Risk analysis methods and indicators

Abstract#

This chapter moves from the concepts of risk (Chapter 3) to specific methods of risk analysis and their application in business planning. It presents a system of four principal methods: sensitivity analysis answers the question “what matters?”, scenario analysis “what could happen?”, Monte Carlo simulation “what is the probability?”, and risk indicators “how much are we risking?” These methods are not competitors; they form a progressively deepening analytical sequence in which each level supplements the previous one and answers an increasingly complex question.

The central thesis of the chapter is that risk analysis is not a single universal tool but a structured system in which each element has clear capabilities and limits. Sensitivity analysis identifies critical variables but ignores their interaction. Scenario analysis captures structural breaks but depends on subjective probabilities. Monte Carlo simulation integrates uncertainty quantitatively but carries the errors in its assumptions over into the results with statistical precision. Risk indicators (VaR, CVaR, degrees of leverage) provide standardised metrics but may create an illusion of false security. Effective risk analysis requires all four methods to be combined, with a conscious awareness of the limits of each and with the principle of proportionality applied: the complexity of the analysis must match the scale of the decision.

The theoretical part traces the development of the methods from the first application of Monte Carlo to investments by Hertz (1964), through the scenario revolution of Kahn and Wack, to the theory of coherent risk measures by Artzner and colleagues (1999), which changed the paradigm of bank regulation. The analytical part presents thirteen formulas (4.1–4.13) with numerical examples. They cover the elasticity coefficient, the expected value and variance of scenarios, the Monte Carlo confidence interval, the break-even point, the degrees of operating and financial leverage, parametric VaR, CVaR, the expected monetary value of a decision tree, the Omega ratio, maximum drawdown (MDD) and the Sobol’ index of global sensitivity analysis. The chapter builds directly on the risk concepts and basic measures of Chapter 3 (the standard deviation, beta, Sortino, the coefficient of variation), deepening them and adapting them to practice. It also prepares the ground for Chapter 5 (diversification decisions), Chapter 11 (the sensitivity analysis of WACC) and Chapter 14 (real options and decision trees).

Learning outcomes#

After reading this chapter and completing the exercises, the reader will be able to:

1. Recognise which of the four questions — “what matters?”, “what could happen?”, “what is the probability?”, “how much are we risking?” — a particular risk analysis method answers, and state its place in the analytical sequence (recognition).
2. Explain why VaR is not a coherent risk measure and what practical consequence of this led to the regulatory move to CVaR (comprehension).
3. Calculate the elasticity coefficient, the expected value of scenarios with the variance, the Monte Carlo confidence interval, the break-even point with the degrees of leverage, and VaR and CVaR, and interpret each result for a decision (application).
4. Analyse the reliability of the results of a risk analysis: distinguish parametric from structural error, and recognise the signs of spurious precision and of anchoring to the base scenario (analysis).
5. Construct an integrated risk analysis of an investment project in which sensitivity, scenario and probabilistic analysis lead to a justified decision, including the alternative of staged investment (synthesis).
6. Assess what level of risk analysis complexity is proportionate to the scale of a particular decision, and justify why a broader analysis would in this case be a waste of resources or, on the contrary, is necessary (evaluation).

4.1 Theoretical part#

4.1.1 Historical and conceptual context#

From intuition to the structured management of uncertainty#

Risk has always been assessed in business decisions, but for a long time this was a matter of intuition, experience and instinct rather than the object of a structured analytical process. Knight’s (1921) distinction, discussed in Chapter 3, between risk (where the distribution of outcomes is known a priori or from past statistics) and true uncertainty (where there is no basis for classifying cases, so probability remains unmeasurable) was for a long time a philosophical distinction with no practical tools. The methods of this chapter — sensitivity analysis, scenarios, Monte Carlo and risk indicators — are precisely the tools which, over seven decades of evolution, have made it possible to turn Knight’s distinction into a practical analytical system.

The first steps: engineering and war (1940–1960)#

The Monte Carlo method — today one of the most powerful tools of risk analysis — was born not in finance but in physics. In 1946 the mathematician Stanisław Ulam, while recovering from an illness and playing solitaire, realised that the behaviour of complex systems could be studied not by solving equations analytically but by generating a large number of random trials and observing the distribution of the results (Eckhardt, 1987). In March 1947 John von Neumann set out in a letter how this idea could be turned into a computational procedure, and in the same year it was applied to neutron scattering calculations at the Los Alamos laboratory. The name “Monte Carlo” was chosen as a reference to the famous casino in Monaco — a symbol of gambling and chance (Metropolis & Ulam, 1949).

In parallel, in the post-war period, Herman Kahn at the RAND Corporation began to apply the scenario method — structured thinking about alternative futures. Kahn used scenarios not for forecasting but for the systematic exploration of the strategic possibilities of nuclear war. His book On Thermonuclear War (1960) caused a public controversy but established scenario planning as a serious analytical discipline. Kahn’s main contribution was epistemological: scenarios are not forecasts; they are structured hypothetical narratives, intended not to guess the future but to widen the thinking horizon of decision-makers (Kahn & Wiener, 1967).

The revolution in finance: Hertz and the risk analysis of investments (1964)#

The breakthrough in finance came in 1964, when David B. Hertz published the article “Risk Analysis in Capital Investment” in the Harvard Business Review — the first systematic application of the Monte Carlo method to investment decisions. Hertz argued that traditional investment appraisal, based on a single “most likely” scenario, is fundamentally wrong: it ignores the dispersion of results and creates an illusion of false certainty. Instead, Hertz proposed assigning a frequency distribution to each factor that determines the return and obtaining by simulation not a single value of the indicator but the whole distribution of the rate of return on the investment (Hertz, 1964). A year earlier, Hillier (1963) had taken a similar direction as one of the first to propose probability distributions for investment indicators — present value, annual costs and the internal rate of return.

Hertz’s article was innovative not only methodologically but also epistemologically. He was the first to state clearly an idea that today seems obvious: a single-figure assessment may look accurate, but it says nothing about uncertainty. This idea is directly linked to the phenomenon of spurious precision discussed in Chapter 2 — a complex model that gives one specific result may be less informative than a simpler model that shows a range of possible results.

Yet for decades Hertz’s ideas remained more theoretical than practical, not because of conceptual shortcomings but because of technological limits. In 1964 Monte Carlo simulation required a mainframe computer; its practical application in business planning became possible only in the 1970s and 1980s, with the arrival of personal computers and spreadsheet add-ins such as @RISK.

The scenario revolution: Shell and the oil crisis (the 1970s)#

The scenario method moved from military strategy to the business world through one of the most telling cases in the history of management. Pierre Wack, an analyst in the planning department of Royal Dutch Shell, began to apply structured scenarios to the analysis of the oil market in the late 1960s. At that time one assumption dominated: the price of oil would remain stable and predictable, because the countries of the Organization of the Petroleum Exporting Countries (OPEC) would have no motivation to change supply drastically. Wack assessed each producer by its reserves and by its ability to use oil revenues productively, and saw that no country had both, so the producers had no reason to expand production in line with growing demand. At the same time, the import needs of the consuming countries were due to begin growing much faster than before. It was precisely this gap that constituted OPEC’s future power; when the oil crisis of 1973 became reality, Shell’s management was prepared for it, although not for its timing (Wack, 1985).

Wack’s contribution was not only practical but also conceptual. He formulated the principle of “breaking mental models”: the true value of scenarios lies not in predicting the future but in forcing managers to question their deep-rooted assumptions about how the world works. This is directly linked to the cognitive biases discussed in Chapter 3, particularly the anchoring effect and overconfidence.

Peter Schwartz, a former Shell strategist, later democratised the scenario method by founding the Global Business Network (GBN) and writing the book The Art of the Long View (1991), which became a guide to practical scenario planning. Schoemaker (1995) gave the method an academic foundation by describing a structured process for building scenarios.

Sensitivity analysis: from engineering to finance#

Sensitivity analysis — the simplest but often the most practical tool of risk analysis — has no single “father” and no clear moment of birth. It arose naturally from engineering and scientific practice: any model requires an understanding of which input parameters affect the result most. In finance, sensitivity analysis became an inseparable part of modelling along with the spreadsheet revolution (see Chapters 1 and 2): when VisiCalc and Excel made it possible to change assumptions interactively, “what if?” questions became part of an analyst’s everyday practice.

Saltelli and colleagues (2008) systematised the methodology of global sensitivity analysis (GSA), which assesses the effect on the model result not only of individual variables but also of their interactions.

The revolution in risk measures: from VaR to coherent measures (1994–1999)#

The last major methodological breakthrough occurred in the field of risk indicators. In 1994 JP Morgan publicly released RiskMetrics — a standardised methodology for calculating Value at Risk (VaR) which, as discussed in Chapter 3, for the first time turned a complex risk model into a publicly available standard. VaR quickly found its way into the capital requirements of banks as well. In 1996 the Market Risk Amendment of the Basel Committee allowed banks to use internal models to calculate their capital requirements (see Chapter 3). However, VaR has a major shortcoming, which the financial crisis of 2008 exposed on a wide scale: VaR shows a loss threshold that under “normal” conditions is not exceeded with a stated probability, but it says nothing about what happens when those conditions are breached.

A theoretical answer to this shortcoming had already been given before the crisis by Artzner, Delbaen, Eber and Heath (1999) in their influential article “Coherent Measures of Risk”, in which they formulated four axioms that a “good” risk measure must satisfy: monotonicity, subadditivity, positive homogeneity and translation invariance. VaR does not always satisfy the subadditivity axiom. This means that combining two portfolios may theoretically increase VaR, although diversification ought to reduce risk. Conditional Value at Risk (CVaR), also called Expected Shortfall, satisfies these axioms, and the Basel Committee therefore moved, in the Basel III reform and through the Fundamental Review of the Trading Book (FRTB), from VaR to Expected Shortfall as the principal regulatory risk measure.

Synthesis: a system of four methods#

Figure 4.1. The evolution of risk analysis methods and their interrelationships

graph LR
    subgraph "1940s–1960s"
        A["Ulam & von Neumann<br/><i>The Monte Carlo method</i><br/>1946–1949"]
        B["Kahn (RAND)<br/><i>Scenario planning</i><br/>1960s"]
    end
    subgraph "1960–1990"
        C["Hertz<br/><i>MC for investments</i><br/>1964"]
        D["Wack (Shell)<br/><i>Business scenarios</i><br/>1970s"]
        E["Hillier<br/><i>Probabilistic investment indicators</i><br/>1963"]
        F["@RISK, Crystal Ball<br/><i>Spreadsheet add-ins</i>"]
    end
    subgraph "1990–present"
        G["JP Morgan<br/><i>RiskMetrics / VaR</i><br/>1994"]
        H["Artzner et al.<br/><i>Coherent risk measures</i><br/>1999"]
        J["Saltelli et al.<br/><i>Global sensitivity analysis</i><br/>2008"]
        I["Integrated<br/>risk analysis"]
    end

    A --> C
    B --> D
    C --> F
    D --> I
    E --> I
    J --> I
    F --> I
    G --> H
    H --> I

    style I fill:#4a90d9,color:#fff

This diagram shows that present-day integrated risk analysis is not a single method but the convergence of four independently originating traditions: physics (Monte Carlo), military strategy (scenarios), engineering (sensitivity) and financial regulation (risk measures). Each method answers a different question, and their power is revealed only when they are used together. This is discussed in more detail in section 4.1.2.

4.1.2 Principal theories and models#

Sensitivity analysis: what affects the result most?#

Sensitivity analysis is the simplest and most frequently applied method of risk analysis. Its essence is to change one or several input variables of a model systematically and to observe how this affects the result (usually net present value (NPV), profit or cash flow). This makes it possible to identify critical variables — those whose small changes cause disproportionately large fluctuations in the result.

One-way sensitivity analysis changes one variable at a time, keeping all the others constant (ceteris paribus). In a discounted cash flow (DCF) model, for example, it is possible to study separately how NPV varies with the weighted average cost of capital (WACC; from 8 % to 14 %), the revenue growth rate (from 2 % to 8 %) or the margin of earnings before interest and taxes (EBIT; from 10 % to 20 %). The result is usually shown in a tornado diagram — a horizontal bar chart in which the variables are ranked by the size of their effect, from largest to smallest. The tornado diagram is an extremely effective communication tool: it shows managers at a glance which three factors could do the most damage, and it is therefore widely used in investment committee presentations and due diligence reports.

Another means of visualisation is the spider diagram, in which the effect of each variable is shown as a line running from the base scenario. A steeper slope means greater sensitivity. The spider diagram is particularly useful when the aim is to compare not only the size of the effect but also its direction (positive or negative) and linearity, that is, whether the effect is proportional or accelerating.

Quantitatively, sensitivity is measured by the elasticity coefficient — the ratio of the percentage change in the result to the percentage change in the variable (formula (4.1), see section 4.2). Elasticity makes it possible to compare the effects of different variables in uniform terms, regardless of their absolute values.

Multi-way sensitivity analysis changes several variables at the same time. The most common variant is the two-way data table, for example WACC × growth rate, which generates an NPV matrix. This is extremely useful in DCF valuation, because it shows how the two most uncertain parameters — the discount rate and long-term growth — together affect value. However, varying as few as three variables at the same time ($5^3 = 125$ combinations) becomes hard to visualise, and six ($5^6 = 15\ 625$) can no longer be interpreted without automated tools.

This limit of one-way and multi-way analysis is overcome by global sensitivity analysis (GSA), for which Saltelli and colleagues (2008) provided the canonical guide. Unlike local analysis, which changes variables one at a time around a base point, GSA assesses the effect of the variables across the whole range of their possible values, including their mutual interactions. This is particularly important when a model contains non-linearities or correlations because of which one-way analysis may mislead.

Sobol’ indices — the most popular GSA measure — are based on variance decomposition. The first-order Sobol’ index $S_i$ shows what share of the total variance of the result is explained by a single variable $X_i$:

where $\mathbb{E}[V \mid X_i]$ is the conditional expected value of the model result, given the value of $X_i$. If $S_i = 0.45$, this means that 45 % of the whole uncertainty of the model arises from this one variable. The total-order Sobol’ index $S_{T_i}$ additionally covers all the interactions of the variable with other variables, and the difference $S_{T_i} - S_i$ shows the importance of the interactions. When $\sum S_i \approx 1$, the model is almost additive and the interactions are insignificant; when $\sum S_i \ll 1$, interactions dominate and one-way analysis is essentially inadequate.

