Probability, Statistics and Risk Analytics

Introduction and context

Risk management converts uncertainty into information that supports action. In banking, finance and insurance, decisions are rarely based on a single known outcome. A borrower may repay, default or repay late; an investment may gain or lose value; an insurer may experience few or many claims. Probability and statistics provide disciplined ways to describe these possibilities, estimate their frequency and evaluate their financial consequences.

Risk analytics is not the elimination of uncertainty. It is the process of measuring uncertainty, identifying its drivers, communicating its magnitude and selecting responses that are proportionate to the organization’s risk appetite. Quantitative results must therefore be interpreted alongside data quality, model assumptions, expert judgment, regulation and ethical considerations.

Learning objectives

By the end of this chapter, students should be able to:

1. Explain probability concepts and distinguish discrete from continuous random variables.
2. Calculate and interpret expected value, variance, standard deviation and covariance.
3. Explain correlation and regression in financial and insurance applications.
4. Construct and interpret confidence intervals.
5. Apply scenario analysis and simulation to risk decisions.
6. Select suitable visualizations for risk data.
7. Recognize data, model, estimation and governance limitations.

1. Probability as a language of uncertainty

A sample space, written Ω, is the set of all possible outcomes. An event A is a subset of Ω. The probability of A, written P(A), satisfies 0 ≤ P(A) ≤ 1. For mutually exclusive events A and B, P(A ∩ B) = 0. The complement of A is Aᶜ, and:

For any two events:

The subtraction avoids counting the intersection twice. Conditional probability measures the probability of A given that B has occurred:

If A and B are independent, knowledge of B does not change the probability of A, so P(A | B) = P(A) and P(A ∩ B) = P(A)P(B). Independence is a strong assumption and should not be inferred merely because two variables appear unrelated.

Bayes’ theorem updates an initial probability using new evidence:

In credit risk, A might represent default and B might represent a missed payment or deteriorating financial ratio. Bayes’ theorem emphasizes that the predictive value of evidence depends both on the evidence and on the initial or base-rate probability of default.

Random variables and distributions

A random variable assigns a numerical value to each outcome. A discrete random variable has countable outcomes, such as the number of claims. A continuous random variable can take values across an interval, such as a daily percentage return or loss severity.

A probability mass function gives probabilities for discrete values. A probability density function describes relative concentration for a continuous variable; the probability of an exact continuous value is generally zero, and probabilities are obtained over intervals. A cumulative distribution function is:

Important distributions include:

Distribution choice should follow the data-generating process, not convenience. Financial returns often display skewness, excess kurtosis and volatility clustering, making a normal model inadequate for some applications.

2. Expected value and dispersion

The expected value is the probability-weighted average of possible outcomes. For a discrete variable X with values xᵢ and probabilities pᵢ:

where ∑pᵢ = 1. For a continuous variable with density f(x), E[X] = ∫xf(x)dx, provided the integral exists. Expected value is a long-run average, not necessarily an outcome that can occur in a single trial.

Variance measures average squared deviation from the mean:

where μ = E[X]. Standard deviation is:

Variance is expressed in squared units, while standard deviation has the same units as X. For a sample of n observations x₁, …, xₙ, the usual unbiased sample variance is:

The n − 1 denominator corrects, under standard random-sampling assumptions, for estimating the population mean from the same data. It does not correct for non-representative sampling, measurement error or dependence.

Worked example: expected loss

An insurer estimates that a policy has a 0.97 probability of no claim, a 0.02 probability of a claim costing £10,000 and a 0.01 probability of a claim costing £40,000. Let L denote the loss.

The expected loss is £600 per policy before expenses, capital costs, profit and other adjustments. The variance is:

The large standard deviation relative to the expected loss shows why an insurer needs reserves and capital even when the average loss is modest.

For a portfolio, expected loss is often decomposed as:

This identity is useful when the three components are defined consistently. Probability of default is a probability, loss given default is generally a proportion between zero and one, and exposure at default is a currency amount. Correlation among defaults and uncertainty in each estimate still matter for unexpected loss and capital assessment.

3. Covariance, correlation and portfolio risk

Covariance describes whether two variables tend to move together:

A positive covariance indicates aligned deviations from means; a negative covariance indicates opposite deviations. Covariance depends on measurement units, so correlation standardizes it:

Correlation lies between −1 and +1. A value near zero indicates weak linear association, not necessarily independence. Correlation does not establish causation and can change substantially during crises.

For a two-asset portfolio with weights w₁ and w₂, returns R₁ and R₂, and w₁ + w₂ = 1:

The covariance term explains diversification. If correlation is below +1, portfolio risk may be less than the weighted average of individual risks. Diversification reduces unsystematic risk but cannot remove all market, liquidity, credit or systemic risk.

