FRM Exam Part II · Risk Identification

Scenario Analysis and Stress Testing in Operational Risk

Updated 11 October 2026 · Fact-checked

Operational risk scenario analysis uses structured expert workshops to estimate the frequency and severity of severe but plausible loss events, especially where loss data is thin. You prepare, run the workshop, challenge biases, quantify, validate, then feed results into capital and management decisions. Stress testing applies a defined shock to a measure.

Understand Scenario Analysis and Stress Testing

Internal loss data covers only what has already happened. Rare, severe events such as a major cyber attack, a rogue trader or a prolonged system outage may never have hit your bank. Scenario analysis fills that gap. Experts from the business, risk, technology, legal and finance build a forward-looking picture of a loss event and estimate how often it could happen and how bad it could be.

The usual process has stages. First, preparation: select the scenarios to cover, using risk taxonomy, loss data, external events, RCSA results and key risk indicators. Second, the workshop: a facilitator guides participants through the event, its causes, the controls that would fail, and the impact. Third, quantification: the group estimates frequency and severity, often a typical loss, a severe loss and a worst-case loss. Fourth, validation and review: the second line challenges the output, and results are documented and approved by governance.

Expert judgment is subjective, so biases matter. Anchoring: estimates stick to a first number, such as last year's loss or a figure the facilitator mentioned. Availability: recent or vivid events seem more likely than they are. Overconfidence: ranges are too narrow. Confirmation bias: people favour evidence that supports their view. Groupthink and motivational bias (hierarchy, or fear of showing a weak control environment) also distort results. Good facilitation, independent challenge, diverse participants, and showing ranges instead of single points reduce these.

The key distinction: scenario analysis builds a plausible event story and asks what the loss would be. Stress testing applies severe changes to risk drivers or inputs, such as a market shock or a rise in default rates, and measures the effect on losses, capital or liquidity. In practice the terms overlap. Operational risk scenarios often form part of enterprise stress testing.

Results are used for the capital model (as input where loss data is sparse), for assessing the risk profile against appetite, for finding control weaknesses, and for deciding on mitigation such as insurance, control investment or limits. Scenarios must be severe but plausible, and refreshed regularly.

Key formulas to remember

Expected annual loss from a scenario: Expected annual loss = frequency per year × average severity per event; Use it to compare scenarios. Frequency is the expected number of events per year, not a probability, when events can repeat.
Frequency from a return period: Annual frequency ≈ 1 ÷ return period in years; A 1-in-20-year event has frequency about 0.05. Approximate for rare events.
Scenario process order: Preparation → Workshop → Quantification → Validation and challenge → Use and review; Know the sequence and what each stage controls.

How to solve Scenario Analysis and Stress Testing questions

Use this approach for any question on scenario analysis or stress testing.

1Identify what is asked: process step, bias, comparison with stress testing, or use of results.
2Locate the stage of the process (preparation, workshop, quantification, validation, use).
3If a bias is described, match the behaviour to its definition: first number sticks is anchoring, recent or vivid events is availability, too-narrow ranges is overconfidence.
4If numbers are given, compute frequency and severity, then expected annual loss, and check units and time period.
5Ask whether the scenario is severe but plausible and uses the right data sources.
6Choose the control or fix: independent challenge, diverse participants, range estimates, structured facilitation, documentation.
7Check the answer against the stated purpose: capital input, risk profile, or mitigation decision.

Quickest way: Match the clue to the concept

When to use it: Use when you have about a minute per question and the stem describes a behaviour or a stage.

Underline the key clue in the stem: first number, recent event, narrow range, senior person speaking, applied shock.
Map it: first number is anchoring; recent event is availability; narrow range is overconfidence; deference to seniors is motivational bias or groupthink; applied shock to a driver is stress testing.
Eliminate options that describe the wrong stage or reverse the cause and effect.
For arithmetic, multiply frequency by severity and check you used per year.