This interpretation has one necessary condition: the variables must be independent. For correlated variables, variance decomposition no longer splits the variance into separate, non-overlapping parts. The same share of variance may be attributed to several inputs, so $\sum S_i$ may deviate from one because of correlation and not because of interactions. The practical consequence is important: if a model contains correlations, nothing can be concluded about interactions from $\sum S_i$ until the correlations have been assessed separately.

More recent research proposes Shapley effects as an alternative to Sobol’ indices, particularly when the variables are correlated with one another. In that case classical variance decomposition becomes ambiguous, whereas Shapley effects, based on the logic of cooperative game theory, make it possible to obtain a more stable and more clearly interpretable metric of influence (Palar et al., 2023).

In practice GSA requires thousands or tens of thousands of model runs and is therefore most often combined with Monte Carlo simulation (see below). Modern tools (@RISK, Crystal Ball, the Python SALib library) automate this process, but it is important for the analyst to understand that the results of GSA depend on the chosen ranges and distributions of the variables, that is, on how widely the variables are “allowed” to fluctuate.

In business planning, sensitivity analysis is valuable in two respects. Analytically, it identifies which assumptions deserve the most attention and resources. If 70 % of the uncertainty in NPV arises from the revenue growth rate, it is precisely this assumption that must receive the deepest market analysis. In terms of communication, the tornado diagram is one of the most effective ways of conveying the structure of risk to people who are not financial specialists. It enables board members or investors to grasp at a glance which factors in the model matter most.

Scenario analysis: what could happen?#

Scenario analysis is a method of risk analysis of a qualitatively different kind from sensitivity analysis. If sensitivity analysis asks “how much would the result change if this figure were different?”, scenario analysis asks “what would the whole business context look like if the world took a different direction?” This is not the variation of parameters but the construction of alternative futures — structured thinking about qualitatively different possibilities.

An epistemological distinction. Scenarios are not forecasts. A forecast seeks one “correct” answer — the most likely result. Scenarios consciously give up this aim and recognise that the future is fundamentally multi-variant, particularly in the zone of Knightian uncertainty (see Chapter 3), where neither the probabilities nor the possible scenarios are stable. As Wack (1985) put it, the aim of scenarios is not to guess the future but to change the picture of reality in the minds of decision-makers to such an extent that they reach insights that previously lay beyond the limits of their thinking.

The classical three-scenario model — optimistic, base, pessimistic — is the most widespread in business plans, but it has serious methodological shortcomings. First, it creates an anchoring effect: the base scenario psychologically becomes the “real” one, and the other two merely formal appendages. Second, the three scenarios are often constructed simply by changing the size of the parameters (revenue +10 % / 0 % / −10 %), in essence carrying out a sensitivity analysis under other names rather than creating qualitatively different pictures of the world.

The modern structured approach uses a 2×2 uncertainty matrix: the two most important and least predictable forces are identified (for example, the regulatory environment and disruptive technological innovations), four combinations of them are created, and for each a consistent, internally logical narrative — a scenario — is developed. The four scenarios are not a “bad–average–good” spectrum; they are four qualitatively different worlds, each of which requires a different strategy.

The quantitative integration of scenarios. Although scenarios are first and foremost narratives, they can be integrated quantitatively by assigning a subjective probability to each scenario and calculating the expected value $E(V) = \sum p_i V_i$ and the variance between scenarios (formulas (4.2) and (4.3), see section 4.2). However, it is necessary to be aware of a fundamental epistemological problem: these probabilities are subjective expressions of expert judgement, not objective frequency statistics, and they must therefore be regarded as structured guesses and not as precise data.

Scenarios in business planning. In practice scenarios are particularly valuable for long-term strategic planning, where quantitative models are at their weakest. In the Lithuanian and Baltic context scenario analysis is especially relevant because a small open economy is vulnerable to external shocks. These include fluctuations in energy prices after the closure of the Ignalina nuclear power plant, the launch of the liquefied natural gas (LNG) terminal and the appearance of the NordBalt (to Sweden) and LitPol Link (to Poland) interconnections. They also include EU regulatory changes (the European Green Deal, the Carbon Border Adjustment Mechanism (CBAM), the Corporate Sustainability Reporting Directive (CSRD)), geopolitical risk (Russia’s invasion of Ukraine) and the dynamics of export markets. In these areas the use of a single “base” scenario is not a simplification but structural negligence.

Monte Carlo simulation: what is the probability?#

Monte Carlo simulation is the most powerful quantitative method of risk analysis; it makes it possible to create a probabilistic model from a deterministic one, that is, to obtain not one result but the whole distribution of possible results. If sensitivity analysis changes variables one at a time and scenario analysis constructs several qualitatively different worlds, Monte Carlo changes all the variables at the same time according to the probability distributions assigned to them, and repeats this process thousands or tens of thousands of times. Today it is a standard instrument in three different fields: portfolio risk management (Jorion, 2007), business and investment valuation (Damodaran, 2012) and project risk analysis (Vose, 2008).

The essence of the methodology. The process of Monte Carlo simulation involves four steps:

1. Identifying the model. A deterministic model (for example, DCF) is established, with clearly defined input variables and a formula for the result.
2. Assigning distributions. Each uncertain variable is assigned a probability distribution reflecting the extent and form of its uncertainty:
   • Normal — when the variable fluctuates symmetrically about the mean (for example, macroeconomic indicators).
   • Triangular — when the minimum, maximum and most likely points are known, but there are few data (for example, expert assessments).
   • Lognormal — when the variable cannot be negative and has a right skew (for example, share prices, raw material prices).
   • Beta / PERT — when the variable fluctuates within a defined interval with a known mode (for example, the duration of a project). The PERT distribution (Program Evaluation and Review Technique) is particularly convenient in business planning, because it requires only three expert estimates: the minimum $a$, the mode $c$ (the most likely value) and the maximum $b$. From these the mean $\mu = \frac{a + 4c + b}{6}$ and the standard deviation $\sigma \approx \frac{b - a}{6}$ are calculated. Weighting by a coefficient of 4 gives the mode a greater weight than the extreme values, so the PERT distribution is less sensitive to extremes than the triangular distribution and reflects experts’ expectations better. In practice PERT is widely used in modelling project durations, costs and sales volumes when historical data are lacking but experts can provide three reference points (Vose, 2008).
3. Simulation. In each iteration a random number generator (usually the Mersenne Twister algorithm) selects values of the variables according to the assigned distributions, and the model calculates the result. After $N$ iterations (usually 10 000–100 000) the distribution of the result is obtained.
4. Analysis. The histogram of the results makes it possible to calculate the expected value, the standard deviation, confidence intervals and probabilities (for example, $P(NPV < 0)$ — the probability that the project will make a loss).

Convergence and the number of iterations. The Monte Carlo standard error decreases in proportion to $1/\sqrt{N}$. This means that reducing the error by a factor of 10 requires 100 times as many iterations. In practice 10 000 iterations are usually enough for the stability of the mean and standard deviation, but tail probabilities (for example, $P(NPV < 0)$, when that probability is small) may require 50 000–100 000 iterations. The formula for the confidence interval is given as formula (4.4) in section 4.2.

Modelling correlations. One of the most frequent Monte Carlo errors in practice is the assumption that the variables are independent. In reality many variables are correlated: revenue growth and the EBIT margin often have a negative correlation (fast growth reduces the margin because of the need for investment), and interest rates and real estate prices also have a negative correlation. If correlations are ignored, Monte Carlo simulation may generate unrealistic combinations of variables and distort the distribution of the results. The technical solution is Cholesky decomposition, a mathematical method which transforms independent random numbers into correlated ones according to a specified correlation matrix (Vose, 2008). An alternative is the rank correlation method of Iman and Conover (Iman & Conover, 1982), used in @RISK and similar tools.

Latin Hypercube Sampling (LHS). A simple random sampling method may “miss” certain areas of a distribution, particularly the tails. LHS is an improved method which divides the distribution of each variable into $N$ intervals of equal probability and ensures that across the whole sample of $N$ iterations exactly one value is taken from each interval (McKay, Beckman, & Conover, 1979). In one iteration each variable receives one value, and random pairing determines which interval of one variable meets which interval of another. In this way the sample covers the whole width of each distribution, including the tails. This considerably improves convergence and is the standard choice in modern simulation tools.

Monte Carlo and scenarios: complementary, not competing methods. Monte Carlo and scenario analysis perform fundamentally different functions. Scenarios create discrete, qualitatively different futures with a narrative logic. They are best suited to structural breaks, where past statistics no longer apply. Monte Carlo creates a continuous probability distribution according to parametric distributions. It is best suited to the quantitative assessment of parametric uncertainty. Effective practice combines the two: scenarios are used to identify structural breaks, and within each scenario Monte Carlo is applied for the quantitative assessment of parametric uncertainty.

This combination has a name of its own — layered or hybrid modelling: the outer layer consists of several qualitatively different scenarios, and the inside of each is filled by a separate simulation with distributions adapted to that scenario (Vose, 2008; Rubinstein & Kroese, 2017). The practical difference from ordinary Monte Carlo is that the distributions are not one and the same for all the scenarios: in a recession scenario not only does the mean of revenue shift, but its dispersion also widens, and some correlations reverse their sign. The result is presented not as one distribution but as several, one per scenario, and it is precisely their failure to coincide that shows how far the result depends on the structural assumption rather than on the fluctuation of parameters. In a business plan this means that instead of a single “the probability that NPV < 0 is 12 %”, three figures are given, with the scenario stated, and the reader sees which of them is critical for the decision.

Risk indicators: how much are we risking?#

Section 3.2 of Chapter 3 presented the basic risk measures — the standard deviation ($\sigma$, formula (3.1)), the beta coefficient ($\beta$, formula (3.2)), the Sortino ratio (formula (3.5)), the coefficient of variation (CV, formula (3.6)) and the country risk premium (formula (3.7)). These measures assess the overall level of risk but do not answer more specific questions: what loss threshold will we not exceed with a stated probability? What is the risk in the tails? How does leverage increase sensitivity? This section presents specialised indicators that supplement the basic set of Chapter 3.

VaR (Value at Risk). VaR answers a specific question: “what loss threshold will we not exceed over a stated period with a stated probability?” For example, “the daily VaR at the 99 % confidence level is EUR 150 thousand” means that on 99 days out of 100 the loss will not exceed EUR 150 thousand. VaR is calculated by three methods:

• Parametric (variance-covariance): returns are assumed to follow a normal distribution, and VaR is calculated directly from the mean and the standard deviation (formula (4.8), see section 4.2).
• Historical simulation: actual historical data are used, with no assumption about the distribution. VaR is simply the corresponding percentile of the series of historical losses.
• Monte Carlo VaR: a distribution of losses is generated by Monte Carlo simulation and the corresponding percentile is taken from it.

VaR entered the capital requirements of banks through the Market Risk Amendment of the Basel Committee in 1996 (see Chapter 3), but it has a fundamental shortcoming: it is a non-coherent measure — it does not always satisfy the subadditivity axiom (Artzner et al., 1999). This means that the sum of the VaRs of two portfolios may be smaller than the VaR of the combined portfolio, which produces the paradox that diversification theoretically “increases” risk. In addition, VaR says nothing about the size of the losses when the VaR threshold is exceeded. It shows the threshold, but not what lies beyond it.

CVaR and Expected Shortfall. Conditional Value at Risk (CVaR), also called Expected Shortfall, answers precisely this question: “if the loss exceeds the VaR threshold, what is the average size of the loss?” Mathematically this is the conditional expected value $E[L \mid L > VaR_\alpha]$ (formula (4.9)). CVaR satisfies all four of the coherence axioms of Artzner and colleagues, and the Basel Committee therefore moved in the FRTB reform to CVaR as the principal regulatory risk measure.

The break-even point. This is the simplest but one of the most useful risk indicators in business plans. The break-even point shows how many units or what volume is needed for revenue to cover all costs (formula (4.5)). A related indicator — the margin of safety — shows how far current sales exceed the break-even point, that is, what fall in sales the business can withstand without beginning to make a loss.

The degrees of operating and financial leverage. Leverage is an “amplifier” of risk: it increases both profit during growth and losses during a downturn. The degree of operating leverage (DOL) shows by what percentage EBIT changes when sales change by 1 % (formula (4.6)). The degree of financial leverage (DFL) shows the analogous sensitivity of net profit to changes in EBIT (formula (4.7)). The degree of total leverage DTL = DOL × DFL shows the cumulative effect: if DOL = 3 and DFL = 2, a 10 % fall in sales causes a 60 % fall in net profit. This is particularly important in assessing capital-intensive businesses or those heavily financed with borrowed funds.

Stress tests. A stress test is a specific form of scenario analysis in which extreme but realistically possible situations are assessed. Historical stress tests rely on the parameters of past crises (for example, in the case of the global financial crisis of 2008, when equity markets fell by about 50 % and credit spreads widened by 300–500 basis points). Hypothetical stress tests create scenarios that have not occurred in the past (for example, a cyber attack paralysing the whole supply chain). A reverse stress test works in the opposite direction. Instead of the question “what would happen if…?” it asks “what conditions would force us to become insolvent?”. From this point of failure it then analyses backwards what events or combinations of events would be needed for such a result to become reality. Methodologically this is a three-step process: (1) a critical threshold is defined (for example, equity < 0, liquidity ratio < 1.0, debt service coverage ratio < 1.2); (2) the combinations of variables that could lead to this threshold are identified; (3) it is assessed whether such combinations are realistic, on the basis of historical precedents and expert judgement. The reverse stress test is extremely valuable because it forces an organisation to confront its vulnerabilities directly rather than ignore them. It exposes “blind spots” that a traditional stress test may fail to detect, since the latter tests only scenarios foreseen in advance. The EBA (European Banking Authority) and the UK Prudential Regulation Authority (PRA) require reverse stress testing from financial institutions; in business planning this logic is no less valuable, although it is applied less often.

