Quantitative Risk Analysis and Decision-Making

Introduction

Risk management requires more than identifying hazards. Managers must estimate how often adverse events may occur, how severe their consequences may be, and whether the cost of reducing risk is justified. Quantitative risk analysis converts uncertain outcomes into numerical estimates that support pricing, insurance purchasing, capital allocation, investment decisions, and control design.

Quantitative analysis does not eliminate uncertainty. Its purpose is to make assumptions visible, compare alternatives consistently, and clarify the trade-offs between risk and return. The quality of a result depends on the quality of the data, model structure, assumptions, and managerial interpretation.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain probability distributions and their use in risk analysis.
2. Calculate expected loss, variance, and standard deviation.
3. Apply frequency–severity models to aggregate losses.
4. Use expected utility and decision trees in risk decisions.
5. Conduct scenario and sensitivity analysis.
6. Calculate and interpret Value at Risk (VaR), including its limitations.
7. Explain the role of stress testing, model governance, and ethical judgment.

1. Probability as a Foundation of Risk Analysis

Probability represents uncertainty about possible outcomes. A random variable assigns numerical values to uncertain events. A discrete random variable has countable outcomes, while a continuous random variable can take values across an interval.

For a discrete random variable X with outcomes xᵢ and probabilities pᵢ:

Here, E[X] is the expected value, xᵢ is outcome i, and pᵢ is its probability. The probabilities must satisfy pᵢ ≥ 0 and ∑ᵢpᵢ = 1. Expected value is a probability-weighted average, not necessarily an outcome that will actually occur.

For a continuous random variable, probabilities are described by a probability density function f(x), and:

The density must be non-negative and integrate to 1 over its possible range.

Common distributions in risk management

Distribution selection should be based on empirical evidence, domain knowledge, and diagnostic testing. A normal distribution may be convenient but is inappropriate for quantities that cannot be negative or that exhibit substantial right-skewness.

Probability, dependence, and correlation

Two risks may be independent, meaning the occurrence of one does not change the probability of the other. In practice, risks often have common drivers. Flood claims may increase together across a region, and credit defaults may rise during a recession. Ignoring dependence can materially understate aggregate risk.

Correlation measures linear association, but zero correlation does not generally imply independence. Dependence should therefore be investigated using economic reasoning, historical data, stress scenarios, and, where appropriate, dependence models.

2. Expected Loss and Dispersion

Expected loss is the long-run average loss implied by a probability model:

where L is loss, Lᵢ is a possible loss amount, and pᵢ is its probability. Expected loss is central to insurance pricing, provisioning, and cost–benefit analysis. An insurer may charge a premium above expected loss to cover expenses, risk capital, profit, and uncertainty.

Variance measures the average squared deviation from the mean:

where μ = E[L]. Standard deviation is the square root of variance:

Variance has squared monetary units, while standard deviation has the same units as the loss and is therefore easier to interpret. These measures are descriptive; they do not by themselves indicate whether a risk is acceptable.

Worked example: expected loss and volatility

Suppose an investment project has the following annual loss distribution:

Expected loss is:

Thus, the expected annual loss is $14,000. For variance, calculate the probability-weighted squared deviations from 14,000:

Therefore:

The standard deviation is $14,000. The relatively large dispersion compared with the mean reflects the influence of the infrequent $100,000 loss.

3. Frequency–Severity Models

Many insurance and operational risks consist of two components:

• Frequency: the number of loss events in a period.
• Severity: the monetary size of each event.

Aggregate loss is represented by:

where N is the random number of events, Xⱼ is the severity of event j, and S is total loss. The model assumes that N and the severities are appropriately specified; a common simplifying assumption is independence between frequency and severity and between individual severities.

If the expected frequency is E[N] = λ and individual severity has mean E[X] = μₓ, then:

Under independence, with Var(N) = σ²_N and Var(X) = σ²_X:

This is the random-sum variance formula. It separates severity uncertainty from frequency uncertainty.

For a Poisson frequency distribution, Var(N) = E[N] = λ, giving:

Worked frequency–severity example

A warehouse expects 3 theft claims per year. The average claim is $8,000, with a severity variance of $16,000,000. Assume claim frequency is Poisson and independent of severity.

Expected aggregate loss:

Aggregate variance:

Thus:

The expected annual loss is $24,000 and the aggregate standard deviation is approximately $15,492. A risk manager may use these estimates when setting a deductible, purchasing insurance, or determining a reserve.

The model becomes more complex when claims are correlated, policy limits apply, deductibles reduce observed severity, or inflation changes claim amounts. Simulation is often used when a closed-form calculation is unavailable.

4. Expected Utility and Risk Preferences

Expected monetary value treats one dollar as equally valuable regardless of the decision-maker’s wealth. Expected utility allows the value of money to depend on preferences toward risk.