4. Regression and predictive risk analytics

Regression estimates the relationship between a dependent variable and one or more explanatory variables. A simple linear model is:

Here yᵢ is the outcome, xᵢ is the predictor, β₀ is the intercept, β₁ is the slope and εᵢ is the unexplained error. The estimated slope in ordinary least squares is:

and β̂₀ = ȳ − β̂₁x̄. The slope measures the predicted change in y for a one-unit increase in x, holding other included variables fixed. Units must be stated: a slope could represent a percentage-point change in default rate per one percentage-point change in unemployment.

The coefficient of determination is:

where SSE is the sum of squared residuals and SST is the total sum of squares. R² describes in-sample variation explained by the model; it is not proof of causality, robustness or predictive performance.

Risk models require diagnostics. Analysts should examine residual patterns, outliers, influential observations, multicollinearity, changing variance, autocorrelation and out-of-sample performance. For binary default outcomes, logistic regression is often more suitable than ordinary linear regression because it models probability between zero and one:

The coefficients operate on log-odds rather than directly on probability. Interpretation should therefore use predicted probabilities or odds ratios, especially when communicating with non-specialists.

5. Sampling and confidence intervals

A confidence interval quantifies sampling uncertainty around an estimate. If a population standard deviation is known and a sample mean x̄ is based on n independent observations from a normal population, a two-sided 95% confidence interval is:

When σ is unknown and the sample is reasonably independent, it is usually replaced by s and the t critical value:

The standard error of the mean is s ÷ √n. A 95% confidence interval means that a method used repeatedly would capture the fixed population parameter in approximately 95% of repeated samples under its assumptions. It does not mean there is a 95% probability that the fixed parameter lies in one already-calculated interval.

For a sample proportion p̂, a large-sample approximate interval is p̂ ± z√[p̂(1 − p̂) ÷ n], but this approximation can be poor for small samples or proportions near zero or one. Exact or improved methods may be preferable.

Confidence intervals become narrower with larger samples, but larger sample size does not remove systematic bias. A very large sample drawn from the wrong population can produce a precisely estimated but misleading result.

6. Scenario analysis and stress testing

Scenario analysis evaluates outcomes under coherent assumptions about events such as recession, interest-rate shocks, exchange-rate depreciation, falling property prices or an unusually severe claims season. A scenario is not necessarily assigned a probability. This distinguishes it from an expected-value forecast.

A practical scenario process is:

1. Define the decision, portfolio and time horizon.
2. Identify material risk drivers and their baseline values.
3. Construct internally consistent adverse, central and favourable scenarios.
4. Map drivers into revenues, losses, liquidity, capital and solvency measures.
5. Challenge assumptions and examine second-round effects.
6. Compare results with risk appetite, limits and contingency plans.

Sensitivity analysis changes one factor or a small set of factors to identify exposure. Stress testing changes several linked factors and may incorporate management actions. Reverse stress testing starts with an unacceptable outcome, such as a capital breach, and asks which combination of events could produce it.

Scenarios should be plausible enough to support decisions but severe enough to reveal vulnerability. Historical scenarios can be supplemented by hypothetical scenarios because the future may contain combinations not observed in available data.

7. Simulation and Monte Carlo methods

Simulation repeatedly generates outcomes from specified probability models. In Monte Carlo simulation, random draws are used to estimate a distribution of portfolio results, losses or cash flows.

A basic workflow is:

1. Specify uncertain inputs and their distributions.
2. Specify dependence among inputs.
3. Draw a random value for each input.
4. Calculate the resulting financial outcome.
5. Repeat many times.
6. Summarize the simulated distribution using means, percentiles, tail losses and charts.

For simulated losses L₁, …, Lₘ, the estimated mean is:

An empirical 99th percentile is estimated by sorting the simulated losses and selecting the appropriate order statistic. Exact position conventions vary when the percentile falls between observations; the convention must be documented.

Simulation is powerful because it can represent nonlinear payoffs, multiple risk factors and complex dependencies. It does not create knowledge from nothing. Results are conditional on the input distributions, dependence structure, scenario range, random-number quality and implementation. Reproducible seeds, validation tests, sensitivity analysis and independent review are important controls.

8. Data visualization for risk decisions

Effective visualization makes distributions, trends, concentrations and exceptions visible. Suitable choices include:

Axes, units, time period, sample size and source should be shown. Truncated axes, inappropriate three-dimensional effects, excessive precision and undisclosed exclusions can mislead decision-makers. A chart should distinguish observed data from model output and should not imply certainty that the analysis does not support.

9. Illustrative case: retail bank stress analysis

Background

This fictional case concerns Meridian Bank, which has a £200 million residential mortgage portfolio. Historical analysis suggests a baseline annual probability of default of 1.5%, loss given default of 35% and exposure at default equal to the current balance for a simplified analysis.