The Omega ratio and maximum drawdown. The Omega ratio (Keating & Shadwick, 2002) is an alternative risk–return measure which, unlike the Sharpe or Sortino ratios, covers the whole distribution of returns — not only the first two moments (the mean and the variance) but also skewness and kurtosis. Maximum drawdown (MDD) — the fall in value from peak to trough — is an intuitive measure that is particularly important for investors: a −30 % drawdown requires a +42.9 % recovery merely for the value to return to its original level. The Calmar ratio (annual return / |MDD|) makes it possible to compare investments by their risk–return relationship, taking the maximum drawdown into account.

Integrated risk analysis: from methods to a system#

The four methods described in this chapter do not compete with one another. They form a progressively deepening assessment system in which each new level supplements and extends the previous one:

Figure 4.2. The workflow of integrated risk analysis

graph TD
    A["1. Sensitivity analysis<br/><i>Tornado diagram</i><br/>Asks: what matters?"] --> B["2. Scenario analysis<br/><i>2×2 matrix / 3 scenarios</i><br/>Asks: what could happen?"]
    B --> C["3. Monte Carlo<br/><i>Probability distribution</i><br/>Asks: what is the probability?"]
    C --> D["4. Risk indicators<br/><i>VaR, CVaR, DOL/DFL</i><br/>Asks: how much are we risking?"]
    D --> E["5. Decision<br/><i>Accept / Adjust / Reject</i>"]
    E -.->|Iteration| A

    style A fill:#50b5a9,color:#fff
    style B fill:#f5a623,color:#fff
    style C fill:#4a90d9,color:#fff
    style D fill:#e8705a,color:#fff
    style E fill:#7b8a8e,color:#fff

This sequence is a typical working order, not a hierarchy. It is suitable when the principal uncertainty is parametric: first it is established what matters, and only then is a probabilistic model built for the parameter that matters. When the principal risk is structural — when the future may be qualitatively different and not merely different in size — the order is reversed. Scenarios then come first, and Monte Carlo works inside them, with distributions of its own for each scenario (see layered modelling in section 4.1.2 and the argument on the Lithuanian context in section 4.1.5). The numbering in the diagram shows where one usually starts, not whose result carries more weight.

The risk register is the central document of integrated risk analysis. It contains, for each identified risk, a description, a category (strategic, operational, financial, regulatory), an assessment of probability and impact, the risk priority number $RPN = P \times I$ (where $P$ is the probability score and $I$ is the impact score), a risk management strategy and the person responsible. The risk register is not a static document: it is updated regularly throughout the life cycle of the project or business plan. The risk register is one of the instruments that help to implement the enterprise risk management principles of the Committee of Sponsoring Organizations of the Treadway Commission (COSO, 2017) — risk identification, impact assessment and the setting of priorities; the framework itself treats risk assessment not as a separate procedure but in the context of performance and strategy.

The risk heat map is a visual matrix of the risk register in which the horizontal axis represents probability and the vertical axis impact. Risks are coloured by zone: green (low RPN — acceptable risk), yellow (medium RPN — monitor and manage), orange (high RPN — a management plan is necessary), red (critical RPN — an automatic escalation signal). The risk heat map is an effective communication tool for the board and investors, but it must be understood as a starting point for discussion and not as a final answer. The assessments of probability and impact are subjective and may be influenced by the same cognitive biases as were discussed in Chapter 3.

Figure 4.3. Symmetric and asymmetric risk matrices (P — probability, columns; I — impact, rows; R — risk score)

%%{init: {"theme":"neutral","themeVariables":{"nodeTextColor":"#17212b","textColor":"#17212b","primaryTextColor":"#17212b"}}}%%
block-beta
  columns 13

  AH["SYMMETRIC MATRIX"]:6 space:1 BH["ASYMMETRIC MATRIX"]:6

  AX["I \ P"] A01["1"] A02["2"] A03["3"] A04["4"] A05["5"] space:1 BX["I \ P"] B01["1"] B02["2"] B03["3"] B04["4"] B05["5"]

  AP5["5"] A51["5"] A52["10"] A53["15"] A54["20"] A55["25"] space:1 BP5["5"] B51["25"] B52["50"] B53["75"] B54["100"] B55["125"]
  AP4["4"] A41["4"] A42["8"] A43["12"] A44["16"] A45["20"] space:1 BP4["4"] B41["16"] B42["32"] B43["48"] B44["64"] B45["80"]
  AP3["3"] A31["3"] A32["6"] A33["9"] A34["12"] A35["15"] space:1 BP3["3"] B31["9"] B32["18"] B33["27"] B34["36"] B35["45"]
  AP2["2"] A21["2"] A22["4"] A23["6"] A24["8"] A25["10"] space:1 BP2["2"] B21["4"] B22["8"] B23["12"] B24["16"] B25["20"]
  AP1["1"] A11["1"] A12["2"] A13["3"] A14["4"] A15["5"] space:1 BP1["1"] B11["1"] B12["2"] B13["3"] B14["4"] B15["5"]

  AF["R = P × I"]:6 space:1 BF["R = P × I²"]:6

  classDef heading fill:#e9eff6,stroke:#aab9cb,color:#19314d
  classDef axis fill:#f0f3f7,stroke:#cbd5e1,color:#334155
  classDef low fill:#afd5ab,stroke:#fff,color:#17212b
  classDef medium fill:#ffe29a,stroke:#fff,color:#17212b
  classDef high fill:#f6b271,stroke:#fff,color:#17212b
  classDef critical fill:#e97f77,stroke:#fff,color:#17212b
  classDef formula fill:#eef2f8,stroke:#cbd5e1,color:#172c49

  class AH,BH heading
  class AF,BF formula
  class AX,BX,A01,A02,A03,A04,A05,B01,B02,B03,B04,B05,AP1,AP2,AP3,AP4,AP5,BP1,BP2,BP3,BP4,BP5 axis

  class A11,A12,A13,A14,A21,A22,A31,A41 low
  class A15,A23,A24,A32,A33,A42,A51 medium
  class A25,A34,A35,A43,A52,A53 high
  class A44,A45,A54,A55 critical

  class B11,B12,B13,B14,B15,B21 low
  class B22,B23,B31 medium
  class B24,B25,B32,B33,B41 high
  class B34,B35,B42,B43,B44,B45,B51,B52,B53,B54,B55 critical

In the symmetric matrix the risk score is the RPN: the green zone is up to 4, yellow from 5 to 9, orange from 10 to 15, and red from 16. These thresholds are illustrative: each organisation sets them according to how much risk it can take on.

A comparison of two risk cases

A methodological conclusion: in the symmetric matrix the scores of the two risks coincide, although their consequences differ greatly. In the asymmetric matrix a greater weight is given to impact, so possible bankruptcy acquires a higher priority.

In reality such symmetry is usually absent, because the weight of probability and of impact in a decision is not equal. Frequent but minor disruptions can be covered by a firm without difficulty from current cash flows, and it can gradually adapt to them. Bankruptcy, by contrast, is usually irreversible: once it has occurred there remains neither continuity of operations nor any possibility of recovery. Such a risk therefore cannot be “evened out” by the profits of future periods.

In addition, the scores of the matrix express only an ordinal scale and not actual cash flows. An impact scored at five points may in financial terms be not five but several dozen times greater than an impact of one point, so a simple product of probability and impact may drastically distort the real threat. Risk matrices may in general assign the same rating to quantitatively very different risks (Cox, 2008). The same absolute loss also has an entirely different weight for different firms: a large organisation can absorb it easily, whereas for a small firm it may lead directly to insolvency. Risks therefore cannot be compared by a mechanical score alone. If an event poses an existential threat to the survival of the firm, what must be assessed first is the firm’s capacity to withstand the blow, and only after that the probability of its occurrence.

Note: the colour classes of the asymmetric matrix are illustrative. The formula $R = P \times I^2$ and the thresholds of the risk levels must be justified by the methodology chosen for the particular organisation. For cases of catastrophic impact it is appropriate to set, in addition, a separate criterion of unacceptability. In the figure this criterion is $I = 5$: all the cells of this row are red, although the score of 25 is lower than the orange 27.

Decision trees are a method that makes it possible to model sequential decisions with uncertainty at each stage. A decision tree is made up of decision nodes (where a decision is taken), chance nodes (where a random event determines the result) and terminal nodes (the results). The expected monetary value (EMV) of each path is calculated as a weighted average of probabilities and results (formula (4.10), see section 4.2), and the decision is taken by backward induction — from the terminal nodes “back” to the first decision.

Decision trees are particularly important when investments are staged — for example, when the first stage is a pilot project and the second is full-scale expansion. This is directly linked to the logic of real options (more on this in Chapter 14): staged investment creates an option to abandon (the possibility of stopping the project if the pilot stage proves unsuccessful) and an expansion option (the possibility of increasing the investment if the pilot stage is successful). A standard static NPV does not include the value of these options, so decision trees and real options thinking can fundamentally change the logic of an investment decision.

Each level of Figure 4.2 adds information but also complexity, so not every decision needs all five steps.

The principle of proportionality. Integrated risk analysis is powerful, but it can become a source of “analysis paralysis”. Chapman and Ward (2003) warn that the complexity of risk analysis must be proportionate to the scale of the decision and to the capabilities of the organisation; they do not give specific sums, because these cannot be transferred from one organisation to another. A practical point of reference might be this: for a small firm assessing an investment of EUR 50 000, sensitivity analysis and a few scenarios are enough, whereas a large infrastructure project (EUR 50 million) requires a full Monte Carlo simulation with stress tests and a risk register. The limit is different in every organisation, and it is not determined by the sum alone: the same investment of EUR 50 000 is an experiment for one firm and the annual capital budget for another. Applying all the methods to every decision is not thoroughness but a waste of resources. The Pareto principle applies here too: usually 80 % of the value of risk arises from 20 % of the risk factors. The tornado diagram identifies them, and it is precisely to them that the greatest analytical attention must be given.

4.1.3 Critical analysis and discussion#

The problem of spurious precision#

Every method presented in this chapter raises the same temptation — to create an illusion of precision. Sensitivity analysis gives specific figures in a table, and the reader tends to regard them as “answers”, although they are only deterministic values without probabilities. Monte Carlo simulation generates distributions with statistical characteristics (the mean, the standard deviation, percentiles) which look scientifically rigorous but are only as reliable as the assumptions assigned to them. As discussed in Chapter 2, a more complex model is not necessarily more accurate. It merely creates a stronger appearance of being “scientific”.

This problem is particularly acute in the application of Monte Carlo simulation. A simulation may generate an NPV distribution with many digits after the decimal point. But suppose that the revenue growth rate has been assigned “a normal distribution with a mean of 5 % and a standard deviation of 3 %” on the basis of one analyst’s guess rather than empirical data. The whole distribution is then nothing other than a statistically precise image of that guess. The principle of “garbage in – garbage out” here takes on a subtler form: “garbage in – beautifully distributed garbage out”.

VaR: the paradox of non-coherence and a regulatory lesson#

The criticism of VaR illustrates a wider problem — how a widely accepted standard can create systemic risk. Artzner and colleagues (1999) showed that VaR does not always satisfy the subadditivity axiom — the requirement that the risk of a combined portfolio should not exceed the sum of the risks of the separate portfolios. This is not merely a mathematical question. If a bank manages two portfolios, the VaR of each of which is acceptable, the VaR of the combined portfolio may be greater than the sum of the two VaRs. This means that diversification, which ought to reduce risk, may “increase” it in the regulatory system. This paradox was one of the reasons why the Basel Committee moved from VaR to CVaR.

The deeper lesson, however, is not technical but epistemological. VaR, even if it were mathematically perfect, has a structural limitation: it says nothing about what happens beyond the stated confidence threshold. A 99 % VaR shows “the worst normal day”, but the crisis of 2008 showed that it is precisely the 1 % of cases about which VaR is silent that determine whether an institution survives or collapses. This is the essence of the “black swan” criticism by N. Taleb (2007): models calibrated on “fair weather” data systematically underestimate the risk of extreme events.

The fat tails problem and the normality assumption#

The normal distribution assumption, on which parametric VaR, many Monte Carlo configurations and standard portfolio theory depend, is one of the most criticised assumptions in modern finance. As discussed in Chapter 3, Mandelbrot (1963), studying changes in speculative prices, mainly cotton, showed that their distributions have “fatter tails” than the normal distribution predicts. This means that extreme events (crises, crashes) happen considerably more often than standard models forecast.

In the application of Monte Carlo simulation this problem shows itself in two ways. First, if normal distributions are assigned to the variables, the simulation will systematically underestimate the probability of extreme results. Second, under crisis conditions correlations between assets and variables rise sharply (the so-called correlation breakdown effect). A model calibrated on “quiet time” correlations may show too optimistic a diversification benefit during crisis periods. This does not mean that the Monte Carlo method is useless. It means that its results must be interpreted consciously, with an understanding of the limits of the assumptions within which they are valid.

The problem of the subjectivity of scenarios#

Scenario analysis claims to manage structural uncertainty, yet it is itself a product of subjectivity. Several specific problems arise:

The subjectivity of assigning probabilities. When probabilities are assigned to scenarios (for example, optimistic — 25 %, base — 50 %, pessimistic — 25 %), these probabilities are expert guesses and not statistical frequencies. Different experts will assign different probabilities to the same scenarios, and there is no objective way of establishing which is more correct. The formula $E(V) = \sum p_i V_i$ creates an appearance of mathematical precision, but it is only as certain as the input probabilities.

The danger of narrow framing. The three or four scenarios created inevitably reflect the thinking horizon of their creators. Scenarios that seem “too extreme” or “too strange” are often rejected as unrealistic, yet it is precisely these that may include the true “black swans”. The COVID-19 pandemic of 2020 was an event of this kind: many firms had scenarios for an economic downturn, but very few had a scenario for a global paralysis of supply chains caused by an epidemiological shock.

Anchoring to the base scenario. Even when several alternative scenarios have been constructed, the base scenario psychologically often becomes the “real” one. Decision-makers tend to regard the optimistic and pessimistic scenarios not as equally valid possibilities but only as unlikely deviations. This is directly linked to the anchoring effect (anchoring bias) discussed in Chapter 3, and it is one of the main reasons why the 2×2 matrix method (four qualitatively different scenarios with no distinguished “base” one) is methodologically superior.

