Aggregating 200 Small Risks for the Board
A manufacturing firm has 200 plant-level risk scenarios in its register, each with an ALE between $20,000 and $150,000. Summed, the ALEs total $8.4M. The board's tolerance is $6M at the 90th percentile of annual loss. Most scenarios are small, local failures: pump failures, conveyor jams, localized power interruptions. But 160 plants run the same ERP system, and a single ransomware or supply-chain attack on that ERP could affect all plants at once. The CISO wants to present the $8.4M sum as the enterprise risk figure. The CFO calls it 'conservative' because it adds everything up. The risk team has 20 person-days and no enterprise loss history; plant managers can provide local estimates. The audit committee wants to know whether the firm is within tolerance before approving a $4M ERP security upgrade.
1. Explain why the $8.4M sum may overstate or understate enterprise risk, and what determines which.
Read the worked answer
The $8.4M is a sum of expected annual losses, not a percentile. If the 200 local failures are largely independent, the portfolio's 90th percentile is much lower than the sum of individual 90th percentiles because of diversification. In that case the sum overstates the chance of a bad year, though it remains a valid expected-loss figure. If a shared ERP creates common-cause risk, losses correlate: one ransomware event can trigger many plant-level scenarios at once. Then the tail can approach or exceed the sum of means, and the sum may understate the 90th percentile. The key determinants are dependence and the severity distribution. The board tolerance is a percentile, so presenting a sum of means answers a different question.
2. Design a practical aggregation approach within 20 person-days.
Read the worked answer
De-duplicate and group the 200 scenarios by common asset, threat community, and loss event. Build 5 or 6 aggregate scenarios: independent local equipment failures, ERP ransomware, supply-chain attack, regional power interruption, and so on. For local failures, use frequency-severity distributions from plant managers and assume independence or mild correlation. For the ERP scenario, model one event affecting 160 plants with correlated downtime and recovery. Use calibrated estimates for local and IT inputs, then run a Monte Carlo with an explicit correlation assumption. Test sensitivity to that assumption. Present a loss exceedance curve and the 90th percentile, with contribution by aggregate scenario. Document that precision is limited but the dependency structure is visible.
3. How do you answer the CFO's claim that the sum is conservative, and what do you present to the audit committee?
Read the worked answer
The sum of means is not automatically conservative. It can overstate the 90th percentile when losses are independent, and understate it when a shared ERP drives correlation. A truly conservative bound would assume perfect correlation and add the 90th percentiles, but that is unrealistic and would not help prioritize. Present the loss exceedance curve, the 90th percentile against the $6M tolerance, and the contribution of the ERP aggregate scenario. Show how the $4M upgrade reduces the correlated tail, not just the sum of small ALEs. State the correlation assumptions and sensitivity. The audit committee needs to see whether residual risk is within tolerance and why the upgrade changes the tail, not a single summed figure.