Common mistakes in Scenario Analysis and Stress Testing

Confusing anchoring with availability.
Both involve past information shaping estimates.
Fix: Anchoring is fixation on a reference number. Availability is overestimating what is easy to recall, like a recent or dramatic event.
Treating scenario analysis as the same as historical loss data analysis.
Both feed operational risk capital.
Fix: Scenarios are forward-looking and expert-based. Loss data is backward-looking. Scenarios cover events not yet seen.
Saying scenarios should be the worst imaginable event.
Severe is read as extreme.
Fix: Scenarios must be severe but plausible. Implausible events are not useful for management or capital.
Using a single point estimate as the final answer.
It looks simpler.
Fix: Good practice records ranges and uncertainty, since single points encourage anchoring and false precision.
Assuming the business unit alone should own and validate scenarios.
The business knows the risk best.
Fix: The business supplies expertise, but the second line provides independent challenge and governance approves the results.
Mixing up scenario analysis and stress testing.
The terms are often used loosely.
Fix: Scenario analysis builds a specific event story with frequency and severity. Stress testing applies a shock to inputs and measures the effect. Say which one the stem describes.

Worked examples

Example 1

In an operational risk scenario workshop at a bank, the facilitator opens by saying last year's largest fraud loss was USD 4 million. Participants then estimate the severe loss for a new fraud scenario at between USD 3.5 million and USD 4.5 million, though the new scenario involves a much larger business line. Which bias is most likely, and what is the best remedy? Options for the bias: A. Availability B. Anchoring C. Confirmation D. Groupthink

Show the solution

The facilitator gave a specific number first.
Estimates cluster tightly around that number despite a different, larger exposure.
This is fixation on an initial reference value, which is anchoring.
Availability would involve overweighting a recent vivid event, not a number offered at the start.
Remedy: have participants estimate independently before any number is shown, and base estimates on exposure and control analysis.

Answer: B. Anchoring. Collect independent estimates first and avoid stating reference figures at the start.

Example 2

A scenario workshop estimates a data-centre outage with a frequency of 1 in 10 years and an average severity of USD 25 million per event. A second scenario, payment fraud, has frequency 0.5 per year and average severity USD 3 million. Which has the higher expected annual loss, and what is the combined total?

Show the solution

Outage frequency = 1 ÷ 10 = 0.1 per year.
Outage expected annual loss = 0.1 × 25 = USD 2.5 million.
Fraud expected annual loss = 0.5 × 3 = USD 1.5 million.
Outage is higher.
Total = 2.5 + 1.5 = USD 4 million per year.

Answer: The outage scenario has the higher expected annual loss (USD 2.5 million versus USD 1.5 million). Combined expected annual loss is USD 4 million. This ignores correlation and tail severity, which matter for capital.

Exam tips

Learn each bias as a one-line definition plus a typical clue, as questions describe behaviour without naming the bias.
Remember the process order and who does what: business experts, facilitator, second-line challenge, governance approval.
For comparison questions, say scenario analysis is event-based and expert-driven, while stress testing applies shocks to risk drivers.
Expect a link to use: scenarios supplement sparse loss data in capital models and highlight control weaknesses.
Watch for words like severe but plausible, independent challenge and documentation, as correct options often use them.

Practice questions from Risk Identification

Scenario Analysis and Stress Testing in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Scenario Analysis and Stress Testing: frequently asked questions

What is the difference between scenario analysis and stress testing?

Scenario analysis builds a specific plausible event, such as a major cyber breach, and estimates its frequency and loss. Stress testing applies a severe change to inputs or risk drivers and measures the effect on losses, capital or liquidity. In practice scenarios are often used as part of a stress test.

How do you run a scenario workshop in operational risk?

Prepare by choosing scenarios from loss data, RCSAs, external events and indicators. Bring together diverse experts and a skilled facilitator, walk through causes, control failures and impacts, then estimate frequency and severity as ranges. Document the reasoning and send results for independent challenge.

Which biases matter most in scenario analysis for FRM Part II?

Anchoring, availability and overconfidence are the main ones, along with confirmation bias, groupthink and motivational bias. Know the definition and a typical example of each. Remedies include independent estimates, structured facilitation and challenge by the second line.

Why do banks need scenario analysis if they have loss data?

Loss data shows only past events, and severe tail events are rare. Scenarios let experts consider events that have not happened to the bank but could. They supplement data in capital models and management decisions.