Applying Open FAIR to Risk Scenarios and Decision Support
What the domain tests
Application questions test whether you can turn a business decision into a scoped FAIR scenario, compare treatment options, and communicate results without overstating precision.
Core rules
- Start from the decision: accept, avoid, reduce, or transfer risk. Each option changes specific factors.
- Compare options on risk reduction, cost, and residual risk, using distributions. A control that lowers LEF from 2.0 to 0.5 against $1M LM reduces expected loss by $1.5M per year before control cost.
- Use loss exceedance curves to show tail risk and tolerance breaches.
- Communicate ranges, assumptions, and confidence. Do not present a single number as certainty.
- Risk transfer shifts financial consequence, not the loss event; residual risk remains.
Worked example
A payment fraud scenario has LEF 2 per year and LM $1M, expected loss $2M. Control A costs $150k per year and cuts LEF to 0.5; expected loss falls to $0.5M, saving $1.5M, net benefit $1.35M. Control B costs $400k and cuts LM to $600k; expected loss falls to $1.2M, net benefit $0.4M. On expected value, A wins; but check the tail. If B reduces a $5M tail event and tolerance is $3M, B may still be preferred.
Traps
Comparing only control cost; ignoring secondary loss; using ALE without uncertainty; assuming insurance removes risk; confusing risk appetite with tolerance; presenting heat-map labels as quantified risk.