# Spin of the wheel: the role and reality of Monte Carlo simulations.

Hurricane Katrina, September 11 and other recent disasters across the world represent tragic examples of worst-case events that have become an increasingly prominent--and permanent--feature of the modern risk management landscape. This has made the use of analytical tools such as Monte Carlo simulations more critical than ever when preparing for the kinds of doomsday situations that can ruin an enterprise overnight. But getting the most out of such methods can be anything but easy.

Monte Carlo methods are a widely used class of computational algorithms for simulating the behavior of various complex systems. They are different from other simulation methods in that they are in some way nondeterministic (usually by using random number generation). It is this inherent randomness that give a Monte Carlo simulation its name, since the random numbers it incorporates are not that dissimilar from the various games of chance found in a casino.

Because Monte Carlo methods use repetitive algorithms and a large hum her of calculations, they are best suited for computerized simulations. They are quite useful for studying inherently unpredictable systems, such as the calculation of risk in business. The extreme outcomes (e.g., 99th percentile) that can be generated by a Monte Carlo simulation, for example, can shed light on the critical risks a company is exposed to, highlighting that firm's likeliest worst-case scenarios. This is what makes Monte Carlo methods, as a whole, such a popular method of quantifying worst-case scenarios as a means of managing the risks they represent.

In a basic Monte Carlo simulation model, one assigns distributions to all the important uncertain parameters, then runs the simulation generating many thousands of scenarios. A probability weighting of parameter values is achieved by drawing from each distribution with a frequency proportional to the likelihood of the parameter's occurrence.

Monte Carlo has applications in many different industries. In banking, for example, with the new Basel II capital requirements, banks calculate how much credit they can offer their clients so that the bank has a 99.9% probability of sufficient capital by using historical data.

In areas such as business development, corporate finance and marketing, an increasing number of firms are also using Monte Carlo techniques to estimate values like the probability of a positive NPV or possible extreme outcomes of an investment (e.g., 1st and 99th percentiles).

While Monte Carlo simulation is a useful and potentially powerful technique to uncover possible worst-case scenarios and help your company plan for them, it is certainly not the only valuable technique available. A range of very useful but often less well-known techniques can be used either individually or together.

Using the Past to Plot the Future

Risk analysis models--Monte Carlo or otherwise--usually rely heavily on historical data to predict future scenarios. For example, credit risks for banks usually follow a fairly consistent pattern and can therefore be predicted with reasonable accuracy using a range of forecasting methods. Historical price data and leading indicators can be used to forecast commodity prices. While the reliance on historical data can be powerful and relatively "objective," one has to be careful when using it. Historical data will only tell you what risks your organization faces, and if patterns, risks or trends of the past can be replicated into the future. If the future business climate is likely to be considerably different from the past, it is important to take this into account through scenario building exercises.

Second, examine the role conservatism plays in a Monte Carlo simulation. Analysts often include some level of conservatism into their analysis (i.e., the model parameters reflect a "bad" scenario rather than an unbiased one). While this may seem logical at first glance, it is not advisable. Rather, perform an analysis that is as objective as possible. Decision-makers are then able to make conservative decisions based on the objective analysis (preventing a double layer of conservatism).

Third, have a plan for when no data or no reliable estimates are available. Too often businesses frantically attempt to use Monte Carlo simulation, while in reality, no reliable data exist to create an accurate model. This may result in forecasts that look plausible and satisfactory, but this situation is really "garbage in, garbage out." In situations with no data or reliable expert estimates, it is better to use qualitative or "semi-quantitative" techniques.

Fourth, make sure not to forget about any relevant risks. One of the best methods to identify a complete list of relevant risks is to have a brainstorming session with various experts. Before conducting a quantitative (Monte Carlo) analysis, always go through a qualitative stage such as a brainstorming session, which can be flexible enough to allow a wealth of ideas and problems to emerge among experts.

Fifth, the Monte Carlo model should include risks dictated by the results of the qualitative stage (a goal of which is to identify risks that do not need to be modeled quantitatively to know their effect and possible actions). For instance, a political scandal in a corporation may generate a complete cessation of operations due to the loss of an operating license. Although the obvious monetary impact of this is the complete loss of revenue, there is no need to quantify the dollar value of this event since the risk is obviously unacceptable for a corporation. The information collected in the qualitative stage will therefore already be enough to decide the optimal actions to take.

Sixth, worst-case scenarios are strongly affected by cascading risks and correlations, and not accurately accounting for them can result in greatly under- or overestimating the risks. At a real estate company, for example, revenues may decline when interest rates rise or when local employment drops. When both occur at the same time, however, they may have a larger effect than the sum of both individual effects.