For alternatives A with possible outcomes xᵢ and probabilities pᵢ:

where u(x) is the utility function. A risk-averse decision-maker has a concave utility function, such as:

where w is final wealth and w ≥ 0. Because of concavity, the utility of expected wealth is greater than or equal to expected utility:

This relationship is Jensen’s inequality for a concave utility function. It explains why a risk-averse individual may pay a premium to avoid an uncertain loss.

The certainty equivalent is the guaranteed wealth CE that gives the same utility as the risky prospect:

The risk premium is the difference between expected wealth and the certainty equivalent:

The risk premium depends on preferences, not solely on statistical risk.

Illustration

A person with current wealth of $100,000 faces a 50% chance of losing $36,000 and a 50% chance of losing nothing. With u(w) = √w:

The certainty equivalent is:

Expected final wealth is $82,000, so this calculation indicates an inconsistency: the certainty equivalent cannot exceed expected wealth for a concave utility function. Rechecking the arithmetic, √64,000 ≈ 252.98 and √100,000 ≈ 316.23; therefore EU ≈ 284.61 and CE ≈ $81,000. The risk premium is approximately $1,000. This example demonstrates why numerical verification is essential.

5. Decision Trees

A decision tree represents sequential choices and uncertain events. Decision nodes are usually shown as squares, chance nodes as circles, and terminal outcomes at the ends of branches. The analysis proceeds by rollback: calculate expected values or expected utilities at the final chance nodes and then select the best decision at each decision node.

Figure: A simplified decision tree for choosing insurance.

Decision trees are useful when choices occur over time, information arrives sequentially, or management can respond to an event. Their limitations include large tree size, subjective probabilities, and difficulty representing continuous outcomes or dependence.

6. Scenario and Sensitivity Analysis

Scenario analysis evaluates coherent combinations of assumptions, such as a base case, adverse case, and severe-but-plausible case. Scenarios should tell an economically consistent story rather than simply applying arbitrary shocks.

Sensitivity analysis changes one input at a time, or varies inputs systematically, to identify which assumptions most affect the result. Common techniques include:

• one-way sensitivity analysis;
• two-way tables;
• tornado diagrams;
• break-even analysis; and
• Monte Carlo simulation.

If profit is P = Revenue − Cost and revenue is $1,000,000 while cost is $750,000, profit is $250,000. If cost rises by 12%, the revised cost is $840,000 and profit becomes $160,000. The calculation reveals substantial sensitivity to cost inflation. Sensitivity analysis does not assign probabilities unless probabilities are explicitly added; it explores conditional outcomes.

7. Value at Risk

Value at Risk summarizes a loss distribution by a percentile. At confidence level c, VaR is the loss threshold that is not exceeded with probability c over a specified horizon:

where L is loss and c is commonly 0.95 or 0.99. For a one-day 95% VaR of $2 million, the interpretation is that, under the model and conditions used, daily loss is expected to exceed $2 million on approximately 5% of days. VaR is not the maximum possible loss and says nothing directly about the size of losses beyond the threshold.

Parametric normal VaR

If portfolio return R is normally distributed with mean μ_R and standard deviation σ_R, and loss is defined as the negative return on portfolio value V, a commonly used approximation is:

where z_c is the c-quantile of the standard normal distribution. This formula assumes a normal return distribution, stable parameters, a defined time horizon, and consistent scaling. If μ_R is negligible, VaR is approximately Vz_cσ_R.

For a $10 million portfolio with daily σ_R = 1% and zero expected return, 95% VaR is approximately:

Square-root-of-time scaling, such as σ_T ≈ σ_1√T, is only defensible under assumptions including independent, identically distributed returns with stable variance. Volatility clustering and serial dependence weaken this approximation.

Historical and Monte Carlo VaR

Historical VaR revalues the current portfolio using historical changes. It is transparent but depends heavily on the chosen sample period and may fail when the future differs from the past. Monte Carlo VaR simulates risk-factor changes from specified distributions and revalues the portfolio. It can represent complex instruments but is sensitive to model assumptions and computational implementation.

Expected Shortfall, also called Conditional VaR in some contexts, measures the average loss beyond the VaR threshold:

Expected Shortfall gives information about tail severity and is generally more informative than VaR for extreme-loss management, although it too depends on data and model quality.

8. Stress Testing

Stress testing examines the effect of severe but plausible conditions. Examples include a major interest-rate increase, a sharp currency depreciation, a cyberattack, a pandemic-related shutdown, or a regional catastrophe. Stress tests may be:

• Historical: replaying a past crisis;
• Hypothetical: constructing a forward-looking event;
• Reverse stress tests: identifying conditions that would cause failure; or
• Sensitivity-based: applying a specific shock to one or more variables.

