Scenario analysis (operational risk)

Roles that need it

• Operational Risk Analyst
• Risk Advisory Consultant
• Internal Auditor
• Cybersecurity GRC Consultant

Skills it belongs to

• Scenario and sensitivity analysis
• Risk judgment and escalation instinct
• Internal controls and risk oversight

Related concepts

• Operational riskOperational risk is the risk of loss from inadequate or failed internal processes, people and systems, or from external events. It includes legal risk and excludes strategic and reputational risk. Examples are fraud, processing errors, cyber incidents and outages.
• Operational loss eventAn operational loss event is an incident from a process, people, system or external failure that causes a financial loss, a near miss or a gain. Banks record each event with dates, amounts, recoveries and an event type in a loss database used for analysis and capital.
• RCSA (risk and control self-assessment)A risk and control self-assessment is the periodic exercise in which a business unit identifies its operational risks, rates inherent risk, assesses how well its controls work and derives the residual risk. Results are challenged by the second line and lead to actions where residual risk exceeds appetite.
• Stress test (supervisory)A supervisory stress test projects a bank's capital under a common adverse macroeconomic scenario over several years. The EBA coordinates the EU-wide exercise every two years, and the results inform Pillar 2 guidance. Banks also run internal stress tests for the ICAAP and ILAAP.

Sources

• Revisions to the principles for the sound management of operational risk, BIS (external site) accessed 31 Oct 2026

Updated 31 Oct 2026.