Does scenario analysis really help? An empirical counterweight#

The criticism set out above is conceptual: it shows why scenario analysis may mislead. But the answer to the question of whether it helps in practice depends not on arguments but on data. Here it must first be noted what the literature on scenario planning itself never promised. Chermack and Lynham (2002, p. 374), having analysed eighteen definitions used in the literature, divided the expected results of the method into four categories: changed thinking, well-founded stories of alternative futures, better decisions, and enhanced human and organisational learning and imagination. Forecast accuracy is not on this list. This also agrees with the position of van der Heijden (2005) that scenarios are not a product but a strategic conversation: value is created by the process itself, through which the organisation is forced to voice and reconcile its assumptions. This means that assessing scenario analysis by whether a scenario “came true” is a category error — much the same as assessing a fire drill by whether a fire actually broke out.

What the measurements show:

• The effect on learning. Haeffner and colleagues (2012) surveyed 133 participants from ten US companies before and after scenario planning sessions, using the standardised Dimensions of the Learning Organization Questionnaire (DLOQ). Six of the seven dimensions of the questionnaire changed in a positive direction.
• The effect on decision-making style. Chermack and Nimon (2008), in a “before and after” quasi-experimental study in a technology company, found that after scenario planning participants shift towards a more intuitive decision-making style. This result should be read with caution: it may mean that the participants learned to work with uncertainty, but also that they became less inclined to demand quantitative justification.
• The effect on the decision itself. The strongest evidence is provided by Phadnis and colleagues (2015), who carried out three field experiments with experts in the field, one of them in the transportation department of a US state, assessing sixteen infrastructure investments. The results are unexpected in two respects. First, the use of several scenarios neither increased nor reduced the experts’ confidence in their judgement. This contradicts earlier research. Second, the experts’ judgement changed in a definite direction: an investment is judged more favourably if it proves beneficial in a particular scenario, and the strength of the effect depends on how confident the expert was at the outset.

The most important conclusion of the same study for business planning is the third: after working with several scenarios, the experts began to choose more flexible investment options. This is no trifle but the empirical basis for what the first case in section 4.4 presents as a decision: scenario analysis leads not to a different figure but to a different structure of investment (staged, with an option to abandon).

The limits of this evidence must be stated plainly. The samples are small, some of the indicators are the participants’ self-assessments rather than an objective result, and the studies were carried out in US organisations. None of them shows that firms that applied scenario analysis earned more. An honest formulation is therefore this: the evidence supports scenario analysis as an instrument of learning and flexibility, but not as an instrument of forecast accuracy, and it is precisely in this way that it is worth presenting in a business plan.

Behavioural biases in the risk analysis process#

The seven cognitive biases presented in Chapter 3 show themselves not only in the perception of risk but also in the risk analysis process itself:

• Overconfidence leads analysts to assign excessively narrow distributions to Monte Carlo variables (“I know for certain that growth will be between 3 % and 7 %”). Empirical experience, however, shows that experts systematically assess the range of possible results too narrowly.
• The availability heuristic means that the risk register is dominated by risks recently experienced or visible in the media, while “invisible” but potentially more significant risks are left out.
• Groupthink in risk committees may stifle the creation of dissenting scenarios. If the dominant opinion is optimistic, the pessimistic scenario may be “softened” to a socially acceptable level.
• Escalation of commitment means that for a project already accepted, risk analysis may be applied not to assess it objectively but to confirm the decision (confirmation bias), by seeking arguments for continuing rather than stopping.

The strategies for managing these biases — pre-mortem analysis, structured adversarial discussion (red team) and reference class forecasting — were discussed in Chapter 3. In the context of this chapter it is important to emphasise that structured methods (sensitivity analysis, scenarios, Monte Carlo) are themselves instruments for reducing bias. They force assumptions to be clearly defined, tested and questioned. However, they do not confer immunity from biases. The assumptions entered into a model are still human decisions.

ESG and the problem of double materiality#

ESG (Environmental, Social and Governance) factors create a specific problem for risk analysis — double materiality. This means that ESG risk has two directions: risk to the business (physical climate risk, regulatory changes, supply chain disruptions) and risk from the business (carbon emissions, working conditions, transparency of governance). The EU regulatory system (in particular the CSRD) already requires both directions to be assessed.

In practice ESG is integrated into risk analysis in several ways: as an additional variable in sensitivity analysis (for example, the effect of a carbon tax on the EBIT margin), as a scenario axis (for example, a “2 °C scenario” and a “business as usual scenario”) and as a separate category in the risk register. In the voluntary recommendations of the TCFD (Task Force on Climate-related Financial Disclosures, 2017), scenario analysis is one of the proposed instruments. It is recommended to use not one scenario but a set that must include a scenario of warming of 2 °C or lower and two or three further alternatives.

The danger of double counting. When ESG is integrated into a DCF valuation, a major methodological trap appears. Cornell and Damodaran (2020) sum up that ESG can increase a firm’s value in two ways: through profitability and cash flows, or through a lower discount rate. The same ESG risk may therefore be “counted twice”: both by adjusting cash flows (for example, by reducing forecasts because of a possible carbon tax) and by increasing the discount rate (for example, by adding an ESG risk premium to WACC). If climate risk has already been reflected in more pessimistic cash flow forecasts, an additional adjustment of the discount rate for the same effect is excessive, and vice versa. The analyst must state clearly where in the model each risk effect is reflected, and must not count it again. A cash flow adjustment is often more transparent, because it shows what effect is expected and when. This principle applies not only to ESG but also to other categories of risk integrated into a DCF model (for example, country risk, regulatory risk).

Model risk: structural error is more dangerous than parametric error#

A final and perhaps most important critical remark: all the methods discussed in this chapter assess parametric uncertainty, that is, the question “what would happen if these figures were different?”. But they give no protection against model risk — the possibility that the model itself is structurally wrong. If a DCF model omits a major source of revenue, no sensitivity analysis will detect this, because it will test only the variables that are in the model. If the scenarios do not foresee a qualitatively new category of risk (for example, a pandemic), Monte Carlo simulation will not show its probability, because it will simulate only the risks that have been explicitly defined.

This is the practical expression of Knightian uncertainty (see Chapter 3): quantitative methods can manage risk (where probabilities and scenarios are at least partly known), but in the zone of true uncertainty they are powerless. It is precisely for this reason that integrated risk analysis must be supplemented by qualitative strategies: continuous monitoring of the environment, organisational learning, strategic flexibility and real options thinking (more on this in Chapter 14). As Danielsson (2011, p. xiv) aptly put it: “financial risk models have the annoying habit of failing when needed the most”.

How to check whether a model works: backtesting#

Model risk gives rise to a practical question which quantitative analysis most often does not ask: how do we know whether our risk measure is correct at all? In finance the answer has been formalised and is called backtesting. The VaR estimate is compared with actual results, and it is checked whether the threshold was breached as many times as the chosen confidence level predicts (Jorion, 2007). The logic is simple: if a 99 % daily VaR has been calculated correctly, then over 250 trading days it should be exceeded about two to three times. Zero breaches is not a good result: it may mean that the model overestimates risk and that the firm is tying up capital unnecessarily. One 250-day period without breaches is not enough to conclude this. At the 99 % level, zero breaches can occur even with a correct model, so it is a signal to check, not a conclusion. Ten breaches, on the other hand, are already hard to reconcile with a correct model and show that risk is being underestimated.

A formal criterion for whether the number of breaches is statistically consistent with the chosen level is Kupiec’s (1995) unconditional coverage test; precisely this logic is also embedded in bank regulation, where the number of breaches over the last 250 days determines the capital requirement multiplier.

In business planning there is no daily data series, so direct VaR backtesting does not apply. However, the idea itself is transferable and is more valuable than the measure itself: the quality of a forecast is checked by comparing it with what happened, not with how convincingly it was written. In practice this means that the scenarios and sensitivity ranges of a business plan must be reviewed after the event: did actual sales fall within the forecast range? How many times out of five planning cycles was the real result outside the limits of the pessimistic scenario? A firm that accumulates these statistics learns more about its forecasting bias within a few years than from any improvement to a model. This is directly related to the ex post assessment discussed in Chapter 2 and to the management of plan implementation in Chapter 17.

4.1.4 The technology perspective#

The practical application of risk analysis methods has always been inseparably linked to computing technologies. Each technological wave not only provided new tools but also changed which methods became practically accessible and who could apply them.

The era of computerisation (1970–1995): from the mainframe to the spreadsheet#

For the first decades Hertz’s (1964) ideas on Monte Carlo remained largely the domain of mainframe computers, because simulations required programming skills and expensive hardware. The breakthrough came in the 1980s, when @RISK and Crystal Ball turned Monte Carlo simulation into a spreadsheet add-in. An analyst could run a large number of iterations directly in a spreadsheet, without any programming. This democratised simulation: it became accessible not only to investment banks but also to corporate finance departments and consulting firms.

Sensitivity analysis also changed along with spreadsheets. The Excel Data Table function (one-way and two-way) made it possible to automate “what if?” calculations. An analyst could generate the data needed for a tornado diagram in minutes, where previously this had taken hours of manual work. Specialised software appeared for decision trees — DPL (Decision Programming Language) and TreePlan, which integrates into Excel.

The era of the internet and data (1995–2020): from the tool to the ecosystem#

In this period risk analysis software went through a stage of consolidation: in 2007 Oracle acquired Crystal Ball, integrating it into its business analytics platform; Palisade (now Lumivero) continued to develop @RISK; and in 2008 Vose Software released ModelRisk as an alternative. These tools became the industry standard: in the oil and gas sector, in pharmaceuticals and in infrastructure projects, Monte Carlo simulation with @RISK or Crystal Ball became a mandatory component of investment justification. It is harder than it seems to say how large this market really is, and that is an instructive example in itself. Global Market Insights (2024) valued the risk analytics market at USD 36.6 billion in 2023 and forecast annual growth of more than 13 %, to USD 115.7 billion in 2032. Fortune Business Insights (2026) valued the same market at USD 35.80 billion in 2025 and forecast USD 91.65 billion in 2034, at a rate of 11.01 %. Both estimates are given to one or even two decimal places, yet they cannot be reconciled with each other. Extending the 13 % rate stated by the first source gives about USD 47 billion for 2025, that is, almost a third more than the second source estimates, and the later of the two forecasts predicts a smaller market in later years. The reason is clear at once from what each source counts. Neither source defines risk analytics, both merely list segments, and those lists do not coincide. For business planning the conclusion does not change — institutional demand for risk management is growing at a double-digit rate — but the exact figure here is not data but a consequence of the choice of definition.

This era was also changed by two other forces. First, the open-source ecosystem: Python (with the NumPy, SciPy and pandas libraries), R and other environments made it possible to run Monte Carlo simulations with hundreds of thousands of iterations, to model complex correlation structures and to apply advanced methods (Latin hypercube sampling, copula models) without the price of commercial licences. This is particularly important for the academic and small business sectors. The Python SALib library has made the calculation of Sobol’ and other GSA methods accessible in just a few lines of code.

Second, business intelligence (BI) platforms — Tableau, Power BI and similar tools — moved the visualisation of risk from static tables to interactive dashboards. Risk heat maps, tornado diagrams and Monte Carlo histograms became visualisations updated in real time, accessible not only to analysts but also to managers. In the banking sector the automated stress tests of the EBA and the European Central Bank (ECB), carried out regularly across the whole European banking system, demanded a complex IT infrastructure and standardised data formats, and turned risk analysis into an institutional function rather than the task of an individual analyst.

The era of AI and AI agents (2020→): risk analysis as a dialogue#

AI agents are autonomous software systems capable of carrying out multi-step sequences of tasks with minimal human intervention.

Artificial intelligence is changing risk analysis at several levels. The applications listed below are those already used in practice; comparative studies of their effectiveness are so far few, so they are described here without an assessment of how far they outperform earlier methods.

Risk identification. Natural Language Processing (NLP) models are used to scan news streams, regulatory documents and supply chain data in order to notice risk categories that a manual review of such a quantity of documents would simply not see. This can be useful for ESG risk monitoring, where the regulatory environment changes quickly.

The automation of Monte Carlo. Generative AI models are used to create Monte Carlo simulation configurations from text descriptions of assumptions, to propose distributions and to interpret results. This lowers the technical barrier: an analyst who cannot program or use @RISK can obtain a probabilistic assessment through a conversation with an AI assistant. A lower barrier is not the same as a justified result: the choice of a distribution and its justification remain the analyst’s responsibility, because that is precisely where all the assumptions of the model lie (see the “garbage in” argument in section 4.1.3).

The automation of risk registers. AI can analyse earlier projects, identify recurring risks and propose standardised risk registers for new projects, reducing the “blank page” problem. Such a proposal is a draft and not a final register: recurring risks are those that have already occurred, so new categories of risk do not appear in this way.

Advanced AI methods. Machine learning models (gradient boosting trees, neural networks) are used in credit risk assessment because they can detect non-linear relationships among hundreds of variables that traditional logistic regression models do not capture (Lessmann et al., 2015). However, these models raise the “black box” problem. Regulators (the EBA and the ECB in particular) require model explainability. The SHAP (SHapley Additive exPlanations — a method explaining the contribution of each variable to a model’s forecast; Lundberg & Lee, 2017) and LIME (Local Interpretable Model-agnostic Explanations) methods are therefore becoming a standard component of the validation of AI models.

However, the AI era intensifies the already discussed risk of automation bias: if the configuration of a Monte Carlo simulation has been generated by AI rather than by a human expert, there may be excessive confidence in the results without an understanding of what assumptions have been made. In the Lithuanian and Baltic context, where the financial technology (fintech) sector is growing rapidly (see the technology perspective in Chapter 3), this tension between accessibility and critical understanding is particularly relevant. In the supervisory practice of the Bank of Lithuania (the central bank and financial supervisor), risk management requirements for fintech entities are constantly becoming stricter. Data from Nasdaq Vilnius (Lithuania’s stock exchange) make it possible to run Monte Carlo simulations with real Baltic market parameters. A deeper analysis of the relationship between technology and risk analysis is given in Chapter 19.

4.1.5 The Lithuanian context#

The methods discussed in this section were created in large economies and large organisations: Monte Carlo simulation was born in a nuclear programme, scenario planning in an international oil corporation, and VaR on the trading floor of an investment bank. The situation of Lithuanian business differs in three respects, and all of them change not the correctness of the methods but the choice among them.