Stress testing complements, rather than replaces, probability-based models. A low-probability event may be poorly represented in ordinary data but still threaten solvency. Results should be translated into management actions, such as liquidity reserves, reinsurance, hedging, limits, or contingency plans.

9. Integrated Illustrative Case: Meridian Retailers

This is a fictional illustrative case.

Background

Meridian Retailers operates 50 stores. It faces annual cyber incidents, property losses, and business interruption. Management must choose between purchasing insurance and retaining more risk through a higher deductible.

Problem

The risk team estimates cyber incident frequency as Poisson with expected frequency λ = 2 per year. Average gross severity is $120,000, with severity variance of $14,400,000. A policy costs $180,000 annually and covers losses above a $25,000 deductible, subject to a sufficient policy limit.

Analysis

Before considering the deductible, expected annual cyber loss is:

The aggregate variance is:

Thus aggregate standard deviation is approximately $7,589? No: √57,600,000 ≈ $7,590 only if the variance is 57.6 million; this is correct numerically, but it is implausibly low relative to the stated severity variation. Rechecking: 120,000² = 14,400,000,000, not 14,400,000. Therefore:

This correction illustrates the importance of unit consistency: monetary variance is measured in dollars squared.

The deductible changes the severity distribution. If Y = max(X − 25,000, 0), the insurer’s payment per claim is Y, while Meridian retains the first $25,000 of each claim. The team cannot correctly estimate insured loss by simply subtracting $25,000 from expected annual loss unless every claim exceeds the deductible. It must estimate E[Y] from claim-level data or a fitted severity distribution.

Approach and solution

Meridian should:

1. fit frequency and severity distributions using internal and external data;
2. model the deductible and policy limit explicitly;
3. simulate annual aggregate losses;
4. compare the premium with retained expected loss, capital requirements, and risk appetite;
5. conduct stress tests for a coordinated attack affecting several stores; and
6. review insurer credit quality, exclusions, waiting periods, and claims-payment conditions.

Outcome

Suppose simulation indicates that the policy reduces the 99th-percentile annual cyber loss from $1.10 million to $420,000, while the retained expected loss is $145,000. The premium is economically meaningful, but the decision cannot be based on expected loss alone. If Meridian’s available risk capital is only $500,000, transferring tail risk may be appropriate even if the premium exceeds the expected insured payment.

Learning points

The case demonstrates that frequency–severity analysis, contract terms, tail measures, capital constraints, and qualitative coverage conditions must be considered together. A mathematically attractive result may be operationally misleading if exclusions, dependence, or parameter uncertainty are ignored.

10. Governance, Ethics, Technology, and Limitations

Quantitative models can create false confidence. Important limitations include poor data, structural model error, parameter uncertainty, regime change, omitted dependence, non-stationary distributions, and behavioral responses to controls or insurance.

Model governance should include documented purpose, data lineage, validation, independent review, performance monitoring, version control, and clear approval authority. Managers should distinguish:

• aleatory uncertainty, arising from natural variability; and
• epistemic uncertainty, arising from incomplete knowledge or model limitations.

Ethically, analysts should not select a distribution merely because it produces a favorable capital or pricing result. Assumptions, exclusions, confidence levels, and tail limitations should be communicated clearly to decision-makers. Artificial intelligence and machine learning can improve claims classification, anomaly detection, and scenario generation, but they may reproduce historical bias, obscure reasoning, or fail under conditions not represented in training data. Human oversight, explainability, privacy protection, and monitoring for drift are essential.

Best practice is to combine quantitative estimates with expert judgment, stress testing, conservative controls, and explicit risk appetite. Models should support decisions, not replace accountability.

Chapter Summary

Quantitative risk analysis represents uncertain losses through probabilities, distributions, and aggregate models. Expected loss measures the probability-weighted average outcome, while variance and standard deviation describe dispersion. Frequency–severity models separate the number of events from the size of each event and provide a foundation for insurance and operational-loss analysis.

Expected utility incorporates risk preferences and explains why decision-makers may pay to reduce uncertainty. Decision trees organize sequential decisions and uncertain outcomes. Scenario and sensitivity analysis reveal how results change under alternative assumptions. VaR summarizes a loss percentile, but it does not describe losses beyond that threshold; Expected Shortfall and stress testing provide additional insight into tail risk.

Reliable analysis requires sound data, appropriate assumptions, unit checks, model validation, dependence analysis, and ethical communication. Professional risk decisions integrate model outputs with capital capacity, contractual terms, operational realities, and organizational risk appetite.

Key Terms

Probability distribution: A representation of possible outcomes and their probabilities.

Random variable: A variable whose numerical value depends on an uncertain outcome.

Expected loss: The probability-weighted average loss.

