Newsflash
service contains over 52,000 public risk event reports
Peer loss event data Source of loss event data that is anonymously submitted by peer member firms, for example,
ORIC International’s peer event database of quantified risk and near-miss events.
Scenario Anonymised assessment data including information on the storyline and parameterisation
benchmarking approach, together with assessment data including frequency and severity assessment data,
confidence intervals, deductions and recoveries.
It is important to consider relevant external data when determining the firm’s risk profile and for
producing meaningful scenario assessments that reflect the frequency and severity of events. Peer
loss event and public domain data can be used to support and validate scenario storylines and internal
assessments. ORIC International members can benchmark their risk profile against an industry
profile developed from 18,000+ anonymised peer loss events and 52,000+ public domain risk events,
providing a cross-industry view with read-across to the firm’s risk profile. Members also have access
to a suite of benchmark scenarios with detailed descriptions of each, together with 900+ member
submitted scenarios, and assessment reference tables that provide insights on peer scenario
assessment ranges.
28 AIRMIC GUIDES
GUIDES
04
4.4 A network approach to scenario analysis
A network approach to scenario analysis offers a more comprehensive and interconnected perspective
The approach acknowledges the reality that risks are not isolated but interconnected, and by mapping out
relationships and dependencies among various risk factors, a network approach enables leaders to identify
potential cascading effects and systemic vulnerabilities that could significantly impact their operations,
financial stability and overall resilience.
1. Identify risk factors: Compile a list of internal and external risk factors that could impact the organisation.
Consider internal risks, such as operational, technological and human factors, as well as external risks, including
market, regulatory and environmental factors.
2. Define risk relationships: Consider internal risks, such as operational, technology and human factors, as well as
external risks, including market, regulatory and environmental factors.
3. Develop risk network map: Create a visual representation of risk factors and their relationships, highlighting
vulnerabilities and concentrations of risk.
4. Assign weights and probabilities: Assign relative importance and likelihood of occurrence to each risk factor and
connection in the network.
5. Perform scenario simulations: Use analytics and simulation techniques to explore risk scenarios, considering
cascading effects resulting from interconnected risk factors.
6. Analyse results: Evaluate scenario simulations to identify key risk drivers, vulnerabilities and potential mitigation
strategies. Assess for potential cascading effects and resilience.
7. Implement risk mitigation strategies: Design targeted strategies addressing significant and interconnected risks,
updating policies, procedures and contingency plans as needed.
8. Monitor and update: Regularly review and update the risk network map and scenario analysis, incorporating new
risks and adjusting relationships, weights and probabilities as necessary.
By following these steps, organisations can successfully apply a network approach to scenario analysis,
allowing them to better understand and manage the complexities of their risk landscape.
SCENARIO ANALYSIS 29
05 Using scenario analysis for insurance
Insurance, the transfer of risk to an insurance with sufficient information for the insurance
company, is a popular risk mitigation strategy that company to evaluate the risk it is accepting under
remains in widespread use. Scenarios can be used the policy.
to ensure that the insurance the organisation has or
proposes to take will be effective. A third and possibly underutilised role for scenario
analysis is to help with the selection of insurance
A common example of how scenarios can help type or the added services that may be packaged
with insurance is to match the potential negative with the insurance cover. For example, cyber
consequences of the scenario against the scope insurance is often provided with specialist services
of current insurance cover. Issues that may arise that can be parachuted into an organisation to
from this comparison can include areas where help recover from any cyber-attack. Scenarios that
policy wording is unclear, coverage is inadequate address the organisation’s cyber vulnerability may
or coverage extends beyond the needs of the be used to ensure that the right services will be
organisation and savings in premium may be made. provided when required. Another example where
scenarios may help with insurance type may be
Scenarios can also be used to surface plausible when the scenarios indicate that the scope of any
consequences that are ideally treated with a risk claim may be complex, but where the trigger event
transfer or insurance option. Results from the is well defined. In such cases, parametric cover may
scenario analysis may also help the organisation meet be a better alternative to indemnity and the quicker
its obligations (legally binding in some jurisdictions resolution of a parametric claim over an indemnity
such as the UK) to provide the insurance company claim may itself be a tactical advantage.
30 AIRMIC GUIDES
GUIDES
05
Insurance is a used by many organisations to mitigate risk and yet as a lawyer who has worked with
policyholders to manage claims and resolve insurance disputes for over 20 years, experience shows that
policy wordings often do not get the attention they deserve.