Problem

Senior management wants to know how a recession could affect expected credit loss and capital planning. The portfolio is concentrated in one region, and historical data contain few severe downturns.

Analysis

Under the baseline assumptions:

The risk team constructs an adverse scenario in which unemployment rises, house prices decline and refinancing becomes more difficult. The model assumes probability of default rises to 4%, loss given default rises to 45% because collateral recovery weakens, and exposure remains £200 million.

The increase is £2.55 million, or approximately 243% relative to baseline. This calculation is not a forecast of the exact loss. It is a conditional estimate under stated assumptions.

The bank then simulates borrower-level outcomes, allowing income, loan-to-value ratio and regional house prices to vary. It tests alternative default correlations because defaults may become more synchronized in a recession. Results are displayed as loss distributions and compared with provisions, capital buffers and risk appetite.

Approach and solution

Management approves tighter underwriting for high loan-to-value lending, enhanced monitoring of borrowers with payment difficulties and a contingency funding review. Model outputs are supplemented by expert challenge because the downturn is outside much of the historical sample.

Outcome and learning points

The case demonstrates that expected loss depends on several components, not only default frequency. Stress assumptions can affect both default probability and recovery. Correlation and concentration can make portfolio losses more severe than a simple average suggests. Finally, a model result is useful only when its assumptions, uncertainty and management implications are clearly communicated.

10. Limitations, governance and ethical practice

Risk analytics faces several recurring limitations:

• Data quality: Missing, inconsistent, stale or inaccurately classified records distort estimates.
• Selection bias: Defaults observed in a historical sample may not represent the current population.
• Non-stationarity: Relationships can change after regulation, technology, economic shocks or customer behaviour changes.
• Model risk: Incorrect specifications, coding errors or unsuitable distributions can produce false confidence.
• Parameter uncertainty: Estimated probabilities and correlations are themselves uncertain.
• Tail uncertainty: Extreme outcomes are rare, so data provide limited evidence about them.
• Dependence risk: Assuming independence can materially understate aggregate losses.
• Overfitting: A model may fit historical noise and fail on new data.

Good governance includes documented purpose and scope, data lineage, clear ownership, independent validation, performance monitoring, back-testing where suitable, change control and an audit trail. Models should be tested under ordinary and stressed conditions, and limitations should be reported to decision-makers.

Ethical practice requires lawful and proportionate data use, privacy protection, security controls and fair treatment of customers. Automated credit or insurance decisions can reproduce historical discrimination through proxy variables or biased samples. Institutions should assess fairness, explainability, appeal processes and the consequences of errors. Compliance with applicable data-protection, consumer-protection, prudential and model-risk requirements is part of sound risk management, not an alternative to it.

Artificial intelligence can assist anomaly detection, document processing and nonlinear prediction, but it introduces risks involving opacity, data drift, leakage, adversarial manipulation and unstable performance. Human oversight, independent testing and clear accountability remain necessary.

Best-practice checklist

A defensible risk analysis should:

1. Define the decision, population, horizon and units.
2. Use data that are relevant, representative and traceable.
3. State assumptions and distinguish observed facts from estimates.
4. Select distributions and models based on evidence and purpose.
5. Test sensitivity, scenarios and alternative specifications.
6. Validate both calculations and implementation.
7. Report uncertainty, tail risk and limitations.
8. Use clear visualizations and explain their interpretation.
9. Connect results to limits, capital, pricing or operational action.
10. Monitor outcomes and revise models when conditions change.

Chapter Summary

Probability provides the formal language for uncertain events, while distributions describe possible values and their likelihoods. Expected value measures a probability-weighted average; variance and standard deviation measure dispersion. Covariance and correlation explain joint movement and are central to portfolio diversification, although correlation is not causation or independence. Regression estimates relationships and supports prediction, but requires diagnostic testing and careful interpretation.

Confidence intervals express sampling uncertainty under stated assumptions. Scenario analysis and stress testing examine conditional outcomes, including severe but plausible conditions. Monte Carlo simulation can represent complex uncertainty, but its results depend on model inputs and dependence assumptions. Data visualization helps reveal distributions, trends, concentrations and tail outcomes. Across all methods, data quality, non-stationarity, model risk, governance, ethics and clear communication determine whether quantitative analysis supports responsible decisions.

Key Terms

Probability: Numerical measure between zero and one representing uncertainty about an event.

Conditional probability: Probability of an event given information about another event.

Random variable: Numerical representation of outcomes from a random process.

Probability distribution: Description of possible values and their probabilities.

Expected value: Probability-weighted average outcome.

Variance: Expected squared deviation from the mean.