Variance: The probability-weighted squared dispersion around the mean.

Standard deviation: The square root of variance, expressed in the original units.

Frequency: The number of loss events during a specified period.

Severity: The monetary size of an individual loss event.

Aggregate loss: The total of all losses in a specified period.

Poisson distribution: A distribution commonly used for event counts over an interval.

Expected utility: The probability-weighted utility of possible outcomes.

Risk aversion: A preference for a certain outcome over a risky outcome with the same expected value.

Certainty equivalent: A guaranteed outcome with utility equal to the utility of a risky prospect.

Decision tree: A graphical structure representing decisions, chance events, and outcomes.

Scenario analysis: Evaluation of coherent alternative states of the world.

Sensitivity analysis: Examination of how results respond to changes in assumptions.

Value at Risk: A loss percentile at a specified confidence level and horizon.

Expected Shortfall: The average loss conditional on exceeding a VaR threshold.

Stress testing: Assessment of outcomes under severe but plausible conditions.

Model risk: The possibility that a model is unsuitable, incorrectly implemented, or misused.

Risk appetite: The amount and type of risk an organization is willing to accept.

Review Questions

Short Answer Questions

1. Distinguish between frequency and severity in an insurance loss model.
2. Why is standard deviation easier to interpret than variance for monetary losses?
3. What does a 99% one-day VaR measure?
4. Explain the difference between scenario analysis and sensitivity analysis.
5. Why can correlation be important when aggregating risks?

Long Answer Questions

1. Explain how expected loss, variance, and standard deviation support insurance and operational-risk decisions. Include their limitations.
2. Derive and explain the frequency–severity aggregate-loss formulas under independence assumptions.
3. Discuss expected utility, risk aversion, certainty equivalents, and the economic rationale for insurance.
4. Compare parametric, historical, and Monte Carlo VaR methods.
5. Explain how stress testing and model governance complement probability-based risk analysis.

Analytical / Application Questions

1. A firm expects four claims per year, with average severity of $15,000 and severity variance of $25,000,000. Assuming Poisson frequency and independence, calculate expected aggregate loss and aggregate variance.
2. A portfolio worth $20 million has daily volatility of 1.2% and negligible expected return. Using a normal model, estimate one-day 95% VaR with z₀.₉₅ = 1.645, then identify two reasons the estimate may be unreliable.
3. Design a decision tree for a firm choosing whether to retain or insure a cyber risk. Specify the required probabilities, costs, terminal outcomes, and at least two qualitative factors that a purely monetary expected-value calculation would omit.

Multiple Choice Questions with Answers

Question 1

A loss has outcomes of $0 with probability 0.8 and $50,000 with probability 0.2. What is its expected loss?

A. $5,000

B. $10,000

C. $25,000

D. $40,000

Correct Answer: B. $10,000

Question 2

Which distribution is commonly used to model the number of events occurring in a fixed interval?

A. Poisson

B. Normal

C. Lognormal

D. Uniform

Correct Answer: A. Poisson

Question 3

Under independence, if expected frequency is λ and mean severity is μₓ, aggregate expected loss is:

A. λ + μₓ

B. λ − μₓ

C. λμₓ

D. λ/μₓ

Correct Answer: C. λμₓ

Question 4

For a concave utility function, a decision-maker is generally:

A. Risk seeking

B. Risk neutral

C. Risk averse

D. Indifferent to wealth

Correct Answer: C. Risk averse

Question 5

A 95% VaR of $2 million means that, under the model, loss exceeds $2 million with approximately what probability over the stated horizon?

A. 1%

B. 5%

C. 50%

D. 95%

Correct Answer: B. 5%

Question 6

Which measure describes the average loss conditional on exceeding a VaR threshold?

A. Expected loss

B. Standard deviation

C. Expected Shortfall

D. Correlation

Correct Answer: C. Expected Shortfall

Question 7

A key limitation of normal VaR is that it may:

A. Require no assumptions

B. Capture all extreme tail behavior perfectly

C. Understate skewness and fat-tail risk

D. Measure only claim frequency

Correct Answer: C. Understate skewness and fat-tail risk

Question 8

What does sensitivity analysis primarily examine?

A. How results change when assumptions change

B. Whether probabilities sum to zero

C. Only historical claims frequency

D. The legal validity of an insurance contract

Correct Answer: A. How results change when assumptions change

Question 9

If a Poisson frequency variable has expected value λ = 6, its variance is:

A. 0

B. 3

C. 6

D. 36

Correct Answer: C. 6

Question 10

Which practice is most directly associated with model governance?

A. Hiding assumptions from users

B. Independent validation and documented data lineage

C. Using the most complex model available

D. Ignoring model performance after implementation

Correct Answer: B. Independent validation and documented data lineage