It is important when mapping different scenarios against the insurance policy coverage, its limits
and deductibles, to test not only the frequent "known" risks but also to understand how a policy will
respond under extreme stress from a low frequency but high severity incident. If the last few years
including the pandemic and the war in Ukraine have taught us anything, it is to be prepared for the
unexpected!
It is also worth considering if any of the outputs from your scenario analysis could or should form part
of your contract with insurers. I have seen this done in practice and it can be appropriate in some cases
to record the shared understanding of the parties on how the policy is to respond in certain situations
in order to minimise the risk of disputes down the line.
Finally, I would urge risk managers to include in their analysis of various scenarios, not only how an
insurance policy might respond on its terms, but also think about the practical steps the organisation
should take in the event of each scenario to protect cover. There are two essential components to
this planning. First, consider the use of claims protocols so that suitably experienced service providers
including loss adjusters and even lawyers are identified in advance. Second, develop an internal plan
within the organisation so that relevant individuals – risk managers at least, but potentially other key
operational personnel – understand not only what insurance policies are in place, but the key terms of
the policies such as notification provisions, the prohibitions against settling claims or making admissions
of liability without the insurer's consent, and the seeking of insurer consent in advance for any costs to
be incurred. It can also be helpful to engage in pre-loss planning for how to mobilise a team to preserve
evidence and engage with loss adjusters and retain experts in a first party context.
Alexander Oddy
Partner and Head of Insurance & Professional Risks
Herbert Smith Freehills LLP
SCENARIO ANALYSIS 31
06 Using scenario analysis for stress testing
Stress testing is an essential component of a The primary objective of stress testing is to evaluate
comprehensive risk management framework, an organisation’s resilience under extreme but
with scenario analysis playing a pivotal role. This plausible conditions. This could include a major
process involves crafting hypothetical situations or geopolitical crisis or a significant shift in interest
sequences of events to assess what could negatively rates. Subjecting a financial product or portfolio to
impact on operational or financial stability. these severe scenarios enables financial services
professionals to detect weaknesses and devise
These scenarios might entail single-factor or contingency plans. The results of the stress test can
multifactorial events. The range encompasses be invaluable in determining the requisite capital to
both internal risks, such as operational or financial cushion potential losses and assess the overall risk
vulnerabilities, and external risks, such as economic profile of the product or portfolio.
downturns, regulatory changes or geopolitical crises.
In the case of financial institutions, they might
consider extreme market fluctuations, credit events
or liquidity crises.
Monte Carlo simulation is a technique where the distribution of possible outcomes of a decision is
generated by a computer application that calculates an outcome repeatedly, each time using different
randomly selected variables. It is the equivalent to running thousands of ‘what if’ analyses at the
same time.
Monte Carlo simulation is especially useful in sectors and organisations with large data sets – for
example where there is a significant footfall as in the leisure industry.
32 AIRMIC GUIDES
SCENARIO ANALYSIS
GUIDES
33
06
07 Using scenario analysis for resilience
Scenario analysis has its history in preparing for • Validate the efficacy of the organisation’s
battle and therefore, unsurprisingly, the use of resilience planning
scenario planning in business continuity and crisis • Ensure the plan invocation process is fit for
management is well established. purpose
• Test the emergency messaging procedures
While business continuity relates to the capabilities In addition to the objectives, the scenario may be
of being able to continue delivery of products and driven by industry or sector trends and internal,
services within acceptable time frames at predefined external and emerging risks. The scenario may focus
capacities, a crisis can be defined as something on a single source of disruption or may present
serious for the organisation that represents a threat as a set of interconnected incidents. The level of
to its operations, strategic objectives and reputation. complexity of the design of the scenario will be
dependent on:
Increasingly, external stakeholders, including clients • the objectives of the exercise
or customers, investors and regulators, may request • the maturity of the team; and
information on how the organisation is equipped • the maturity of the organisation in relation
to resilience.
to deal with disruption. This is particularly relevant For example, an established response team may
in the context of supply chains, and evidence of the manage a complex scenario, whereas a newly
implementation of recommendations following established group or one with a number of new
exercises is now commonplace. It is even becoming members may need a simpler narrative to achieve
more commonplace for suppliers and customers to its objectives. Additionally, the method of exercise
run joint exercises to build resilience. delivery may drive the scenario design and
development. For example, a desktop exercise
Many organisations now use the word resilience is usually discussion based and is well suited to
interchangeably with business continuity, crisis an adaptive and, as needed, complex scenario. A
management and related disciplines such as disaster simulation or live exercise may need to be carefully
recovery and emergency management. For the constructed as this may play out in almost real-time.