Standard deviation: Square root of variance, expressed in the original units.

Covariance: Measure of joint directional variation between two variables.

Correlation: Standardized measure of linear association between variables.

Diversification: Reduction of portfolio-specific risk through combining exposures.

Regression: Statistical method for estimating relationships between variables.

Residual: Difference between an observed value and a model-predicted value.

Confidence interval: Range produced by a method intended to capture a population parameter at a stated long-run rate.

Scenario analysis: Evaluation of outcomes under specified assumptions about risk drivers.

Stress testing: Assessment of performance under severe adverse conditions.

Monte Carlo simulation: Repeated random sampling used to estimate an outcome distribution.

Model risk: Risk of loss or poor decisions caused by model weaknesses or misuse.

Data bias: Systematic distortion arising from how data are collected, measured or selected.

Tail risk: Risk associated with unusually extreme outcomes.

Risk appetite: Amount and type of risk an institution is willing to accept.

Review Questions

Short Answer Questions

1. What is the difference between a discrete and a continuous random variable?
2. Define expected value and explain why it may not be an actual observable outcome.
3. Why does correlation not prove causation?
4. What does a 95% confidence interval mean under repeated sampling?
5. State two limitations of Monte Carlo simulation.

Long Answer Questions

1. Explain how expected loss is calculated in a credit-risk setting and discuss the assumptions behind the calculation.
2. Compare covariance and correlation, including their units, interpretation and limitations.
3. Explain the role of regression diagnostics in validating a risk model.
4. Distinguish sensitivity analysis, scenario analysis, stress testing and reverse stress testing.
5. Discuss how data quality, model risk and ethics affect automated financial risk decisions.

Analytical / Application Questions

1. A portfolio has a 2% probability of default, a 40% loss given default and £50 million exposure at default. Calculate expected loss and explain why realized loss may differ.
2. Two assets have standard deviations of 10% and 15%, weights of 60% and 40%, and correlation of 0.20. Calculate portfolio variance using the two-asset formula and explain the diversification effect.
3. Design a stress-testing framework for a bank exposed to rising interest rates and falling property prices. Identify risk drivers, assumptions, outputs, governance controls and limitations.

Multiple Choice Questions with Answers

Question 1

A loss has probabilities 0.8 for £0, 0.15 for £1,000 and 0.05 for £4,000. What is its expected loss?

A. £200

B. £350

C. £500

D. £1,667

Correct Answer: B. £350

Question 2

Which measure is expressed in the same units as the original risk variable?

A. Variance

B. Covariance

C. Standard deviation

D. Coefficient of determination

Correct Answer: C. Standard deviation

Question 3

If two variables have correlation −1, what does this indicate in the ideal linear case?

A. No relationship of any kind

B. A perfect negative linear relationship

C. A perfect positive linear relationship

D. Statistical independence necessarily holds

Correct Answer: B. A perfect negative linear relationship

Question 4

In the expected-loss identity, which three components are multiplied?

A. Interest rate, maturity and inflation

B. Probability of default, loss given default and exposure at default

C. Mean, median and mode

D. Revenue, expense and capital

Correct Answer: B. Probability of default, loss given default and exposure at default

Question 5

What is the primary purpose of a confidence interval?

A. To guarantee the future value of a parameter

B. To quantify sampling uncertainty around an estimate

C. To remove all systematic bias

D. To prove that a regression is causal

Correct Answer: B. To quantify sampling uncertainty around an estimate

Question 6

Which method begins with an unacceptable outcome and investigates combinations of events that could produce it?

A. Reverse stress testing

B. Random sampling

C. Descriptive visualization

D. Ordinary averaging

Correct Answer: A. Reverse stress testing

Question 7

A major reason for using a t critical value instead of 1.96 is that the analyst has:

A. A known population standard deviation and a huge sample

B. An unknown population standard deviation and sampling uncertainty

C. No observations at all

D. A perfectly deterministic process

Correct Answer: B. An unknown population standard deviation and sampling uncertainty

Question 8

What does Monte Carlo simulation primarily do?

A. Eliminates model assumptions

B. Uses repeated random draws to estimate an outcome distribution

C. Guarantees accurate tail probabilities

D. Replaces governance and validation

Correct Answer: B. Uses repeated random draws to estimate an outcome distribution

Question 9

Which visualization is generally most suitable for examining the relationship between two numeric variables?

A. Scatter plot

B. Pie chart

C. Single-value display

D. Unordered text list

Correct Answer: A. Scatter plot

Question 10

Why can a large sample still produce a misleading risk estimate?

A. Large samples always increase variance

B. Sampling bias or model misspecification may remain

C. Expected value cannot be calculated from data

D. Correlation becomes exactly zero

Correct Answer: B. Sampling bias or model misspecification may remain