First, the openness of the economy makes scenarios more important than probabilities. In a small open economy the greatest fluctuations in results arise not from a firm’s internal parameters but from external breaks: the regime of energy prices, the cycle of export markets, EU regulatory changes (the Green Deal, CBAM, CSRD) and geopolitical decisions. Such breaks are not random variables around a mean; they are qualitatively different states whose probabilities historical data do not provide. It is precisely for this reason that in the business plan of a Lithuanian firm a 2×2 scenario matrix often gives more than a thousand Monte Carlo iterations: the simulation precisely measures the fluctuation around an assumption whose principal risk is that it will cease to hold at all. The second case in this chapter (section 4.4) illustrates this logic with an example from the Lithuanian energy sector, in which the very way the market works changed over a decade and a half.

Second, the size of firms makes the principle of proportionality mandatory rather than merely recommended. The structure of Lithuanian business is dominated by small and medium-sized enterprises, in which risk analysis is not a separate function and rarely has a person responsible for it separately. The practical conclusion is not that quantitative analysis is unsuitable for such firms. It is exactly as Chapman and Ward (2003) formulate it: the complexity of the analysis must match the scale of the decision. For a firm considering an investment of EUR 50 000, a tornado diagram of five variables and three scenarios will give almost all the possible gain in information; a full Monte Carlo model with a correlation matrix is here not thoroughness but procrastination. On the other hand, the same logic also works in the opposite direction: for a public sector infrastructure project on a scale of tens of millions of euros, sensitivity analysis alone is not enough, and presenting it as sufficient is a methodological error.

The availability of data. A third practical constraint is the shortness of historical series. Nasdaq Vilnius market data make it possible to calculate real Baltic parameters, but for many sectors the Lithuanian series are too short to justify parametric VaR: testing the normality assumption requires observations that simply do not exist. In such a case the more honest solution is not to state VaR with two decimal places but to present scenarios with clearly stated assumptions. This is not a lower level of analysis but the same avoidance of spurious precision that is discussed in section 4.1.3.

4.2 Analytical models and formulas#

This section presents thirteen principal risk analysis formulas with explanations of the variables and numerical examples. The formulas build on those of Chapter 3 (3.1–3.8) and cover the methods of sensitivity analysis, scenarios, Monte Carlo, business risk indicators and integrated analysis.

The elasticity coefficient — a measure of sensitivity#

The elasticity coefficient measures the relative sensitivity of the model result to a relative change in a variable:

where:

• $\varepsilon_{Y,X}$ is the elasticity of the result $Y$ with respect to the variable $X$,
• $Y_0$ is the base value of the result,
• $X_0$ is the base value of the variable,
• $\Delta Y$, $\Delta X$ are the respective changes.

Numerical example. In a firm’s DCF model the base NPV = EUR 500 000 at WACC = 10 %. If WACC increases to 12 % (a change of +20 %), NPV falls to EUR 350 000 (a change of −30 %).

An elasticity of −1.5 means that a 1 % increase in WACC reduces NPV by about 1.5 %. The negative sign shows an inverse relationship. If the similarly calculated elasticity of revenue growth is +0.8, then WACC is almost twice as important as revenue growth, and it will be at the top of the tornado diagram.

The expected value with scenario probabilities#

When several scenarios with assigned probabilities have been created, the expected value is calculated as a weighted average:

where:

• $E(V)$ is the expected value,
• $p_i$ is the probability of scenario $i$ ($\sum p_i = 1$),
• $V_i$ is the value of the result in scenario $i$,
• $n$ is the number of scenarios.

Numerical example. A Lithuanian exporting company assesses an investment project with three scenarios:

The expected NPV is positive (EUR 337 500), but this figure alone is not enough for a decision. The dispersion of the results must also be assessed.

The variance between scenarios#

The variance of the scenarios shows how far the results may vary around the expected value:

Numerical example (continued). Using the data given above ($E(V) = 337\ 500$):

The standard deviation of EUR 336 100 is almost equal to the expected value of EUR 337 500. The coefficient of variation (see formula (3.6) in Chapter 3): $CV = 336\ 100 / 337\ 500 \approx 1.00$ — this indicates a very high relative risk. In the pessimistic scenario the project makes a loss, so the decision-maker must decide whether a 25 % probability of a loss is acceptable.

The Monte Carlo confidence interval#

After $N$ Monte Carlo iterations the precision of the mean of the result is assessed by the standard error:

where:

• $\bar{Y}$ is the mean of the simulation results,
• $s_Y$ is the standard deviation of the simulation results,
• $N$ is the number of iterations,
• $1.96$ is the $z$-value of the standard normal distribution for the 95 % confidence level.

Numerical example. After 10 000 Monte Carlo iterations the DCF model generates: $\bar{Y} = \text{EUR}\ 420\ 000$, $s_Y = \text{EUR}\ 310\ 000$.

The 95 % confidence interval of the mean: [EUR 413 924; EUR 426 076]. This means that the mean itself has been established quite precisely (±EUR 6 076). However, the dispersion of individual results is considerably greater. If the distribution were normal, 95 % of the results would fall within the interval $\bar{Y} \pm 1.96 \times s_Y$, that is, approximately [EUR −187 600; EUR 1 027 600]. This condition is not a formality: section 4.1.3 criticises precisely the normality assumption, and the distribution of the case in section 4.4 is asymmetric, its 5th percentile (EUR −180 000) lying considerably further from the mean than a normal distribution would allow. Therefore, to state the true extent of the uncertainty, the actual percentiles of the simulation are used, and not the $\pm 1.96\,s_Y$ interval; the latter is given here only as an indication of size and as a reminder of how it differs from the error of the mean.

The break-even point — a basic risk indicator#

The break-even point shows the minimum sales volume needed to cover costs:

where:

• $Q_{BE}$ is the break-even sales quantity (in units),
• $FC$ is fixed costs,
• $P$ is the selling price per unit,
• $VC$ is variable costs per unit.

Numerical example. A Lithuanian manufacturing company: selling price EUR 50/unit, variable costs EUR 30/unit, fixed costs EUR 120 000/year.

If current sales are 8 000 units, the margin of safety = $(8\ 000 - 6\ 000) / 8\ 000 = 25\%$ — this means that sales may fall by 25 % before the company begins to make a loss. The break-even point is an intuitive and powerful communication tool, because it turns the question “is this business profitable?” into “how many units / what volume must we sell?” Operational managers can answer this question better than financial analysts.

The degree of operating leverage (DOL)#

The analysis of operating and financial leverage has been established in corporate finance textbooks since Van Horne’s (1968) Financial Management and Policy, Part VIII of which is devoted to the instruments of financial analysis — ratios, funds flows and, specifically, the analysis of operating and financial leverage. Mandelker and Rhee (1984) showed empirically the relationship between these indicators and systematic risk. These indicators became a standard instrument for assessing business risk in corporate finance and are presented today in the canonical textbooks of this field (Brealey, Myers, & Allen, 2020).

DOL shows by what percentage EBIT changes when sales change by 1 %:

where:

• $Q$ is the sales quantity,
• $P - VC$ is the contribution margin per unit,
• $FC$ is fixed costs.

Numerical example (continued). At sales of 8 000 units:

DOL = 4.0 means that a 10 % fall in sales will cause a 40 % fall in EBIT. The closer a company operates to the break-even point, the greater the DOL and the greater the operating risk. This is particularly relevant to capital-intensive industries (manufacturing, energy, logistics), where fixed costs make up a large share of total costs.

The degree of financial leverage (DFL)#

DFL shows how net profit responds to changes in EBIT:

where:

• $EBIT$ is earnings before interest and taxes,
• $I$ is interest expense.

Numerical example. The company’s EBIT = EUR 40 000 (from the previous example), annual interest EUR 15 000.

DFL = 1.6 means that a 10 % fall in EBIT will cause a 16 % fall in net profit. The degree of total leverage DTL = DOL × DFL = 4.0 × 1.6 = 6.4. This means that a 10 % fall in sales will ultimately cause a 64 % fall in net profit. This “leverage cascade” explains why firms with high fixed costs and high debts are extremely vulnerable to an economic downturn, and why leverage is one of the most important factors in risk analysis (more on capital structure in Chapter 11).

Parametric VaR#

Parametric VaR under the normal distribution assumption:

where:

• $VaR_{\alpha}$ is the loss threshold which the loss does not exceed at confidence level $\alpha$, expressed in money,
• $\mu$ is the expected return (or zero, if calculated over a short period),
• $z_{\alpha}$ is the quantile of the standard normal distribution (for example, $z_{0.99} = 2.326$; $z_{0.95} = 1.645$),
• $\sigma$ is the standard deviation of the return,
• $V_0$ is the value of the position at the time of assessment.

Without the multiplier $V_0$ the expression $-(\mu - z_{\alpha} \cdot \sigma)$ gives the loss as a share of value and not in money; both forms are used, but they must not be mixed in one calculation.

Numerical example. The value of an investment portfolio $V_0 = \text{EUR}\ 1\ 000\ 000$, the standard deviation of the daily return $\sigma = 1.5\%$, $\mu \approx 0$ (over one day the expected return is close to zero, so the formula simplifies to $VaR_{\alpha} \approx z_{\alpha} \cdot \sigma \cdot V_0$).

The daily VaR at the 99 % level = EUR 34 890. This means that on 99 days out of 100 the daily loss will not exceed EUR 34 890. But on that one day out of 100 the loss may be of any size, and VaR says nothing about this. It is precisely for this reason that CVaR is a more informative measure.

CVaR and Expected Shortfall#

Conditional Value at Risk (CVaR), or Expected Shortfall:

This form of notation holds when the loss distribution is continuous. For discrete outcomes — for example, in a scenario or decision tree model — the strict inequality $L > VaR_{\alpha}$ may cover too few outcomes or none at all, and the conditional value is then no longer a correct tail average. The inequality $ES_{\alpha} \ge VaR_{\alpha}$ holds in general, and the exact form applied in the discrete case calculates the tail average and gives only part of its weight to the outcome lying exactly at the VaR threshold. For business planning calculations the form (4.9) is sufficient, but in a scenario model it must be applied consciously.

The normal approximation:

where $\phi(z_{\alpha})$ is the value of the probability density function of the standard normal distribution at the point $z_{\alpha}$, $\mu$ is the expected return, and $V_0$ is the value of the position, as in formula (4.8). Since a loss is a return with the opposite sign ($L = -R$), a higher expected return reduces both VaR and CVaR. The quantities $\alpha$, $z_{\alpha}$ and $\phi(z_{\alpha})$ are not three independent parameters: once $\alpha$ is chosen, the other two are uniquely determined, so a change in the confidence level requires all three to be recalculated.

Numerical example (continued). With $z_{0.99} = 2.326$, $\phi(2.326) \approx 0.026674$ and $\mu \approx 0$ (the term $-\mu$ equals zero):

CVaR ≈ EUR 40 011 — this means that the average loss on those days when the VaR threshold is exceeded (that is, on that 1 day out of 100) is about EUR 40 011. CVaR is greater than VaR (EUR 40 011 > EUR 34 890), because it covers the whole tail area and not only the threshold point.

The expected monetary value in a decision tree (EMV)#

EMV makes it possible to compare decision alternatives while taking uncertainty into account:

where:

• $p_k$ is the probability of the $k$-th result,
• $C_k$ is the monetary value of the $k$-th result,
• $I_0$ is the initial investment cost,
• $m$ is the number of possible results.

Numerical example. A firm is considering two options: (A) a full investment of EUR 500 000 at once, or (B) a pilot project of EUR 150 000, followed by a decision on full expansion (a further EUR 400 000).

Option A (full investment):

• Success (p = 0.6): a return of EUR 900 000
• Failure (p = 0.4): a return of EUR 200 000

Option B (staged):

• The pilot stage reveals information; if it is successful (p = 0.6), the full sum is invested and the probability of success rises to 0.85
  • $EMV_{expansion} = 0.85 \times 900\ 000 + 0.15 \times 200\ 000 - 400\ 000 = 765\ 000 + 30\ 000 - 400\ 000 = \text{EUR}\ 395\ 000$
• If the pilot stage is unsuccessful (p = 0.4), the project is stopped, with a loss of EUR 150 000

Although option A has the higher EMV (EUR 120 000, compared with EUR 87 000), option B reallocates the risk. Option A has two outcomes: EUR +400 000 ($p = 0.60$) and EUR −300 000 ($p = 0.40$). Option B has three: EUR +350 000 ($p = 0.51$), EUR −350 000 ($p = 0.09$) and EUR −150 000 ($p = 0.40$). The staged option therefore does not cut off the worst outcome — it is in fact larger (EUR −350 000) — but it reduces its probability to 9 %, and it limits the most likely loss to EUR 150 000 instead of EUR 300 000. As a result the expected loss falls from EUR 120 000 to EUR 91 500. This is the logic of real options in practice: a staged investment may be justified even when its EMV is lower, because it reallocates risk and provides the possibility of abandonment (more on this in Chapter 14). The comparison below shows whether the information itself pays off. At the same time the example also shows the limit of this logic: abandonment is possible only after a bad signal, while after a good signal the full sum is invested, and it is precisely that branch that is the worst.

How much is information worth in total? Before explaining whether the pilot stage “paid for itself”, it is useful to calculate the upper limit — the value of perfect information (Expected Value of Perfect Information, EVPI). It is obtained from the same formula (4.10): if the outcome could be known in advance, one would invest only in the case of success and not at all in the case of failure:

It is not worth paying more than EUR 120 000 for any information, even if it were perfect. The pilot stage can now be assessed as well: it gives EUR 87 000, that is, EUR 33 000 less than simply investing the whole sum at once. Consequently, imperfect information costing EUR 150 000 does not add expected value but takes it away.

This does not mean that the pilot stage is a mistake. It means that its justification is not the value of information but the reallocation of risk that has just been calculated. The difference matters in practice: if a project is justified with the words “the pilot stage will provide valuable information”, that value must be stated in a figure and compared with the cost of the stage. It often turns out that the information itself is cheap, but that the way of obtaining it, such as a pilot stage, is expensive.

