What is single-event risk quantification?

Single-event risk quantification (Event Risk Exposure in the Monty & Co suite) is a Monte Carlo model of one risk event whose likelihood comes from multiple cause-drivers and whose consequence comes from multiple impact dimensions. The model tells you the distribution of total impact across simulated outcomes, ranks the drivers by how much variance they contribute, and — most usefully — measures the cost-benefit of hypothetical treatments.

Where Beau-Tie's bow-tie is the qualitative map of a risk and PRQ is the portfolio-level cost-risk simulator across a whole register, Event Risk sits between them: quantitative, single-event. It's the right tool when you have one specific risk you need to price honestly — a cyber event, a supply-chain failure, a litigation outcome — and you want to compare treatment options against their cost.

The model in plain English

Per iteration i of N:

1. For every cause, draw its likelihood probability from the configured input (TRI / PERT distribution OR 5-band rating). Apply the multiplicative reduction from every existing control whose targets include this cause.
2. Roll a uniform [0, 1) per cause. If any cause's roll falls below its post-reduction likelihood, the event fires for this iteration (any-of aggregation).
3. If the event fired, sample every impact's consequence from its distribution. Apply the multiplicative reduction from every existing control whose targets include this impact.
4. Total impact for this iteration = sum of post-reduction impact samples (or zero if the event didn't fire).

After all N iterations, sort the totals and read off percentiles. P80 is the headline contingency number; P90 is the tail check (same conventions as PRQ).

Why two simulation passes?

Every Run produces two simulated outcome distributions (when at least one treatment is defined):

• Baseline — existing controls only. The current truth.
• Treated — existing controls + every defined treatment, applied multiplicatively. The hypothetical "if we shipped everything in the treatment plan" outcome.

The two passes share random draws (paired sampling) so the baseline-vs-treated comparison is variance-reduced. This matters: with independent draws you'd need ~4× the iterations to detect a small treatment effect cleanly.

How treatments earn their cost

Every treatment carries a cost and a reduction spec (likelihood / consequence / both). The results panel computes a marginal expected-loss reduction per treatment by re-running the simulation with every other treatment applied but THIS one omitted, then comparing the expected loss to the fully-treated case. Divide by the treatment's cost to get the ROI.

This is the "marginal attribution under joint treatment" method from capital-allocation literature. Important property: the per-treatment marginal reductions don't sum to the total treatment effect (treatments interact). The headline number is the portfolio ROI on the hero stat row; the per-treatment ROIs on the cost-benefit table answer "given I'm already buying the rest, is this one worth its cost?"

Two ways to express likelihood

The Likelihood input on each cause flips between two modes, because risk teams elicit likelihood two different ways depending on the workshop format:

Distribution mode (TRI / PERT)

Best when stakeholders can give you a probability triple — "low case 5%, most-likely 15%, high case 30%". Same three-parameter elicitation as PRQ's impact distributions but bounded to [0, 1]. Per-iteration the model samples a probability from the distribution, then rolls the trigger random against it.

Band mode (5-point rating)

Best when stakeholders are more comfortable on a qualitative scale — Very Unlikely / Unlikely / Possible / Likely / Almost Certain. Each band carries a configured probability (default: 2% / 5% / 20% / 50% / 85%, but tunable per cause). Per-iteration the model uses the band's configured probability directly.

Mix and match — a single envelope can have some causes in distribution mode and others in band mode. Same engine, same downstream sensitivity analysis.

How driver sensitivity is computed

The results panel ranks every cause / impact / control by its contribution to total variance. The method:

• Causes + impacts: re-run the baseline simulation with this driver removed (cause's probability → 0; impact omitted from the sum). The drop in variance is that driver's contribution.
• Controls: re-run baseline with this control disabled. The increase in variance is what the control was holding back. A "good" control gets a high score here because it's reducing variance in baseline.

All three lists are normalised against the baseline variance so their numbers are directly comparable. Caveats: variance shares don't sum to 100% (interactions), and a driver with very low base variance can rank low even if it's the only one you can practically treat — the tornado is one input, not the only input.

Where Event Risk is the wrong tool

Three patterns where you should reach for something else:

• Multiple events at once. If you're trying to total exposure across many distinct risks, that's PRQ's job — Event Risk is one-event-per-envelope by design.
• Pure qualitative work. If you don't have any quantitative inputs yet (no probabilities, no dollar consequences), start with Beau-Tie — it's the qualitative map. Event Risk can take that as a starting point later.
• Conditional or sequential events. Event Risk treats causes as independent-any-of. If your scenario has "event A triggers event B which triggers event C" structure, a system-dynamics or Bayesian-network model is more honest.