purpose of this guide, we use the term resilience to Often consultants are involved in the creation and
refer to the collective disciplines delivery of the scenario and exercise to provide an
independent perspective as well as expertise on the
In a resilience context, the objectives of an exercise design and facilitation of the session. However, for
might include, to: the scenario to be meaningful, it should be tailored
to the organisation using specific, relevant details
• Validate the understanding of roles and where possible, for example, local landmarks, firm
responsibilities of all response team specific roles and individuals.
members
34 AIRMIC GUIDES
GUIDES
07
7.2 Selecting exercise 7.3 Reporting and
participants decision-making
SCENARIO ANALYSIS 35
08 Conclusion
Scenario analysis is a powerful tool that can be used Access to reliable and diverse sources of information
for a range of purposes, from strategic planning to and perspectives is crucial for generating
stress testing, insurance to resilience. Its strength meaningful insights.
lies in its ability to enhance decision-making by
providing valuable insights into the uncertainties By using the framework set out in this guide and
the organisation may face. By assessing different embracing scenario analysis as an integral part of
scenarios, risk professionals can identify key drivers their strategic and operational processes, risk and
and evaluate their potential effects, enabling them to insurance professionals can proactively adapt to
proactively plan and develop strategies to mitigate changing circumstances, improve resilience and
risks and seize opportunities. ultimately enhance their organisation’s ability to
adapt and thrive in an increasingly complex world.
Implementing scenario analysis is not without its
challenges. The scope of scenarios must be carefully
considered to ensure relevance and accuracy, and the
models will produce credible and reliable estimates.
Pierre Wack
‘The Father of Scenarios’
Shell
36 AIRMIC GUIDES
GUIDES
08
ANNEX ONE - CASE STUDIES
Energy firm
CONCLUSION
Stage Key Actions Participants
Assessment & - Group planning managed a series of meetings to develop Group planning
measurement specific scenarios Group risk
- Individual scenarios were developed over a number of CFO
meetings, to allow participants to return to the office Heads of functions
and consider the impact of the scenario on their area of
the business, and therefore to determine the most likely
future for the scenario
- Heads of relevant functions or their deputies attended
meetings, ensuring technical expertise as well as wider
business understanding
- Group planning attended meetings and were given an
equal role to ensure that all scenarios were considered
in terms of business planning
- Group risk acted as a ‘challenger’ in the meetings to
ensure that all assumptions were challenged and
considered in detail
- The discussion created a series of plausible but different
‘outcomes’ for the business
Validation & - The output and implications for planning were reviewed Group risk
modelling at each meeting, to sense-check the scenario Group planning
development Head of functions
- Modelling and the estimating of potential financial and
economic consequences were carried out alongside the
development of the scenarios
- Scenarios were not assessed in terms of probability, but
in terms plausibility. A wide range of plausible events
were considered, since ‘predictions’ of the future are
likely to be wrong.
SCENARIO ANALYSIS 37
08 Conclusion
Reporting - The scenario is signed off and reviewed by heads of Group risk
functions during the process Group planning
Head of functions
Decision-making and - For each issue and scenario, the implications for strategy Strategic planning
actions were considered, alongside the development of the Group risk
scenario itself
- Output was cascaded down to review how existing
strategic plans might be altered.
Process review - The organisation has largely focused on two to three- Group risk
year scenarios, but is increasingly looking at longer-term Executive management
variables including technological, environmental and
political risks
- The organisation will continue to look at the scenario
tested in terms of ‘most probable outcome’ but also
examine the plausible extremes for the variable being
investigated –i.e. a more optimistic or pessimistic view
of the scenario.
38 AIRMIC GUIDES
GUIDES
08
CASE STUDY - SCENARIO ANALYSIS
FOR CRISIS MANAGEMENT
ANNEX
FTSE 100 Technology Firm
Definition, approach - The Board of a FTSE 100 firm identified cyber risk as a Board
& governance key exposure. Board committees
- They asked the resilience team to help investigate the Resilience team
impact of a cyber incident.