The Omega ratio#

The Omega ratio (Keating & Shadwick, 2002) is an alternative risk–return measure covering the whole distribution of returns — not only the mean and the variance but also skewness and kurtosis:

where:

• $F(r)$ is the cumulative distribution function of returns,
• $\theta$ is the chosen threshold level of returns.

The numerator represents the “gains area” (the expected excess above $\theta$) and the denominator the “losses area” (the average shortfall below $\theta$). When $\Omega > 1$, the investment “wins” more than it “loses” at the chosen threshold. The advantage of Omega over the Sharpe ratio is that it does not require the normality assumption and by its nature covers all the moments of the distribution.

Numerical example. Suppose there are two investment funds whose monthly returns over 12 months (%) are:

• Fund A: 2, 4, −1, 3, −2, 5, 1, −3, 6, 2, −1, 4 (mean ≈ 1.67 %)
• Fund B: 1, 1, 1, 2, 0, 1, 2, 1, 0, 1, 1, 1 (mean ≈ 1.00 %)

With the threshold $\theta = 0\%$ (that is, “does the fund earn anything?”):

• Fund A: 8 months above 0 %, 4 months below. Sum of gains = 27 %, sum of losses = 7 %. $\Omega_A(0) \approx 27/7 = 3.86$.
• Fund B: 10 months above 0 %, 2 months at exactly 0 %. Sum of gains = 12 %, sum of losses ≈ 0 %. $\Omega_B(0) \to \infty$ (in practice very large).

Although fund A has the higher mean, fund B has the higher Omega, because it almost never loses. This illustrates why the Omega ratio can reveal aspects of risk and return that the mean and the standard deviation do not show, particularly when the distribution of returns is asymmetric.

Maximum drawdown (MDD) and the Calmar ratio#

Maximum drawdown — the fall in value from peak to trough — is an intuitive and psychologically significant measure of risk:

where $V_{peak,t}$ is the highest portfolio value reached up to time $t$, and $V_{trough,t}$ is the lowest value after the peak.

A practical interpretation: a −30 % drawdown requires a +42.9 % recovery merely for the value to return to its original level ($1/0.7 - 1 \approx 0.429$). The Calmar ratio normalises the return by MDD:

The Calmar ratio makes it possible to compare investments or business projects by their risk–return relationship, taking into account the maximum drawdown and not only the variance. For example, if the value of a portfolio fell from EUR 100 000 to EUR 70 000 (MDD = 30 %), and the annual return was 12 %, then $Calmar = 12\% / 30\% = 0.40$: each percentage point of maximum drawdown corresponds to 0.4 percentage points of annual return.

The first-order Sobol’ index — a measure of global sensitivity analysis#

Formula (4.1) measures local sensitivity (one variable, one change). The Sobol’ index (Saltelli et al., 2008) is a global measure of sensitivity, assessing the effect of a variable across the whole range of its possible values:

where:

• $S_i$ is the first-order Sobol’ index for the variable $X_i$,
• $\mathbb{E}[V \mid X_i]$ is the conditional expected value of the model result, given the value of $X_i$,
• $\text{Var}(V)$ is the total variance of the model result.

$S_i = 0.45$ means that 45 % of the whole uncertainty of the model arises from the variable $X_i$. The total-order index $S_{T_i}$ additionally covers all the interactions of the variable with other variables. The difference $S_{T_i} - S_i$ shows the importance of the interactions.

Numerical example. In the DCF model of UAB “BaltTech” (uždaroji akcinė bendrovė — a limited liability company whose shares may not be offered publicly; see section 4.4), GSA with 10 000 iterations gives: price $S_1 = 0.42$, sales volume $S_2 = 0.28$, raw materials $S_3 = 0.15$, WACC $S_4 = 0.08$, labour costs $S_5 = 0.04$. The sum $\sum S_i = 0.97 \approx 1$ — the model is almost additive and the interactions are insignificant. This confirms the conclusion of the tornado analysis: price and sales volume are the two most important factors. However, if $\sum S_i$ were, for example, 0.65, this would mean that 35 % of the uncertainty arises from interactions between variables, which one-way sensitivity analysis did not see at all.

A limitation without which this figure cannot be interpreted. The indices were calculated by treating the variables as independent, whereas the Monte Carlo model of the case in section 4.4 has correlations ($\rho = +0.3$ between sales and price, $+0.2$ between sales and raw materials). In the presence of correlations variance decomposition is no longer an exact division of the variance, so $\sum S_i = 0.97$ shows not that “there are almost no interactions” but that “under the independence assumption there are almost no interactions”. This is exactly the situation for which section 4.1.2 mentions Shapley effects: for correlated variables they give an unambiguous attribution, which Sobol’ indices can no longer give.

Summary of the formulas#

Table 4.1. The formulas of Chapter 4

4.3 Summary#

This chapter has presented the four principal methods of risk analysis and their integration into a unified system. The main conclusions are:

1. Sensitivity analysis identifies critical variables and is the most effective communication tool (the tornado diagram), but it ignores interactions between variables and does not show probabilities. The global sensitivity analysis of Saltelli and colleagues (2008) solves the problem of interactions but requires a Monte Carlo infrastructure.

2. Scenario analysis is the only method capable of capturing structural breaks — qualitatively new pictures of the world that quantitative models do not cover. However, it depends on the thinking horizon of its creators and is vulnerable to anchoring and narrow framing biases. The modern 2×2 matrix approach is superior to the classical optimistic/base/pessimistic model.

3. Monte Carlo simulation transforms a deterministic model into a probabilistic one, making it possible to assess uncertainty quantitatively through a distribution function. Its power and its weakness are one and the same: it transfers assumptions into results with statistical precision. If the assumptions are good, the results are informative; if the assumptions are bad, the results are wrong but look scientific.

4. Risk indicators (VaR, CVaR, Omega, MDD, DOL/DFL, the break-even point, stress tests) provide standardised metrics for decision-making. The non-coherence problem of VaR and the Basel move to CVaR illustrate a wider lesson: a quantitative measure is useful to the extent that its limits are well understood. The Omega ratio and maximum drawdown supplement the traditional variance measures by taking into account the whole shape of the distribution and the largest losses.

5. An integrated system combines all the methods into a progressively deepening sequence: tornado (what matters?) → scenarios (what could happen?) → Monte Carlo (what is the probability?) → indicators (how much are we risking?) → decision. However, this system must be applied proportionately, because “analysis paralysis” is a real risk.

6. Model risk — the possibility that the model itself is structurally wrong — is the most important and most difficult dimension of risk to manage. No quantitative methods can protect against unknown unknowns, so quantitative analysis must be supplemented by qualitative strategies (monitoring of the environment, organisational learning, strategic flexibility, real options thinking).

The methods of this chapter prepare the ground for further topics of the book. In Chapter 5 diversification decisions rely on portfolio risk measures, and in Chapter 9 the analysis of financial statements uses leverage ratios. In Chapter 11 the sensitivity analysis of WACC shows how uncertainty about the discount rate affects the whole valuation. In Chapter 14 real options and decision trees are applied to the valuation of start-ups and of mergers and acquisitions (M&A).

4.4 Case studies and worked examples#

Case 1: UAB “BaltTech” — an integrated risk analysis of a manufacturing investment#

This is a hypothetical teaching example based on a typical situation in the Lithuanian furniture manufacturing sector. The figures are illustrative, reflecting the proportions of an average exporting manufacturing company.

The situation#

UAB “BaltTech” is a Lithuanian furniture manufacturer that exports about 60 % of its output to Germany and Scandinavia. The company is considering an investment of EUR 1.5 million in an automated production line, which is expected to reduce labour costs by 30 % and increase production capacity by 40 %. The duration of the project is 7 years. Base WACC = 11 %, base NPV = EUR 420 000.

The board asks the chief financial officer to carry out a full risk analysis before a decision is taken.

The NPV amounts given below — the base value, the scenario values and the Monte Carlo statistics — are teaching data taken as given. They are derived from a full financial model of the project which is not included in the chapter (fixed costs, the distribution of cash flows over time and taxes are not given here). What can be reproduced are the elasticities and their relationship to one another, since they are derived from the unit parameters stated in the table. The lesson of this case is the sequence of the methods and what each method shows, not the precision of any individual figure.

Step 1: Sensitivity analysis (the tornado diagram)#

The chief financial officer identifies five critical variables and carries out a one-way sensitivity analysis, changing each variable by ±20 % from its base value:

The tornado diagram reveals that product price (a range of EUR 1 020 000) is clearly the most important factor, while sales volume (EUR 442 000) and raw material price (EUR 408 000) are almost level. Labour costs and WACC have considerably less influence.

Why price outweighs volume, although both are changed by the same ±20 %. The unit price is EUR 150, while the contribution margin is only EUR 65 ($150 - 60 - 25$). A change in price affects the whole EUR 150, whereas a change in volume affects only the contribution margin, so the leverage of price is $150 / 65 \approx 2.3$ times greater. This is not a property of this example but a general rule: in one-way sensitivity analysis, as long as variable costs are above zero, price always outweighs volume. If a tornado table shows the opposite, what is checked first is not the conclusion but the table.

The elasticity coefficients according to formula (4.1) (the change in NPV divided by the 20 % change in the variable): price $\varepsilon \approx 6.07$; sales volume $\varepsilon \approx 2.63$; raw materials $\varepsilon \approx -2.43$; labour costs $\varepsilon \approx -1.01$; WACC $\varepsilon \approx -0.59$. The ratio of the price and volume elasticities, $6.07 / 2.63 \approx 2.3$, repeats the same $150 / 65$ ratio, and this is a check worth carrying out in every tornado table.

Conclusion: the greatest attention must be given to pricing strategy, followed by the sales forecast and raw material purchase contracts.

Step 2: Scenario analysis#

On the basis of the tornado results, three scenarios are created, changing all the variables in a coordinated way (not just one at a time):

$CV = 406\ 000 / 370\ 000 \approx 1.10$ — the dispersion exceeds the expected result itself, so the relative risk is high. In the pessimistic scenario the project makes a loss.

The scenario NPVs coincide with the sensitivities of step 1 only approximately, and this is as it should be: in the scenarios the variables are changed at the same time, so their interactions come into play, and one-way analysis does not cover these. If the difference were not just approximate but consistently in one direction (for example, the dispersion of the scenarios being considerably smaller than what the tornado table shows), this would mean that the scenarios had been constructed too cautiously.

Step 3: Monte Carlo simulation#

Probability distributions are assigned to five variables:

• Sales: triangular (8 000; 10 000; 12 500) — expert assessment
• Price: normal ($\mu = 150$, $\sigma = 12$) — historical data
• Raw materials: lognormal ($\mu = 60$, $\sigma = 10$) — the asymmetry of the raw material market
• WACC: normal ($\mu = 11\%$, $\sigma = 1.5\%$)
• Labour costs: triangular (20; 25; 32) — with the uncertainty of automation

Correlation: sales ↔ price: $\rho = +0.3$ (better demand → the possibility of raising the price); sales ↔ raw materials: $\rho = +0.2$ (the common economic cycle).

After 10 000 iterations the model gives:

• Mean NPV: EUR 405 000
• Standard deviation: EUR 310 000
• $P(NPV < 0) = 18.5\%$
• 5th percentile: EUR −180 000
• 95th percentile: EUR 920 000

Interpretation: almost one iteration in five shows a loss. In the case of the 5th percentile the loss reaches EUR 180 000. The pessimistic scenario (EUR −250 000) lies below this percentile, because in it all the variables worsen at the same time, and its probability of 0.25 is a scenario weight, not a simulation frequency.

Step 4: The decision — a staged investment#

In view of the 18.5 % probability of a loss, the board decides to apply staged investment: first to invest EUR 500 thousand in a pilot line (a 6-month trial period) and to invest the remaining EUR 1 million only if the results are confirmed. This creates:

• The option to abandon: if the pilot stage proves unsuccessful, only EUR 500 thousand has been irrevocably committed, and not the whole sum of EUR 1.5 million. This is a limit on the capital at risk and not on the loss: even if the whole sum is invested, the 5th percentile is an NPV of EUR −180 thousand and the pessimistic scenario an NPV of EUR −250 thousand, not a loss of EUR 1.5 million
• Information: the pilot stage reveals the real sales and cost parameters, reducing the uncertainty of the Monte Carlo assumptions. Whether it is worth the cost of the stage must be stated in a figure: the example in section 4.2 shows how the value of perfect information is obtained from formula (4.10) and how it is compared with the cost of the stage. In that example the information does not pay for its cost, and the justification for the pilot stage is the reallocation of risk

The logic of the decision tree (formula (4.10)) here shows the same thing as was calculated in the example in section 4.2: the staged approach has a lower EMV but a better risk profile, and it does not cut off the worst outcome but only reduces its probability.

Case 2: A 2×2 scenario matrix for the Lithuanian energy sector#

A mixed teaching example: the context of the scenarios is based on real events in the Lithuanian energy sector (the closure of Ignalina, the LNG terminal, the NordBalt/LitPol interconnections, the energy crisis of 2022), but the particular company and the investment data are hypothetical.

The situation#

A renewable energy company is planning an investment of EUR 5 million in a solar power park in Lithuania. There are two main sources of uncertainty: (1) the electricity price regime (high or low, depending on geopolitics and the energy market) and (2) the regulatory environment (favourable or restrictive, depending on EU policy and national decisions).

The 2×2 matrix#

The four scenarios are not a “good–bad” spectrum; they require different strategies:

• “Green Boom” → aggressive expansion, long-term power purchase agreements (PPA)
• “Quiet Transformation” → a focus on managing the grants available under the regulation
• “Free Wave” → an orientation to the wholesale market, less dependence on the state
• “Calm Before the Storm” → minimal investment, an option to defer

The quantitative view and its limit#

The 2×2 matrix deliberately has no “base” scenario, so here probabilities are assigned not to scenarios but to axes, and only then multiplied together. Suppose the analyst estimates the probability of a high electricity price regime at 45 % and that of a favourable regulatory environment at 55 %. Treating the axes as independent gives four scenario probabilities:

The expected value according to formula (4.2):

The dispersion according to formula (4.3):

The coefficient of variation exceeds one: the dispersion is greater than the expected result itself. However, the most important lesson of this calculation is a different one, and it contradicts the first impression. The expected value of EUR 1.055 million is positive, but no single scenario yields it. Each of the four scenarios requires a different plan of action; EUR 1.055 million is the average of four incompatible futures, which nobody can “obtain”. This is the flaw of averages: a weighted average is treated as a result that can be achieved, although it lies between mutually exclusive outcomes.