Models should be simple (or at least they should start that way) and decision-focused. Try to create a model that answers only the question that needs to be answered. Since a model is only an abstract representation of reality, it helps to start building one with the most relevant risks identified in the qualitative stage and verify if the model is already a fair representation of the system. If the simple model is a good representation, the mission has been accomplished without investing a lot of time and resources into building complicated systems and estimating unnecessary parameters. If the simple model is not a good representation, then its complexity can always be increased with more data. Many times, analysts that have a very deep understanding of an organization try to model every aspect of it, resulting in a model that is often unnecessarily complex, overburdened with assumptions and unsuited for making pragmatic decisions.

Alternative Techniques

While the above comments on Monte Carlo simulation will help in conducting a quantitative analysis, there are several other techniques that can be used either in conjunction with or as an alternative to Monte Carlo simulation. Three techniques that have been found to be very effective are brainstorming sessions, risk registers and probability impact tables.

Brainstorming sessions. As mentioned previously, this useful technique can assist in identifying an organization's risks by gathering together a group of project stakeholders, under the direction of a neutral and reasonably strong-willed chairperson. The participants are encouraged to identify risks that they feel could have an impact on the organization, and possibly result in worst-case scenarios. The chairperson should try to ensure that a blameless and honest environment is maintained, and that each person is allowed to express his or her opinion regardless of status or personality. The group is encouraged to view each risk as it is identified and discuss what may be done to reduce its probability of occurrence and impacts. This aspect of a brainstorming session can be particularly valuable as newly identified risks can often be reduced, eliminated or discounted by agreed upon actions or extra information supplied from the involved parties.

Risk registers. A risk register (also known as a risk tracker in project risk) is a document or database that lists each risk pertaining to an organization or project, along with a variety of information that is useful for the management of those risks. The risks listed in a risk register will have come from a collective exercise to identify risks, such as a brainstorming session with the firm's relevant stakeholders.

In addition, a risk register has a summary that lists the top 10 or so risks that have the highest combination of probability of occurrence and impact (i.e. severity), after the reducing effects of any agreed upon risk reduction strategies have been included. Risk registers can be easily stored in a networked database, and they are a very effective way of sharing information about risks among relevant personnel within a firm. The finance director, lawyers, etc., can look at all the risks from any project being managed, and the chief executive can look at the major risks to the organization as a whole. In addition, the head office has an easier means for assessing the threat posed by a risk that may impact several projects or departments. So called "dashboard" software can enable this by bringing the outputs of a risk register into an appropriate format for decision-makers, helping them identify and prepare for possible worst-case scenarios.

Probability impact tables. The risk identification stage attempts to identify all risks that threaten the achievement of an organization's goals. It is clearly important, however, that attention is focused on those risks that pose the greatest threat. A frequently used technique to determine the risks with the greatest threat is creating probability impact (PI) tables.

A qualitative assessment of the probability (P) of a risk event (a possible event that would produce a negative impact on an organization), and the impact(s) it would produce (I), can be made by assigning descriptions to the magnitudes of these probabilities and impacts. The assessor is asked to describe the probability and impact of each risk, selecting from a predetermined set of phrases like: None, Very Low, Low, Medium, High and Very High. A range of values is assigned to each phrase in order to maintain consistency between the estimates of each risk.

A PI table offers a quick way to visualize the relative possibility of all identified risks that pertain to an organization. While a PI table can be used to make decisions on what risks will most likely result in worst-case scenarios, and therefore should be focused on, it can also be used to identify which risks should be focused on when developing a quantitative risk analysis such as a Monte Carlo simulation.

What Next?

Do not assume the future will follow your best-guess scenario, because it almost certainly will not. Instead, prepare for unexpected events to happen, including worst-case scenarios. A range of techniques is available to help the risk manager identify which risks are most likely to result in worst-case scenarios and the risks on which you should focus most of your attention. While Monte Carlo simulation is one of the most powerful and well-known techniques, qualitative or semi-qualitative techniques can be very useful or can be used as a predecessor to more quantitative methods.

Remember that while many risks can be somewhat "predicted" using historical data or events, the hardest risks for a business to deal with are often the ones that have not yet happened. It is therefore important to not only consider historical risks but also discuss scenarios that have not yet happened but may occur in the future.

Finally, while any company's focus should be on the proper identification and quantification of risks to help better plan for worst-case scenarios, only after the necessary actions are taken will it truly be better prepared for the future. While this is an obvious point, it is also an overlooked one. An informed and prepared organization, however, will have a significant competitive advantage when dealing with worst-case scenarios.

Huybert Groenendaal, Ph.D, MBA, is managing partner of Vose Consulting, based in Boulder, Colorado. Francisco Zagmutt, BVSc, MV, MPVM, is senior risk analysis consultant at Vose Consulting.
COPYRIGHT 2006 Risk Management Society Publishing, Inc.
No portion of this article can be reproduced without the express written permission from the copyright holder.