- Objectives were to assess the impact on the business and
its strategy, and to review existing crisis management and
communication plans.
Framework & - Resilience team worked with internal IT security and Resilience team
planning external resilience consultants to develop a core scenario Internal IT specialists
involving the hacking of a data centre. External resilienc
- External resilience consultants created the final scenario consultants
and any associated materials required for injects / Response team
prompts.
- Crisis plans were reviewed by the resilience team and all
response team members were advised to refresh their
understanding.
- Response team members were invited to the exercise.
Assessment & - External resilience consultants facilitated the scenario External resilienc
measurement with the response team including an introduction consultants
outlining objectives and assumptions. Resilience team
- The exercise used simulated calls and discussion to Response team
progress through the scenario.
- The response team consulted the crisis management and
communication plans to help inform decision-making and
proposed actions.
- The scenario objectives measured included assignment
and understanding of team roles and responsibilities,
communication including with key external contacts and
deciding immediate remedial and recovery actions.
Validation & - External resilience consultants captured learnings and External resilienc
modelling gaps as discussed by the response team throughout the consultants
scenario. Resilience team
- Response team were invited to provide feedback on their Response team
observations and learnings from the exercise both
immediately following the session and then later by
survey.
- Results collated to be included in report.
SCENARIO ANALYSIS 39
08 Conclusion
Decision-making and - Board and risk committee assessed effectiveness of Resilience team
actions exercise in meeting objectives set at the outset. They Response team
agreed and actioned implementation of Internal and externa
recommendations. stakeholders
- Board assessed whether further scenarios and exercises
are required to assess alignment with original objectives
and asked for an additional scenario to be considered.
- Resilience team action recommendations and liaised with
others across the organisation and external sources with
active roles in this process.
- Response team were informed of updates / changes to
the plan.
- Response team were trained on process changes.
Process review - Response team ran through amendments to assess if Resilience team
amended process is fit for purpose and suggested any Response team
further changes. Internal and external
- Resilience team worked with external resilience stakeholders
consultants to create several additional scenarios
focussed on smaller scale events to be used by both the
response team and others across the organisation to test
response capability. Also consideration of
including external stakeholder in scenarios, for example,
key suppliers.
- Additional scenarios included in exercise schedule for
the organisation.
40 AIRMIC GUIDES
GUIDES
ANNEX TWO
FURTHER SOURCES OF INFORMATION
Operational Risk Loss Data | ORIC International The Use of Scenario Analysis in Disclosure of
1. Founded in 2005, ORIC International facilitate Climate-related Risks and Opportunities – TCFD
the anonymised and confidential exchange of Knowledge Hub (tcfdhub.org)
operational risk intelligence between member firms,
providing a diverse, high-quality pool of quantitative 4. The Financial Conduct Authority (FCA) and the
and qualitative information on operational risk Prudential Regulatory Authority (PRA) have also
scenarios, exposures and benchmarking services. published work on climate risk produced by their
Climate Financial Risk Forum.
Operational Risk Loss Data | ORIC International
2. Shell has been developing possible visions of the CFRF Guide 2023: Scenario analysis: Guide for
future since the early 1970s, helping generations Asset Managers (fca.org.uk)
of Shell leaders, academics, governments and
businesses to explore ways forward and make 5. The World Economic Forum (WEF) also publishes
better decisions. scenarios that can be used as sources of information
for organisations. As of 2022, and in recognition of
Warning Extract: Shell’s scenarios are not intended the substantial geopolitical changes that have taken
to be projections or forecasts of the future. They place, the WEF has published a set of four scenarios
are not Shell’s strategy or business plan. They for globalisation.
are designed to stretch management to consider
even events that may only be remotely possible. Four Futures for Economic Globalization:
Scenarios, therefore, are not intended to be Scenarios and Their Implications | World Economic
predictions of likely future events or outcomes and Forum (weforum.org)
investors should not rely on them when making
an investment decision with regard to Shell plc
securities.
SCENARIO ANALYSIS 41
Contributors
This Guide is dedicated to the memory of Jenna Andrews, whose inspiring legacy continues to resonate
through the pages of this work.
42 AIRMIC GUIDES
GUIDES
SCENARIO ANALYSIS 43
Marlow House
1a Lloyd’s Avenue
London
EC3N 3AA
+44 207 680 3088
enquiries@airmic.com
www.airmic.com