This error is close to the anchoring to the base scenario discussed in section 4.1.3, but it is not the same, and the difference explains why the antidote is different. Anchoring attaches to one of the futures presented, usually the middle one, and attention slides away from the extremes; here one becomes attached to a figure that is not among the presented futures at all. Anchoring is countered by additional, broader scenarios, but these do not correct the flaw of averages: when a scenario is added, the average simply shifts, but it will still not be the result of any strategy. The only antidote is not to consider a decision on the basis of $E(V)$ where the outcomes are mutually exclusive.

Another limitation is the independence assumption. The axes are most probably not independent: prolonged high electricity prices themselves increase political pressure for intervention, and thus increase the probability of restrictive regulation. If this link is positive, the probability of “Free Wave” is underestimated and that of “Green Boom” overestimated, and the whole weighted average shifts downwards. The multiplication here is a convenient means of calculation and not an established fact.

The decision in this case is therefore taken not on the basis of $E(V)$ but on the basis of two things that the matrix shows better than any average: the worst outcome (EUR −0.5 million, that is, one tenth of the investment) and its probability (25 %). It is precisely in such a configuration that the rational answer is a staged investment with an option to defer — the same conclusion to which the first case leads by a different route.

The Lithuanian context. These scenarios are not abstract; they reflect real trajectories of the Lithuanian energy sector. After the closure of the Ignalina nuclear power plant (2009), the launch of the LNG terminal (2014) and the appearance of the NordBalt and LitPol Link interconnections, the Lithuanian energy market changed fundamentally. Russia’s invasion of Ukraine in 2022 caused a jump in energy prices which made the projects of some investors extremely profitable and those of others loss-making. Scenario analysis would have made it possible to prepare for both trajectories instead of relying on a single “base” scenario.

4.5 Building the Excel model#

Objective#

The student constructs a set of risk analysis calculators implementing all thirteen formulas of section 4.2: the elasticity coefficient and the Sobol’ index (sensitivity), the expected value with the variance (scenarios), the confidence interval (Monte Carlo), the break-even point with the degrees of leverage, VaR, CVaR, Omega, maximum drawdown and the EMV of a decision tree (risk indicators). The logic of the model follows the sequence of four methods shown in Figure 4.2 and the course of the decision in the “BaltTech” case (see section 4.4).

The architecture of the model#

The model consists of fourteen sheets: an “Įvadas” sheet and one sheet for each formula (F4.1–F4.13). This division is not a technical convenience. In risk analysis the main cause of errors is not arithmetic but the mixing of methods: when VaR, the variance and leverage are calculated on the same sheet, it is no longer clear which assumption affects which result. A separate sheet for each formula forces the student to understand one instrument at a time, in isolation, while combining them into one decision is left to the case in section 4.4 and the independent work task.

Each sheet is made up of the same six blocks: A the heading and a description of the variables, B the situation (what this calculation is needed for), C the data, D the calculations, E the visualisation with a sensitivity curve and table, F the interpretation. For the student this means that the same things can be looked for on every sheet: where the inputs are, where the formula is, where the conclusion is.

Named ranges. All the inputs and results are named; the formulas refer to names, not to cell addresses. There are 124 of them in the model, and all have the same structure, CH04_F4_<formula>_<variable> — for example, CH04_F4_8_sigma is the standard deviation in formula (4.8), and CH04_F4_9_cvar is the result of (4.9). (In the published model the sheet and range names are in Lithuanian: Įvadas — introduction; isvada — conclusion; sl — threshold; skirt — difference; atsig — recovery; sr — margin of safety.) The formula =(CH04_F4_6_cm/(CH04_F4_6_cm-CH04_F4_6_fc)) can be read without a key, whereas =(C23/(C23-C16)) cannot.

Automatic conclusions. In block F of every sheet there is a cell ..._isvada, in which a formula itself states an assessment in a sentence. The thresholds by which it decides are kept in separate cells (..._sl_1, ..._sl_2) and are not written into the condition: the threshold for the coefficient of variation is 0.75, for the margin of safety 0.2, for DOL 3.0, for DTL 5.0 and for Omega 2.0. A threshold can be changed without touching any formula, and that is precisely the pedagogical point of this arrangement: a threshold is an assumption, not a law of nature.

Step-by-step instructions#

The sheets are filled in following the order of the four methods, the same order in which a real analysis proceeds. At the end of each step there is a check point: a control question whose negative answer means an error in the model and not bad data.

Step 1. What matters? (the “F4.1” and “F4.13” sheets)#

On sheet F4.1 the base and changed values of the result (CH04_F4_1_y0, CH04_F4_1_y1) and the base and changed values of the assumption (CH04_F4_1_x0, CH04_F4_1_x1) are entered. The relative changes (..._dy, ..._dx) and the elasticity CH04_F4_1_eps according to (4.1) are calculated. The procedure is repeated for each assumption separately — the resulting order of elasticities is the basis of the tornado diagram.

On sheet F4.13 the same question is asked globally: the variance of the conditional mean and the total variance (CH04_F4_13_varcond, CH04_F4_13_vartot) give the first-order Sobol’ index, and the difference from the total-order index (CH04_F4_13_sti) shows the share of interaction.

Check. Elasticity is measured by changing one assumption at a time. If changing one variable also changes the elasticities of others, the sheet contains a cross-reference that should not be there. If the Sobol’ interaction effect $S_{T_i} - S_i$ comes out negative, this does not necessarily mean that cells have been swapped: for independent variables it cannot be negative, so the first thing to check is whether the inputs really are independent and whether the sample is large enough. A negative value is most often a sign of correlation or of estimation error, not of a formula error.

Step 2. What could happen? (the “F4.2” and “F4.3” sheets)#

On sheet F4.2 the probabilities of two scenarios (CH04_F4_2_p1, CH04_F4_2_p2) and the results of three scenarios (..._v1–..._v3) are entered. The third probability is not entered but calculated: CH04_F4_2_p3 = 1 − p1 − p2. The result is the expected value CH04_F4_2_ev according to (4.2).

On sheet F4.3 the same structure of inputs is supplemented by measures of dispersion: the standard deviation CH04_F4_3_sigma (4.3) and the coefficient of variation CH04_F4_3_cv.

Check. If CH04_F4_2_p3 comes out negative, the probabilities of the first two scenarios exceed one, so the expected value is in that case meaningless. This is not a spreadsheet error but an error of assumptions, and the model must show it and not hide it.

Step 3. What is the probability? (the “F4.4” sheet)#

The mean of the simulation results (CH04_F4_4_ybar), the standard deviation (CH04_F4_4_sy), the number of iterations (CH04_F4_4_n) and the critical $z$ value (CH04_F4_4_z) are entered. The standard error CH04_F4_4_se and the limits of the interval ..._lo, ..._hi are calculated according to (4.4).

Check. If the number of iterations is increased fourfold, the width of the interval must narrow approximately by half, and this is the directly visible $O(1/\sqrt{n})$ rate of convergence (see section 4.1.2). If the width does not change, the formula is using a typed-in number rather than CH04_F4_4_n.

Step 4. How much are we risking? Operating risk (the “F4.5”–“F4.7” sheets)#

F4.5: fixed costs, price, variable costs and quantity give the break-even point CH04_F4_5_qbe (4.5) and the margin of safety ..._sr. F4.6: the same data give the contribution margin, EBIT and operating leverage CH04_F4_6_dol (4.6). F4.7: EBIT and interest give financial leverage CH04_F4_7_dfl, and multiplying by DOL gives total leverage CH04_F4_7_dtl (4.7).

Check. The closer EBIT is to zero, the greater the DOL. If DOL does not reach a very large value at the break-even point, the denominator is most probably not using cm − fc. Conversely, if DOL comes out below one, this is not necessarily an error. With no fixed costs DOL equals one, and it falls below one when fixed costs are negative (for example, when a grant partly covers the operations). The value of CH04_F4_6_fc is checked first, and only then the formula.

Step 5. How much are we risking? Financial risk (the “F4.8”, “F4.9”, “F4.11” and “F4.12” sheets)#

F4.8: the portfolio value, the standard deviation, the expected return and the critical $z$ value give VaR as a percentage (CH04_F4_8_varpct) and in euros (..._vareur). F4.9: adding to the same inputs the density value (..._phi) and the confidence level (..._alpha) gives CVaR and — most importantly — the difference between them, CH04_F4_9_skirt. F4.11 calculates the Omega ratio as the ratio of gains to losses, and F4.12 the maximum drawdown, the recovery requirement and the Calmar ratio.

Check. CH04_F4_9_skirt must be positive: with a continuous distribution CVaR is greater than VaR at the same level, because it measures the average beyond the threshold and not the threshold itself. A negative difference on this sheet means that the arguments have been swapped. (For discrete outcomes the strict inequality is not automatically guaranteed: the difference may be zero — see the note at formula (4.9).) CH04_F4_12_atsig must be greater than ..._mdd, because offsetting a 50 % drawdown takes 100 % growth, and this asymmetry is one of the most practical lessons of the whole chapter.

Step 6. What do we do? (the “F4.10” sheet)#

The probability of success (CH04_F4_10_psucc), the results in the cases of success and failure (..._csucc, ..._cfail) and the initial investment (..._i0) are entered. The EMV (4.10) and the worst-case result CH04_F4_10_worst are calculated.

Check. A positive EMV with an unacceptable ..._worst is not a decision to invest. It is precisely here that one sees why a decision tree requires a second figure too: the average does not say whether the firm could withstand the worst outcome at all.

How to check the whole model#

1. Change one input in a blue cell — every result that depends on it must be recalculated, including the sensitivity table in block E and the conclusion in block F.
2. No hard-coded number may remain in the formulas apart from structural ones (0, 1, 2) and integer powers: every quantity and every threshold comes from a named range.
3. Change the threshold ..._sl_1 — the text of the conclusion must change without any editing of the formula.
4. Automatic check: python Excel/patikra.py 4 (it checks the figures, references, conclusions, the agreement of the formulas with the website calculators and values written directly into conditions).

Files:

• Excel/CH04/Ch04_Formula_Guide.md — a description of all fourteen sheets with the named ranges and the Excel formulas (a single source of truth)
• Excel/CH04/Ch04_Model_Master.xlsm — the full model with formulas, charts and sensitivity tables

4.6 Questions and exercises#

4.6.1 Facts and concepts (recognition level)#

Question 4.1 [recognition]. Name the four risk analysis methods in the order of Figure 4.2 and state for each the question it answers.

Question 4.2 [recognition]. List the three methods of calculating VaR (section 4.1.2) and state which of them requires no assumption about the shape of the distribution of returns.

4.6.2 Explanations (comprehension level)#

Question 4.3 [comprehension]. Explain how the degree of operating leverage (DOL) differs from the degree of financial leverage (DFL) and why their product is called total leverage.

Question 4.4 [comprehension]. Explain why, for a continuous distribution, CVaR is greater than VaR at the same confidence level, and what this difference says about the tail of the loss distribution.

4.6.3 Computational exercises (application level)#

The answers are in Appendix C. They are indicative and intended for self-assessment; the exact figures depend on assumptions that the student must write down clearly.

Question 4.5 [application]. Sensitivity analysis. The base NPV of an investment project = EUR 200 000. A one-way sensitivity analysis established that: (a) if WACC increases from 10 % to 12 %, NPV falls to EUR 120 000; (b) if revenue increases by 10 %, NPV rises to EUR 280 000. Calculate the elasticity coefficients and determine which variable is more important.

Question 4.6 [application]. Scenario analysis. Three scenarios: optimistic (NPV = EUR 500 000, p = 0.20), base (NPV = EUR 180 000, p = 0.55), pessimistic (NPV = EUR −80 000, p = 0.25). Calculate: (a) the expected value $E(V)$; (b) the standard deviation $\sigma$; (c) the coefficient of variation $CV$; (d) the probability that the project will make a loss.

Question 4.7 [application]. Leverage. A company’s data: sales of 5 000 units, price EUR 80/unit, variable costs EUR 50/unit, fixed costs EUR 90 000, interest EUR 20 000. Calculate: (a) the break-even point; (b) the margin of safety; (c) DOL; (d) DFL; (e) DTL. How would a 15 % fall in sales affect net profit?

Question 4.8 [application]. VaR and CVaR. The value of a portfolio is EUR 2 million, the standard deviation of the daily return is 2 %, and the expected daily return ≈ 0 %. Calculate: (a) the daily VaR at the 95 % level ($z_{0.95} = 1.645$); (b) the daily VaR at the 99 % level ($z_{0.99} = 2.326$); (c) CVaR at the 99 % level ($\phi(2.326) \approx 0.026674$). Explain why in this case CVaR > VaR.

4.6.4 Comparative analysis (analysis level)#

Question 4.9 [analysis]. Why may the three-scenario model (optimistic/base/pessimistic) be more dangerous than the use of a single scenario? Discuss the anchoring effect and the problem of narrow framing.

Question 4.10 [analysis]. VaR entered the capital requirements of banks through the Market Risk Amendment of 1996, but the Basel Committee later moved to CVaR (the Basel III reform, FRTB). Why? Explain the subadditivity axiom and its practical significance.

4.6.5 Synthesis and original design exercises (synthesis level)#

Question 4.11 [synthesis]. An Excel model. Construct the sheets F4.1–F4.13 according to the instructions in section 4.5, and then combine them into one analysis of an investment project: (a) the tornado order of five elasticities (F4.1); (b) the expected value of three scenarios with the coefficient of variation (F4.2, F4.3); (c) the confidence interval for a simulation of 1 000 iterations (F4.4); (d) leverage and the margin of safety (F4.5–F4.7). Present an interpretation of the results and a recommendation — to invest or not.

Question 4.12 [synthesis]. A 2×2 scenario matrix. Choose a Lithuanian business sector (for example, financial technology, manufacturing, logistics, real estate). Identify the two most important sources of uncertainty. Create a 2×2 scenario matrix with four qualitatively different scenarios. For each scenario describe: (a) the narrative (what happened?); (b) the main financial parameters; (c) the recommended strategy. Explain how this approach is superior to the classical optimistic/base/pessimistic model.

