4D Analytics: Unique to Risk Insights

The purpose of Risk Insights 4D Analytics™ approach is to gain enough information to make a first-pass at estimating and evaluating uncertainty, and to do so in a way that elicits the information in a way that is comfortable for those providing the estimates e.g. not using High-Medium-Low ratings! Undertaking a straightforward first-pass in this way enables decisions to be made on where to focus further activity as required, such as deeper dive analysis or Monte Carlo simulation.

Risk Interconnection Map is an unique way of presenting risk information. Compared to Probability Impact matrices which only display severity and likelihood, the interconnection map enables four dimensions to be visualized:

Risk likelihood – pessimistic and optimistic scenarios
Risk severity – worst-case and best-case
Risk interconnection – identify the connections between risks
Strength of interconnection – identify your most influential and influenced risks

Identify Interconnections

Risks Interconnections Map

The Risks Interconnections Map shows how all risks are connected to others and underlines the importance of dealing with risk in an holistic manner. The map visualises the strength of connection between individual risks – the most strongly connected risks could merit additional attention due to the multiple ways they affect or are affected by other risks.

Uncertainty Management terminology

Present use of the term ‘risk’ is ambiguous. Best practice regards risk as encompassing both threat and opportunity, but guidance often speaks in terms of threat management, and in common parlance risk is more usually synonymous with threat.  An obvious first step towards uncertainty management is to remove this ambiguity by using the term ‘uncertainty’ in the everyday sense of‘ lack of certainty’ as a starting point.

Risk management Uncertainty management
a downside risk a threat (giving rise to downside risk)
an upside risk an opportunity (giving rise to upside risk) a source of
uncertainty
a risk (upside or downside) a source of uncertainty
a (possible) source of risk a problem an issue
an impact a consequence/effect
a weakness an issue
a poor allocation inadequate an inappropriate/unclear allocation Inappropriate
avoid risk resolve uncertainty
mitigate modify
lack of shortage or surplus of
major risk significant uncertainty
absence of availability of

Reverse stress testing

Reverse stress testing consists in identifying a significant negative outcome and then identifying the causes and consequences that could lead to such an outcome. In particular, a scenario or combination of scenarios that threaten the viability of the institution’s business model is of particular use as a risk management tool in identifying possible combinations of events and risk concentrations within an institution that might not be generally considered in regular stress testing.

SYSC20 introduced rules on reverse stress testing, which require a firm to identify and assess events and circumstances that would cause its business model to become unviable. This chapter also requires the firm’s senior management or governing body to review and approve the results of the reverse stress testing exercise. This should help the firm’s senior management to identify the firm’s vulnerabilities and design a strategy to prevent or mitigate the risk of business failure.

The reverse stress testing requirements are an integral component of a firm’s business planning and risk management under SYSC.

In policy statement 09/20, “Stress and Scenario Testing Feedback on CP08/24 and final rules”, the Financial Services Authority introduced reverse stress-testing requirements for firms to identify and assess scenarios most likely to cause their current business models to become unviable.

The benefits of reverse stress testing are:

  • Helping firms to understand key risks and scenarios that may put business strategies and continuance as a ‘going concern’ at risk; and
  • Providing management and regulators with qualitative information on the potential vulnerabilities faced by the business so that they can identify appropriate actions that should be taken to manage such risks.

The key messages for firms are summarised as follows:

  • Board and senior management should actively engage in stress and scenario testing, taking ownership and responsibility for establishing an effective stress testing programme and infrastructure in the firm.
  • Senior management should take a key role in implementing the firm’s stress testing programme by being actively involved throughout the process, including in scenario selection.
  • Senior management should take action as a result of stress testing and integrate stress testing outputs into the firm’s decision-making process.
  • Firms should establish a stress testing programme covering all relevant levels of its business, all risk types and over a range of severities.
  • Stress and scenario testing should be undertaken on a forward-looking basis, with sufficient use of firm-wide stress testing helping firms to identify risk concentrations, assess interdependencies and understand second-order effects.
  • Firms should establish a robust stress testing infrastructure with appropriate IT systems and resources in place. The infrastructure should be periodically reviewed by senior management for its continued effectiveness.
  • Firms should have clearly documented policies and procedures to enable effective implementation and maintenance of the stress testing programme, which should be periodically reviewed by senior management.