Methodology

What is single-event risk quantification?

Single-event risk quantification (Event Risk Exposure in the Monty & Co suite) is a Monte Carlo model of one risk event whose likelihood comes from multiple cause-drivers and whose consequence comes from multiple impact dimensions. The model tells you the distribution of total impact across simulated outcomes, ranks the drivers by how much variance they contribute, and — most usefully — measures the cost-benefit of hypothetical treatments.

Where Beau-Tie's bow-tie is the qualitative map of a risk and PRQ is the portfolio-level cost-risk simulator across a whole register, Event Risk sits between them: quantitative, single-event. It's the right tool when you have one specific risk you need to price honestly — a cyber event, a supply-chain failure, a litigation outcome — and you want to compare treatment options against their cost.

The model in plain English

Per iteration i of N:

For every cause, draw its likelihood probability from the configured input (TRI / PERT distribution OR 5-band rating). Apply the multiplicative reduction from every existing control whose targets include this cause.
Roll a uniform [0, 1) per cause. If any cause's roll falls below its post-reduction likelihood, the event fires for this iteration (any-of aggregation).
If the event fired, sample every impact's consequence from its distribution. Apply the multiplicative reduction from every existing control whose targets include this impact.
Total impact for this iteration = sum of post-reduction impact samples (or zero if the event didn't fire).

After all N iterations, sort the totals and read off percentiles. Event Risk reports P80 as its headline figure and P90 as the tail check.

Which level you report is a decision, not a default

The methodology does not privilege P80. Which percentile you report, and which one you fund, is an expression of risk appetite: ISO 31073:2022 defines appetite as the "amount and type of risk that an organization is willing to pursue or retain", and ISO 31000:2018 clause 5.2 puts establishing it with top management. Australian public infrastructure generally works in P50 and P90. You should be choosing this, and you should be able to see what the choice costs.

Event Risk now lets you. The Reported at chooser on the results panel selects P50, P75, P80, P90 or P95, defaulting to P80 as a starting point rather than a recommendation. The choice is stored on the envelope, so it travels with an export and is auditable after the fact, and switching never re-runs anything because every listed percentile came out of the same simulation — the same pattern PRQ uses for its funded percentile.

Why two simulation passes?

Every Run produces two simulated outcome distributions (when at least one treatment is defined):

Baseline — existing controls only. The current truth.
Treated — existing controls + every defined treatment, applied multiplicatively. The hypothetical "if we shipped everything in the treatment plan" outcome.

The two passes share random draws (paired sampling) so the baseline-vs-treated comparison is variance-reduced. This matters: with independent draws you'd need ~4× the iterations to detect a small treatment effect cleanly.

How does a treatment earn its cost?

Every treatment carries a cost and a reduction spec (likelihood / consequence / both). The results panel computes a marginal expected-loss reduction per treatment by re-running the simulation with every other treatment applied but THIS one omitted, then comparing the expected loss to the fully-treated case. Divide by the treatment's cost to get the ROI.

In plainer terms it is a leave-one-out marginal contribution: what this treatment adds once everything else in the plan is already in place. The same shape of calculation appears in capital allocation, where a business unit's contribution is measured as the increment it adds to the whole. We describe it that way rather than naming a specific published method, because we have not traced this exact formulation to one.

The property that matters when reading the table: the per-treatment marginal reductions do not sum to the total treatment effect, because treatments interact. Two treatments that both reduce the same cause will each look modest measured this way, since the other is already doing much of the work. That is a true statement about the value of adding one more, not an accounting error, and it is the right basis for a decision at the margin. Do not add the column up. The headline number is the portfolio ROI on the hero stat row; the per-treatment ROIs on the cost-benefit table answer "given I'm already buying the rest, is this one worth its cost?"

Two ways to express likelihood

The Likelihood input on each cause flips between two modes, because risk teams elicit likelihood two different ways depending on the workshop format:

Distribution mode (TRI / PERT)

Best when stakeholders can give you a probability triple — "low case 5%, most-likely 15%, high case 30%". Same three-parameter elicitation as PRQ's impact distributions but bounded to [0, 1]. Per-iteration the model samples a probability from the distribution, then rolls the trigger random against it.

Band mode (5-point rating)

Best when stakeholders are more comfortable on a qualitative scale — Very Unlikely / Unlikely / Possible / Likely / Almost Certain. Each band carries a configured probability (default: 10% / 30% / 50% / 70% / 90%; the five values are stored and editable per cause, an organisational calibration rather than policy). Per-iteration the model uses the band's configured probability directly.

Mix and match — a single envelope can have some causes in distribution mode and others in band mode. Same engine, same downstream sensitivity analysis.

How driver sensitivity is computed

The results panel ranks every cause / impact / control by its contribution to total variance. The method:

Causes + impacts: re-run the baseline simulation with this driver removed (cause's probability → 0; impact omitted from the sum). The drop in variance is that driver's contribution.
Controls: re-run baseline with this control disabled. The increase in variance is what the control was holding back. A "good" control gets a high score here because it's reducing variance in baseline.

All three lists are normalised against the baseline variance so their numbers are directly comparable. Caveats: variance shares don't sum to 100% (interactions), and a driver with very low base variance can rank low even if it's the only one you can practically treat — the tornado is one input, not the only input.

Where Event Risk is the wrong tool

Three patterns where you should reach for something else:

Multiple events at once. If you're trying to total exposure across many distinct risks, that's PRQ's job — Event Risk is one-event-per-envelope by design.
Pure qualitative work. If you don't have any quantitative inputs yet (no probabilities, no dollar consequences), start with Beau-Tie — it's the qualitative map. Event Risk can take that as a starting point later.
Conditional or sequential events. Event Risk treats causes as independent-any-of. If your scenario has "event A triggers event B which triggers event C" structure, a system-dynamics or Bayesian-network model is more honest.