4.6.6 Open discussion questions (evaluation level)#

Question 4.13 [evaluation]. Monte Carlo simulation generates an NPV distribution with precise statistical parameters. Why may this “precision” be misleading? Explain the problem of “garbage in – beautifully distributed garbage out”.

Question 4.14 [evaluation]. How does “analysis paralysis” show itself in practice? Discuss the principle of proportionality: what level of risk analysis is appropriate for (a) an investment of EUR 50 000, (b) an investment of EUR 5 million, (c) an infrastructure project of EUR 50 million?

Question 4.15 [evaluation]. Danielsson (2011, p. xiv) states: “financial risk models have the annoying habit of failing when needed the most”. What does this mean, and what are the practical consequences for the risk analysis process?

4.6.7 Decisions with AI#

The earlier questions in this section test whether the student can apply the four risk analysis methods. These two test something else — whether the student chooses the right method and notices when a correctly performed calculation answers the wrong question. The procedure for completing the tasks is described in Appendix A: the course of the extended task — A.1, the verification protocol — A.2, the handover record — A.3, the verdict — A.4, the defence and opposition — A.5, the assessment criteria — A.6, the conditions — A.7. The appendix must be read before starting the task.

Question 4.16 [basic task]. The situation. UAB “Kaitra” (a hypothetical company) provides heat treatment services for metal parts. Electricity makes up about 35 % of its operating costs, and the technological process requires high instantaneous power. The company is considering an investment of EUR 1.2 million in a new furnace line. At the same time the regulator has published a draft restructuring of the electricity network tariff: payment according to the kilowatt-hours consumed would be replaced by a capacity charge based on instantaneous power. The company’s manager has asked an AI assistant to assess the risk of the project. Before reading the AI summary, steps 0a and 0b of the protocol (A.2) are written down.

This is a task at level 2 of openness: where to look for the weak point is not indicated.

Risk analysis of the furnace line of UAB “Kaitra”. A Monte Carlo simulation with 10 000 iterations was carried out. The variables and their distributions were established from the company’s data for 2019–2025: order volume (normal), electricity price (lognormal), labour costs (triangular).

Results: mean NPV — EUR 210 thousand, standard deviation — EUR 120 thousand. The standard error (formula 4.4): $se = 120 / \sqrt{10\,000} = \text{EUR}\ 1.2\ \text{thousand}$, so the 95 % confidence interval for the mean is [EUR 207.6 thousand; EUR 212.4 thousand] — a very precise estimate. The probability that the project will make a loss, $P(NPV < 0) = 4.0\ \%$.

Conclusion. The mean NPV is positive, the confidence interval is narrow and the probability of a loss is low. The risk of the project is low. Recommendation: invest.

The verification protocol (A.2) is applied to the summary. In this task the check has two parts, and the first will find no errors — and this is as it should be.

Part one: are the figures correct? The standard error and the confidence interval are recalculated according to formula (4.4); it is checked whether the stated 4 % probability of a loss is consistent with the given mean and standard deviation. It is also assessed whether 10 000 iterations are enough for a tail probability (see section 4.1.2 on convergence). All three things must be recorded in the protocol, even if they are confirmed.

Part two: has the right question been answered? Using the four-method system of Figure 4.2, it is established which question had to be answered by this decision and which method is intended for it. An answer is given as to whether a Monte Carlo simulation whose distributions were built from data for 2019–2025 can show the effect of the tariff restructuring at all.

The quantitative part. The effect of the tariff restructuring is modelled with two scenarios: the restructuring is postponed or proves insignificant (NPV = EUR 210 thousand), and the restructuring takes effect and the capacity charge increases costs (NPV = EUR −180 thousand). Instead of guessing the probabilities, it is calculated what the probability of the restructuring taking effect must be for the expected value of the project to become zero (formula 4.2 is rearranged). Then, taking that probability as the threshold, the standard deviation is calculated according to formula (4.3), and an answer is given as to whether the coefficient of variation is informative in this case.

To be submitted: up to two pages — the records of the eight steps of the protocol (0a, 0b and 1–6), the results of both parts of the check, the calculation of the threshold probability and a verdict with a review condition (A.4). One question is also answered: what does it mean that the confidence interval was calculated correctly, yet the decision would still have been wrong?

Question 4.17 [extended task]. This task is intended for independently choosing a risk analysis method and defending that choice. The student formulates a research question, delegates part of the analytical work to AI tools, checks the results obtained critically and defends the conclusion in a seminar. The general principles are set out in Appendix A, while the mechanics of the task specific to this chapter are detailed here. The basic task does not require an agent environment; for the extended one the AI agent working environment described in Appendix B is recommended — its files are then submitted together with the work (A.3).

Task conditions. The lecturer assigns each student a real investment or operational decision of a stated scale — from a few tens of thousands to tens of millions of euros. The student personally chooses the method from the four discussed in section 4.1.2: sensitivity analysis, scenario analysis, Monte Carlo simulation or risk indicators. According to the levels of openness set out in A.1 this corresponds to level 3; if only the sector is specified, to level 4.

Only one method — the chosen one — is carried out. The essence of the task is the choice and its justification, not a demonstration of the whole arsenal. If sensitivity analysis is reasonably chosen, there is no need to carry out a Monte Carlo simulation.

What the defender must prove. The work must contain four things:

1. Identifying the question. Which of the four questions — “what matters?”, “what could happen?”, “what is the probability?”, “how much are we risking?” — has to be answered for this particular decision. If several have to be answered, their order and which one is decisive are stated.
2. Justifying the choice of method. Why the chosen method answers that question. The justification is linked to the properties of the decision: the nature of the uncertainty (parametric or structural), the availability of data, the reversibility of the decision and its scale (the principle of proportionality, section 4.1.2).
3. What the methods not chosen would not have shown. For each of the three methods not chosen, one sentence: what it would have added and why this was not sufficient or not worthwhile. Without this part the work is regarded as unfinished, because it is precisely this part that shows that the method was chosen and did not merely happen to be used.
4. The result and its limits. The conclusion of the analysis carried out and a statement of when it would cease to hold.

Quantitative justification (obligatory). The chosen method is carried out with public or reasonably formulated data, and the result is presented as a range with stated assumptions, not as a single figure (A.1, stage E2). If Monte Carlo simulation is chosen, it is also stated how many iterations were used and why that number is sufficient according to formula (4.4) — the statement “10 000 iterations were used” without justification is not assessed.

When verifying AI results, the logic of Question 4.16 applies: it is first checked whether the figures are correct, and then whether they answer the question asked. There is no need to repeat the simulation, and it is not possible; what is checked is its construction — the data from which the distributions were built, the assumption about the period, whether the variables are treated as independent (section 4.1.2) and whether the confidence interval agrees with formula (4.4).

Submission. Up to 4 pages (records E1–E6), with the handover record and the unedited prompt log in an annex (A.3). After the seminar the defender submits a one-sentence reflection and the opponent a three-sentence summary (A.5, E7). The opponent’s core task in this assignment is specific: to show that the chosen depth of the method was too shallow or excessive.

References#

• Artzner, P., Delbaen, F., Eber, J.-M., & Heath, D. (1999). Coherent measures of risk. Mathematical Finance, 9(3), 203–228. https://doi.org/10.1111/1467-9965.00068
• Brealey, R. A., Myers, S. C., & Allen, F. (2020). Principles of Corporate Finance (13th ed.). McGraw-Hill.
• Chapman, C., & Ward, S. (2003). Project Risk Management: Processes, Techniques and Insights (2nd ed.). Wiley.
• Chermack, T. J., & Lynham, S. A. (2002). Definitions and outcome variables of scenario planning. Human Resource Development Review, 1(3), 366–383. https://doi.org/10.1177/1534484302013006
• Chermack, T. J., & Nimon, K. (2008). The effects of scenario planning on participant decision-making style. Human Resource Development Quarterly, 19(4), 351–372. https://doi.org/10.1002/hrdq.1245
• Cornell, B., & Damodaran, A. (2020). Valuing ESG: Doing good or sounding good? The Journal of Impact and ESG Investing, 1(1), 76–93. https://doi.org/10.3905/jesg.2020.1.1.076
• COSO. (2017). Enterprise Risk Management – Integrating with Strategy and Performance. Committee of Sponsoring Organizations of the Treadway Commission.
• Cox, L. A., Jr. (2008). What’s wrong with risk matrices? Risk Analysis, 28(2), 497–512. https://doi.org/10.1111/j.1539-6924.2008.01030.x
• Damodaran, A. (2012). Investment Valuation: Tools and Techniques for Determining the Value of Any Asset (3rd ed.). Wiley.
• Danielsson, J. (2011). Financial Risk Forecasting. Wiley.
• Eckhardt, R. (1987). Stan Ulam, John von Neumann, and the Monte Carlo method. Los Alamos Science, 15, 131–137.
• Fortune Business Insights. (2026). Risk analytics market size, share and industry analysis, by component, by risk type application, by deployment, by enterprise size, by industry and regional forecast, 2026–2034 (Report No. FBI102975; updated 12 October 2026). https://www.fortunebusinessinsights.com/risk-analytics-market-102975
• Global Market Insights. (2024). Risk analytics market size & share, industry forecasts 2024–2032 (Report No. GMI9133). https://www.gminsights.com/industry-analysis/risk-analytics-market
• Haeffner, M., Leone, D., Coons, L., & Chermack, T. (2012). The effects of scenario planning on participant perceptions of learning organization characteristics. Human Resource Development Quarterly, 23(4), 519–542. https://doi.org/10.1002/hrdq.21147
• Hertz, D. B. (1964). Risk analysis in capital investment. Harvard Business Review, 42(1), 95–106.
• Hillier, F. S. (1963). The derivation of probabilistic information for the evaluation of risky investments. Management Science, 9(3), 443–457.
• Iman, R. L., & Conover, W. J. (1982). A distribution-free approach to inducing rank correlation among input variables. Communications in Statistics – Simulation and Computation, 11(3), 311–334. https://doi.org/10.1080/03610918208812265
• Jorion, P. (2007). Value at Risk: The New Benchmark for Managing Financial Risk (3rd ed.). McGraw-Hill.
• Kahn, H. (1960). On Thermonuclear War. Princeton University Press.
• Kahn, H., & Wiener, A. J. (1967). The Year 2000: A Framework for Speculation on the Next Thirty-Three Years. Macmillan.
• Keating, C., & Shadwick, W. F. (2002). A universal performance measure. Journal of Performance Measurement, 6(3), 59–84.
• Knight, F. H. (1921). Risk, Uncertainty and Profit. Houghton Mifflin.
• Kupiec, P. H. (1995). Techniques for verifying the accuracy of risk measurement models. The Journal of Derivatives, 3(2), 73–84. https://doi.org/10.3905/jod.1995.407942
• Lessmann, S., Baesens, B., Seow, H.-V., & Thomas, L. C. (2015). Benchmarking state-of-the-art classification algorithms for credit scoring: An update of research. European Journal of Operational Research, 247(1), 124–136. https://doi.org/10.1016/j.ejor.2015.05.030
• Lundberg, S. M., & Lee, S.-I. (2017). A unified approach to interpreting model predictions. Advances in Neural Information Processing Systems 30 (pp. 4765–4774). Neural Information Processing Systems Foundation. https://proceedings.neurips.cc/paper/7062-a-unified-approach-to-interpreting-model-predictions.pdf
• Mandelbrot, B. (1963). The variation of certain speculative prices. The Journal of Business, 36(4), 394–419. https://doi.org/10.1086/294632
• Mandelker, G. N., & Rhee, S. G. (1984). The impact of the degrees of operating and financial leverage on systematic risk of common stock. Journal of Financial and Quantitative Analysis, 19(1), 45–57. https://doi.org/10.2307/2331000
• McKay, M. D., Beckman, R. J., & Conover, W. J. (1979). A comparison of three methods for selecting values of input variables in the analysis of output from a computer code. Technometrics, 21(2), 239–245. https://doi.org/10.1080/00401706.1979.10489755
• Metropolis, N., & Ulam, S. (1949). The Monte Carlo method. Journal of the American Statistical Association, 44(247), 335–341. https://doi.org/10.1080/01621459.1949.10483310
• Palar, P. S., Zuhal, L. R., & Shimoyama, K. (2023). Global sensitivity analysis in aerodynamic design using Shapley effects and polynomial chaos regression. IEEE Access, 11, 114825–114839. https://doi.org/10.1109/ACCESS.2023.3324918
• Phadnis, S., Caplice, C., Sheffi, Y., & Singh, M. (2015). Effect of scenario planning on field experts’ judgment of long-range investment decisions. Strategic Management Journal, 36(9), 1401–1411. https://doi.org/10.1002/smj.2293
• Rubinstein, R. Y., & Kroese, D. P. (2017). Simulation and the Monte Carlo Method (3rd ed.). Wiley. https://doi.org/10.1002/9781118631980
• Saltelli, A., Ratto, M., Andres, T., Campolongo, F., Cariboni, J., Gatelli, D., Saisana, M., & Tarantola, S. (2008). Global Sensitivity Analysis: The Primer. Wiley. https://doi.org/10.1002/9780470725184
• Schoemaker, P. J. H. (1995). Scenario planning: A tool for strategic thinking. Sloan Management Review, 36(2), 25–40.
• Schwartz, P. (1991). The Art of the Long View. Doubleday/Currency.
• Taleb, N. N. (2007). The Black Swan: The Impact of the Highly Improbable. Random House.
• TCFD. (2017). Recommendations of the Task Force on Climate-related Financial Disclosures. Financial Stability Board. https://www.fsb.org/uploads/P290617-5.pdf
• van der Heijden, K. (2005). Scenarios: The Art of Strategic Conversation (2nd ed.). Wiley.
• Van Horne, J. C. (1968). Financial Management and Policy. Prentice-Hall.
• Vose, D. (2008). Risk Analysis: A Quantitative Guide (3rd ed.). Wiley.
• Wack, P. (1985). Scenarios: Uncharted waters ahead. Harvard Business Review, 63(5), 73–89.