How can you determine risk severity in scenario analysis?

While I agree with conceptual severity assessment technique mentioned above, I believe the evolution of business environment and the volume of transactions lead to a more advanced risk severity technique which is more than just likelihood and impact. Business context, internal & external factors, and human capitla are just examples of other factors which affect risk severity.

Risk severity, combining likelihood and impact, is foundational. However, a challenge arises in dynamic environments where both factors can shift rapidly. Traditional models may fall short in predicting "black swan" events—rare but high-impact risks. While a risk matrix offers a snapshot, it might not capture evolving risks in real-time. Incorporating continuous feedback loops and leveraging AI can help dynamically adjust risk profiles. Furthermore, considering interdependencies between risks, where one event triggers another, adds depth. Thus, while severity gauges current threats, a forward-looking, interconnected approach ensures comprehensive risk management.

In a manufacturing context, risk severity could be applied when assessing a supplier's reliability. A high likelihood of supplier delays (e.g., due to a history of missed deadlines) combined with a high impact on production (e.g., significant delays in customer orders) results in a severe risk that demands urgent mitigation.

Scenario analysis allows organizations to gauge risk severity by exploring various scenarios and their potential outcomes. This involves identifying key drivers, creating scenarios, estimating likelihood and impact, and assigning a risk severity score or rating. In a retail company, they utilized scenario analysis to assess the risk severity of supply chain disruptions. By considering scenarios like natural disasters, labor strikes, or transportation issues, they estimated their likelihood and impact on product availability. This allowed them to prioritize risk mitigation strategies based on severity.

In a financial institution, scenario analysis helped assess risk severity related to interest rate changes. By creating scenarios of rate fluctuations, they gauged their impact on loan portfolios. This comprehensive approach enabled them to fine-tune risk strategies and align them with the severity of potential rate shifts.

During a pharmaceutical company's scenario analysis for drug development, challenges arose in estimating the likelihood and impact of regulatory changes. Subjectivity among experts and limited historical data complicated the process. Overcoming these challenges required rigorous validation and consultation with regulatory experts.

Although easy to read, the heat map sometimes could cause ambiguity on deciding the action to be taken. The scenarios and assumptions could be complex and extensive to capture possible risk events while the results are only marked by colours. Therefore in my view, one of the real challenges is to how to train people to interpret the results to management levels simple enough for their correct understanding.

In the technology sector, scenario analysis was used to assess cybersecurity risks. To address challenges related to uncertain attack vectors, they collaborated with ethical hackers, drew data from various threat intelligence sources, and employed consistent criteria for assessing potential breach scenarios. Using visual heat maps, they communicated the severity of these cybersecurity risks effectively.